WOL

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:33 AM UTC
• Version: 1.0.2

Overview

This Wake-on-LAN skill does what it claims, but it has review-worthy gaps around shell invocation safety, MAC address exposure, and unconfirmed device deletion.

Review before installing. This skill is not clearly malicious, but only use it if you are comfortable with an agent sending WOL packets on your local network and modifying a stored device list. Treat device names, MAC addresses, and IP addresses as sensitive, and prefer explicit confirmation before add/delete/wake actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wol.py:119

Finding

Full MAC Addresses Disclosed in Command Output

Content

View full analysis

Vulnerability Details

File Location: scripts/wol.py:119, scripts/wol.py:213, scripts/wol.py:242, and scripts/wol.py:249
Vulnerability Type: Sensitive information disclosure
Risk Level: Medium

Vulnerable Code

python

print(f"✓ Device '{name}' added: MAC={mac}, IP={ip}, Subnet={subnet_mask}")

python

print(f"✓ Magic packet sent to {mac_address}")

python

print(f"Found {target} in devices as '{name}': {mac}")
return mac, subnet, target

python

print(f"Found {target} in ARP cache: {mac}")
return mac, None, target

Technical Analysis

The script defines and uses mask_mac() when listing or showing devices, but several other execution paths print complete MAC addresses. This is inconsistent with the privacy controls specified in SKILL.md, which state that full MAC addresses must not be exposed through conversation.

The affected values can originate from the persistent YAML configuration, user input supplied during device creation, or the local ARP cache. Because script output can be returned to the invoking AI agent, recorded in execution logs, or included in conversation context, these statements bypass the intended masking boundary.

Attack Path

1. A user asks the agent to add a device or wake a device by its configured name or IP address.
2. The agent invokes wol.py according to the Skill instructions.
3. The script obtains a complete MAC address from command-line input, references/devices.yaml, or the local ARP cache.
4. One of the affected logging statements prints the complete address.
5. The tool output is captured by the agent platform and may be exposed in conversation history or logs.

Impact Assessment

Successful exploitation reveals hardware identifiers associated with configured or locally discoverable devices. The issue does not grant additional operating-system privileges or directly enable code execution. Its scope is ...[truncated 201 chars]

Remediation

View remediation

Remediation Suggestions

Apply mask_mac() consistently to every MAC address included in user-facing or agent-facing output:

python

print(
    f"✓ Device '{name}' added: "
    f"MAC={mask_mac(mac)}, IP={ip}, Subnet={subnet_mask}"
)

print(f"✓ Magic packet sent to {mask_mac(mac_address)}")

print(
    f"Found {target} in devices as '{name}': "
    f"{mask_mac(mac)}"
)

print(
    f"Found {target} in ARP cache: "
    f"{mask_mac(mac)}"
)

Prefer omitting MAC addresses entirely from success and resolution messages where they are not operationally necessary. Add automated tests that capture standard output from add and wake operations and verify that no complete MAC address appears. Review error messages and future logging additions under the same sensitive-data policy.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:13

Finding

Unsafe Shell Command Templates for Conversation-Derived Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:13-16, SKILL.md:25-28, SKILL.md:41-49
Vulnerability Type: Potential shell command injection at the agent invocation boundary
Risk Level: Medium

Vulnerable Instructions

bash

python3 ~/.openclaw/workspace/skills/wol/scripts/wol.py --target <target>

bash

python3 ~/.openclaw/workspace/skills/wol/scripts/wol.py --add-device <name> <mac> <ip> <subnet_mask>

bash

python3 ~/.openclaw/workspace/skills/wol/scripts/wol.py --delete-device <name>

bash

python3 ~/.openclaw/workspace/skills/wol/scripts/wol.py --show-device <name>

Technical Analysis

The documented commands place conversation-derived target and device values directly into shell command templates without requiring shell-safe quoting, an argument-vector execution API, or strict validation before invocation. Although wol.py safely invokes arp using a list of arguments and does not itself use shell=True, the Skill documentation can cause an agent to interpolate untrusted text into a separate shell command.

Device names are only checked for non-emptiness inside add_device(), while target and name arguments can otherwise contain shell metacharacters. Validation performed by Python occurs too late if a shell has already interpreted the constructed command.

Exploitability depends on the hosting agent executing these templates through a shell with literal string interpolation. A structured process API that passes each value as a distinct argument would prevent this attack.

Attack Path

1. An attacker submits a wake or device-management request containing shell syntax in the target or device name.
2. The agent extracts that text as the command placeholder value.
3. The agent constructs one of the documented commands without safely quoting the value.
4. If the command is executed through a shell, the shell inter ...[truncated 656 chars]

Remediation

View remediation

Remediation Suggestions

Require the agent to invoke the script using a structured process API with an explicit argument array rather than constructing a shell command string. For example, the conceptual argument vector should be:

text

[
  "python3",
  "/absolute/path/to/scripts/wol.py",
  "--target",
  user_supplied_target
]

Update SKILL.md to explicitly prohibit direct shell interpolation. If shell execution cannot be avoided, require a well-tested platform-specific quoting function for every dynamic value.

Add strict input validation as defense in depth. Device names should use a conservative allowlist such as letters, digits, spaces, underscores, and hyphens with a reasonable length limit. IP addresses should be parsed with Python's ipaddress module. Keep MAC validation inside the script, but do not rely on script-side validation to protect a shell invocation that occurs before Python receives the arguments.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents use of shell execution plus file read/write behavior, but declares no explicit tool scope or permissions. In an agent environment, this creates excessive implicit authority and increases the chance the skill can invoke commands or modify files beyond what reviewers and policy expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The catch-all trigger for 'any WOL/device management requests in Chinese' is overly broad and can activate the skill for loosely related requests. Overbroad activation increases the chance of unintended execution of network operations or device configuration changes when user intent is ambiguous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description states the skill should be used for "any WOL/device management requests in Chinese," which imposes a language-specific activation policy. The file does not offer user opt-in, multilingual support, or a documented reason that the skill must be restricted to Chinese.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill claims MAC addresses are masked and should never be revealed, but its own examples show full MAC addresses in conversational usage and command invocations. This inconsistency can cause the agent to solicit, repeat, or expose sensitive network identifiers, undermining the stated privacy control.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 75% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

2. **Configuration File Access**: Do NOT read or show the contents of `references/devices.yaml` to users. This file contains sensitive MAC addresses. The script handles all operations internally.

3. **Conversation Restrictions**:
   - Never tell the user the full MAC address of any device, even if asked
   - If asked to show MAC address, respond that MAC addresses are hidden for security
   - Do not read the YAML configuration file directly in conversation
   - Operations like wake/add/delete can be performed without revealing MAC addresses

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The delete_device flow removes an entry from the in-memory device list, saves the updated YAML file, and prints success immediately. Although the function has a brief docstring, there is no user confirmation step or explicit warning that this operation permanently modifies the stored device configuration.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/wol.py (reported line 167)May include surrounding context.

python

def get_mac_from_arp(ip):
    """Try to get MAC address from ARP cache."""
    try:
        result = subprocess.run(['arp', '-n', ip], capture_output=True, text=True)
        for line in result.stdout.split('\n'):
            if ip in line:
                # Format: address           ether (ethernet)   [ether] on en0

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Throughout the script, all help text, errors, warnings, and status output are hard-coded in English. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation when no locale selection or documented justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.