ClawHub
Back to skill

Security audit

cz-studio-agent

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Studio Agent bridge, but it should be reviewed because it can silently approve remote action requests and expose the auth token in local config output.

Install only if you trust the configured Studio endpoint and understand that requests and identity metadata are sent to that service. Before use, set `CZ_INTERRUPT_DECISION_MODE` to `off` or `auto_reject`, avoid broad `CZ_ALWAYS_ALLOW_TOOLS`, keep the OpenClaw config private, and do not paste validate/apply output containing `CZ_AGENT_WS_URL` into logs or support chats. Rotate any token that has already appeared in command output or shared transcripts.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/cz-agent-proxy.mjs:1108
Finding

Remote tool actions are automatically approved without explicit user authorization

Content
View full analysis
0 ) { decisionMetadata.always_allow_tools = [...baseMetadata.always_allow_tools]; } const decisionMessage = { op_type: "interrupt_decision", identity: this.activeRequest.identity, request_id: message.requestId, conversation_id: message.conversationId, interrupt_decisions: interruptDecisions, timestamp: nowMs(), metadata: decisionMetadata, }; const sent = await this.sendStudioMessage(decisionMessage); if (!sent) { this.emitActiveNetworkError("failed to send interrupt_decision to Studio WebSocket"); return false; } ``` The one-shot runner establishes the unsafe default: ```js if (!asTrimmedString(env.CZ_INTERRUPT_DECISION_MODE)) { env.CZ_INTERRUPT_D ...[truncated 2170 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/configure-skill.mjs:306
Finding

Authentication token is exposed through plaintext WebSocket URLs and configuration output

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (25)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
- A local proxy script: `scripts/cz-agent-proxy.mjs`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md
- A local proxy script: `scripts/cz-agent-proxy.mjs`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
- A local proxy script: `scripts/cz-agent-proxy.mjs`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md
- A local proxy script: `scripts/cz-agent-proxy.mjs`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
- A one-shot runner script: `scripts/cz-agent-oneshot.mjs` (recommended default)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
- A one-shot runner script: `scripts/cz-agent-oneshot.mjs` (recommended default)

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The script persists sensitive connection material into the OpenClaw config under the skill's env, and earlier logic embeds x-clickzetta-token directly into CZ_AGENT_WS_URL. Writing secrets into a local JSON config file increases exposure through filesystem disclosure, backups, logs, shell history from dry-run output, or accidental sharing of the config file.

Content

Scanner excerpt · scripts/configure-skill.mjs (reported line 646)May include surrounding context.

js
}

  const diff = diffKeys(before, next);
  config.skills.entries[SKILL_KEY].env = next;

  if (opts.dryRun) {
    console.error(`\n[dry-run] target config: ${configPath}`);

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cz-agent-oneshot.mjs (reported line 136)May include surrounding context.

js
const parsed = JSON.parse(raw);
  const env = parsed?.skills?.entries?.[SKILL_KEY]?.env;
  if (!isRecord(env)) {
    throw new Error(`Missing skills.entries.${SKILL_KEY}.env in ${fullPath}`);
  }
  return { configPath: fullPath, env };
}

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The proxy defaults CZ_INTERRUPT_DECISION_MODE to auto_approve, and later automatically sends interrupt_decision messages approving tool/action requests without any user confirmation. In an agent bridge, this removes the safety gate around privileged tool execution and can allow a remote agent or compromised backend workflow to perform unintended actions automatically.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill instructs users to place real tokens and connection details into a local config and then apply them into runtime environment settings, but it gives no explicit warning about credential sensitivity, storage risks, or log exposure. In a skill that bridges to a remote agent over WebSocket, this increases the chance of accidental credential disclosure through config files, process environments, command history, or platform config persistence.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
## Execution policy

- Do not ask the user for `CZ_*` env vars up front.
- Assume env is already wired via OpenClaw config (`skills.entries["studio-agent"].env`) unless runtime errors prove otherwise.
- When runtime reports missing/invalid Studio config, return a copy-paste setup block:
  - `cp skills/studio-agent/studio-agent.config.example.json studio-agent.config.json`

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
96% confidence
Finding

Defaulting CZ_INTERRUPT_DECISION_MODE=auto_approve gives the system authority to make approval decisions automatically during an interaction with a remote agent. In this skill's context, that is materially more dangerous because the bridge is designed to relay multi-turn requests to an external service that may trigger follow-up actions, so automatic approval can bypass user intent and consent.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md
- For `user_input`, the proxy auto-normalizes metadata to frontend-compatible shape:
  - default `metadata.source = "openclaw"` when missing
  - default `metadata.configs = [{"type":"text","value":"<user_input>"}]` when missing
- For `interrupt_request`, proxy auto-sends `interrupt_decision` by default (`CZ_INTERRUPT_DECISION_MODE=auto_approve`) so requests do not hang waiting for manual confirmation.
- Proxy defaults to compact output for OpenClaw context safety:
  - `CZ_EMIT_ASSISTANT_DELTAS=false` by default (only `assistant_final` / `error` are emitted)
  - when deltas are enabled, `content` is omitted from delta events to avoid repeated cumulative payloads

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that interrupt requests are auto-approved by default, without any user-facing warning or confirmation requirement. Because this bridge delegates work to a remote agent that may perform task, query, or tool-related actions, automatic approval can allow the remote side to continue or authorize sensitive operations without meaningful human review.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

Documenting CZ_INTERRUPT_DECISION_MODE with auto_approve as the default normalizes autonomous approval behavior and encourages insecure deployment choices. While this line is a configuration reference rather than executable logic, in context it directly supports a risky default for a remote-agent bridge capable of carrying privileged actions.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md
- `CZ_STARTUP_CONNECT_TIMEOUT_SECONDS` (default `10`)
- `CZ_RECONNECT_MAX_ATTEMPTS` (default `3`)
- `CZ_ALWAYS_ALLOW_TOOLS` (optional): comma-separated tool names injected as `metadata.always_allow_tools` when request metadata omits it
- `CZ_INTERRUPT_DECISION_MODE` (optional): `auto_approve` (default) | `auto_reject` | `off`
- `CZ_EMIT_ASSISTANT_DELTAS` (optional, default `false`): emit `assistant_delta` events when true

Optional identity enrichments (recommended for task/query permissions in some Studio deployments):

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/configure-skill.mjs (reported line 85)May include surrounding context.

js
"Input expectation (minimal):",
    "  wsUrl/baseUrl (host:port or ws URL), token, instanceId, instanceName, projectId, workspace",
    "  optional: alwaysAllowTools (comma-separated tool names)",
    "  optional: interruptDecisionMode (auto_approve|auto_reject|off), emitAssistantDeltas (true|false)",
    "  Script builds CZ_AGENT_WS_URL as: <base>/<path>?x-clickzetta-token=<token>&env=prod",
    "  default scheme policy when scheme missing: local -> ws://, remote -> wss://",
    "  default path policy when path missing: local -> /ws, remote -> /ai",

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/cz-agent-proxy.mjs (reported line 187)May include surrounding context.

js
"Input expectation (minimal):",
    "  wsUrl/baseUrl (host:port or ws URL), token, instanceId, instanceName, projectId, workspace",
    "  optional: alwaysAllowTools (comma-separated tool names)",
    "  optional: interruptDecisionMode (auto_approve|auto_reject|off), emitAssistantDeltas (true|false)",
    "  Script builds CZ_AGENT_WS_URL as: <base>/<path>?x-clickzetta-token=<token>&env=prod",
    "  default scheme policy when scheme missing: local -> ws://, remote -> wss://",
    "  default path policy when path missing: local -> /ws, remote -> /ai",

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/cz-agent-proxy.mjs (reported line 188)May include surrounding context.

js
"Input expectation (minimal):",
    "  wsUrl/baseUrl (host:port or ws URL), token, instanceId, instanceName, projectId, workspace",
    "  optional: alwaysAllowTools (comma-separated tool names)",
    "  optional: interruptDecisionMode (auto_approve|auto_reject|off), emitAssistantDeltas (true|false)",
    "  Script builds CZ_AGENT_WS_URL as: <base>/<path>?x-clickzetta-token=<token>&env=prod",
    "  default scheme policy when scheme missing: local -> ws://, remote -> wss://",
    "  default path policy when path missing: local -> /ws, remote -> /ai",

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/cz-agent-proxy.mjs (reported line 1118)May include surrounding context.

js
"Input expectation (minimal):",
    "  wsUrl/baseUrl (host:port or ws URL), token, instanceId, instanceName, projectId, workspace",
    "  optional: alwaysAllowTools (comma-separated tool names)",
    "  optional: interruptDecisionMode (auto_approve|auto_reject|off), emitAssistantDeltas (true|false)",
    "  Script builds CZ_AGENT_WS_URL as: <base>/<path>?x-clickzetta-token=<token>&env=prod",
    "  default scheme policy when scheme missing: local -> ws://, remote -> wss://",
    "  default path policy when path missing: local -> /ws, remote -> /ai",

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The runner constructs the child environment by cloning the entire parent process environment and then overlaying selected CZ_ variables from the skill config. This can unintentionally forward unrelated secrets, tokens, proxy settings, and credentials to the local proxy process and any remote service it communicates with, expanding the blast radius if the proxy or downstream agent is compromised or logs its environment.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Defaulting CZ_INTERRUPT_DECISION_MODE to "auto_approve" enables autonomous approval behavior when no safer setting is configured. For a skill that brokers requests to a remote agent, this reduces human oversight and can permit unintended actions or sensitive data handling to proceed automatically.

Content

Scanner excerpt · scripts/cz-agent-oneshot.mjs (reported line 156)May include surrounding context.

js
env.CZ_REQUEST_TIMEOUT_SECONDS = String(opts.requestTimeoutSeconds);
  env.CZ_STARTUP_CONNECT_TIMEOUT_SECONDS = String(opts.startupTimeoutSeconds);
  if (!asTrimmedString(env.CZ_INTERRUPT_DECISION_MODE)) {
    env.CZ_INTERRUPT_DECISION_MODE = "auto_approve";
  }
  if (!asTrimmedString(env.CZ_EMIT_ASSISTANT_DELTAS)) {
    env.CZ_EMIT_ASSISTANT_DELTAS = "false";

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script automatically spawns a subprocess, sends user-provided input to it, and gives it the inherited environment without any confirmation, disclosure, or safety gate. In this skill's context, the proxy bridges to a remote Studio Agent over WebSocket, so local prompts and ambient credentials may be transmitted off-host even when the user may not realize the execution and forwarding semantics.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

The literal default of auto_approve means the system is intentionally configured for autonomous approval of interrupt requests unless overridden. In this skill context, interrupts appear to represent tool/action approval checkpoints, so bypassing them materially increases the chance of unsafe remote actions.

Content

Scanner excerpt · scripts/cz-agent-proxy.mjs (reported line 14)May include surrounding context.

js
const DEFAULT_ALWAYS_ALLOW_TOOLS = readStringListEnv("CZ_ALWAYS_ALLOW_TOOLS");
const DEFAULT_INTERRUPT_DECISION_MODE = readInterruptDecisionModeEnv(
  "CZ_INTERRUPT_DECISION_MODE",
  "auto_approve",
);
const DEFAULT_EMIT_ASSISTANT_DELTAS = readBoolEnv("CZ_EMIT_ASSISTANT_DELTAS", false);

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/cz-agent-proxy.mjs (reported line 187)May include surrounding context.

js
return fallback;
  }
  const normalized = value.toLowerCase();
  if (["auto_approve", "approve", "auto-approve"].includes(normalized)) {
    return "auto_approve";
  }
  if (["auto_reject", "reject", "auto-reject"].includes(normalized)) {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The proxy establishes a WebSocket connection and includes authentication data in the URL, then sends messages containing identity fields and token-derived data. There is no visible print/log statement, prompt, or explanatory comment warning users that user/system identity data will be transmitted to a remote service.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/cz-agent-oneshot.mjs:238