ClawHub
Back to skill

Security audit

Colmena Manager

Security checks for vulnerabilities and agentic risk

Overview

This agent-management skill is review-worthy because it exposes powerful local workspace and agent controls through unsafe shell commands that can delete data or run unintended commands.

Review before installing. Use this only in a contained OpenClaw environment where the operator trusts all agent IDs and workspace names, and avoid exposing the CLI to untrusted input. The workspace remove command should be treated as permanent deletion, and the shell-based implementation should be fixed with strict input validation and filesystem/process APIs before production use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
src/index.js:66
Finding

Command Injection in Agent Log Retrieval

Content
View full analysis

Vulnerability Details

File Location: src/index.js, lines 66-76
Vulnerability Type: OS command injection through unvalidated CLI arguments
Risk Level: High

js
async logs(agentId: string, lines: number = 50): Promise<void> {
  try {
    const result = await exec({
      command: `tail -n ${lines} /home/nvi/.openclaw/sessions/${agentId}/logs.txt`,
      timeout: 5
    });
    console.log(`Logs de ${agentId} (últimas ${lines} líneas):`);
    console.log(result.stdout);
  } catch (error) {
    console.log(`Error al obtener logs: ${error}`);
  }
}

The affected parameters are populated directly from CLI arguments:

js
case "logs":
  if (args.length < 2) {
    console.log("Uso: logs <agent> [líneas]");
  } else {
    const lines = args.length > 2 ? parseInt(args[2]) : 50;
    manager.logs(args[1], lines);
  }
  break;

Technical Analysis

The agentId value is inserted directly into a shell command passed to exec. No allowlist validation, shell escaping, canonical path verification, or argument separation is performed. Shell metacharacters in a crafted agent identifier can therefore alter the intended command and append additional shell operations.

The lines argument is passed through parseInt, which limits some direct injection opportunities through that parameter, but the result is not checked for finiteness, positivity, or a safe upper bound. The directly interpolated agentId remains the primary command-injection vector.

Attack Path

  1. An attacker obtains the ability to invoke the colmena-manager logs CLI, either directly or through a service that exposes this command.
  2. The attacker supplies an agent identifier containing shell syntax.
  3. The CLI forwards the value through args[1] to manager.logs().
  4. The value is interpolated into exec.command.
  5. The system shell interprets the injected syntax and executes attac ...[truncated 531 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace shell-based log retrieval with Node.js filesystem APIs and implement bounded tail-reading logic without invoking a shell.
  • Validate agent identifiers against a strict allowlist such as ^[A-Za-z0-9_-]+$.
  • Resolve the requested log path with path.resolve() and verify that it remains beneath the canonical sessions directory.
  • Reject symbolic links or otherwise ensure they cannot redirect access outside the intended directory.
  • Require the line count to be a finite integer within a conservative range, such as 1 through 10,000.
  • If an external executable must be used, call it through execFile or spawn with a separate argument array and shell: false.
  • Return a nonzero exit status when validation fails, and avoid including sensitive command details in error messages.

T09 · Insecure Skill Coding Practices

Error
Location
src/index.js:124
Finding

Command Injection Through Registered Agent Identifiers During Health Checks

Content
View full analysis

Vulnerability Details

File Location: src/index.js, lines 124-130 and 148-154
Vulnerability Type: OS command injection through untrusted agent metadata
Risk Level: High

js
// Check proceso
try {
  const result = await exec({
    command: `ps aux | grep ${agent.id} | grep -v grep | wc -l`,
    timeout: 3
  });
  const count = parseInt(result.stdout.trim());
  console.log(`  Proceso: ${count > 0 ? "ACTIVO" : "INACTIVO"}`);
  if (count === 0) allHealthy = false;
} catch (error) {
  console.log(`  ERROR proceso: ${error}`);
  allHealthy = false;
}
js
async checkMemory(agentId: string): Promise<{used: number; total: number}> {
  const result = await exec({
    command: `ps aux | grep ${agentId} | grep -v grep | awk '{sum+=$6} END {print sum}'`,
    timeout: 3
  });
  const usedMB = parseInt(result.stdout.trim()) / 1024;
  
  return {
    used: Math.round(usedMB),
    total: 2048 // Asumir 2GB por defecto
  };
}

Technical Analysis

healthCheck() retrieves agent records from agents_list() and inserts each agent.id into shell pipelines without validation or escaping. Although the identifier is not entered directly through this command's CLI arguments, agent metadata should not be treated as inherently safe. A malicious, compromised, or improperly validated registration source could provide an identifier containing shell syntax.

Both process inspection and memory inspection use shell pipelines. Consequently, shell control operators, command substitution, expansion syntax, or redirections contained in an agent identifier can be interpreted by the shell rather than treated as literal process-search text.

Attack Path

  1. An attacker gains the ability to register an agent or modify the identifier of an agent returned by agents_list().
  2. The attacker assigns an identifier containing shell metacharacters and an injected operation.
  3. An ope ...[truncated 1008 chars]
Remediation
View remediation

Remediation Suggestions

  • Treat all values returned by agent APIs as untrusted and validate identifiers against a strict allowlist before use.
  • Avoid shell pipelines for process discovery. Use a process-inspection library or invoke ps through execFile/spawn with fixed arguments and shell: false, then perform filtering and memory aggregation in JavaScript.
  • Never concatenate an identifier into a command string, even if registration is expected to validate it elsewhere.
  • Apply validation both when agents are registered and immediately before any sensitive local operation.
  • Run the manager under a dedicated, minimally privileged operating-system account.
  • Add tests using identifiers containing spaces, shell operators, substitutions, quotes, wildcard characters, and leading hyphens to verify rejection.

T09 · Insecure Skill Coding Practices

Error
Location
src/index.js:175
Finding

Command Injection in Workspace Creation

Content
View full analysis

Vulnerability Details

File Location: src/index.js, lines 175-183
Vulnerability Type: OS command injection and unsafe path construction
Risk Level: High

js
async workspaceCreate(name: string): Promise<void> {
  try {
    await exec({
      command: `mkdir -p /home/nvi/.openclaw/workspace-${name}`,
      timeout: 5
    });
    console.log(`Workspace ${name} creado`);
  } catch (error) {
    console.log(`Error: ${error}`);
  }
}

The workspace name originates from a CLI argument:

js
case "create":
  if (args.length < 3) {
    console.log("Uso: workspace create <nombre>");
  } else {
    manager.workspaceCreate(args[2]);
  }
  break;

Technical Analysis

The workspace name is appended directly to a shell command without validation, quoting, or escaping. Because exec executes the constructed string through a shell, a crafted name can terminate or modify the intended mkdir command and introduce an additional command.

The code also builds the target path through string concatenation. Names containing traversal components or special path syntax are not rejected, so even a non-shell interpretation would not provide a reliable guarantee that the resulting directory is an immediate child of the intended workspace base.

Attack Path

  1. An attacker invokes workspace create or controls a caller that forwards a workspace name to it.
  2. The attacker supplies a name containing shell syntax or path-manipulation components.
  3. The CLI passes args[2] to workspaceCreate().
  4. The value is concatenated into the mkdir -p command.
  5. The shell interprets the crafted syntax and executes an attacker-selected operation, or creates directories outside the intended naming boundary.
  6. All resulting operations run with the privileges of the manager process.

Impact Assessment

Shell injection can provide arbitrary command execution and therefor ...[truncated 360 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace mkdir -p with fs.promises.mkdir(target, { recursive: true }).
  • Permit only simple workspace names matching an explicit allowlist such as ^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$.
  • Reject dots, path separators, control characters, shell metacharacters, leading hyphens, and empty names.
  • Construct the target with path.resolve(baseDirectory, "workspace-" + name).
  • Verify that the resolved target is an immediate child of the expected base directory before creating it.
  • Run workspace management under a dedicated account with write access limited to the workspace root.
  • Add authorization checks if untrusted users or remote callers can reach workspace-management commands.

T09 · Insecure Skill Coding Practices

Error
Location
src/index.js:186
Finding

Command Injection and Arbitrary Recursive Deletion in Workspace Removal

Content
View full analysis

Vulnerability Details

File Location: src/index.js, lines 186-194
Vulnerability Type: OS command injection and unsafe recursive filesystem deletion
Risk Level: Critical

js
async workspaceRemove(name: string): Promise<void> {
  try {
    await exec({
      command: `rm -rf /home/nvi/.openclaw/workspace-${name}`,
      timeout: 10
    });
    console.log(`Workspace ${name} eliminado`);
  } catch (error) {
    console.log(`Error: ${error}`);
  }
}

The workspace name originates from a CLI argument:

js
case "remove":
  if (args.length < 3) {
    console.log("Uso: workspace remove <nombre>");
  } else {
    manager.workspaceRemove(args[2]);
  }
  break;

Technical Analysis

This method combines untrusted string interpolation, shell execution, and the destructive rm -rf operation. A crafted workspace name can inject shell commands because no allowlist, escaping, or argument separation is used.

Independently of shell metacharacters, unchecked path components can alter which filesystem path is targeted. The implementation does not canonicalize the path, verify containment beneath the workspace root, reject symbolic-link-related hazards, or require confirmation that the target is a recognized workspace. These omissions create a direct risk of deleting data beyond the intended workspace.

The destructive nature of the existing command makes this sink more severe than the other injection points.

Attack Path

  1. An attacker gains access to the workspace remove operation or controls a caller that supplies its workspace-name argument.
  2. The attacker submits a name containing shell syntax, path components, or both.
  3. The CLI forwards args[2] unchanged to workspaceRemove().
  4. The value is concatenated into an rm -rf command.
  5. The shell interprets the constructed command.
  6. The attacker can execute additional commands or cause recursi ...[truncated 731 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the shell invocation entirely and use fs.promises.rm(target, { recursive: true, force: false }).
  • Validate names with a strict, length-bounded allowlist and reject all path separators, dot segments, whitespace, control characters, and shell metacharacters.
  • Resolve both the workspace base and target to canonical absolute paths.
  • Verify that the target is an immediate child of the approved base and is not equal to the base directory itself.
  • Confirm that the target corresponds to a workspace recorded by the application rather than deleting any matching path supplied by a caller.
  • Apply appropriate symbolic-link protections and inspect the target before deletion.
  • Require explicit authorization and, where operationally appropriate, confirmation for destructive removal.
  • Prefer reversible deletion or backups over immediate permanent removal.
  • Execute the manager with the minimum filesystem permissions needed to manage its dedicated workspace directory.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The CLI exposes a destructive delete operation using 'rm -rf' with no confirmation prompt, dry-run mode, or safety interlock. In an agent-management context, this increases the chance of accidental or scripted deletion of important workspace data, especially when operators may run commands quickly or through automation.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Even aside from shell metacharacter injection, concatenating attacker-controlled path segments into a recursive delete target can enable path traversal or unintended target selection. Because the operation is recursive and forceful, mistakes or abuse can cause irreversible availability and data-loss impact.

Content

Scanner excerpt · src/index.js (reported line 193)May include surrounding context.

js
async workspaceRemove(name: string): Promise<void> {
    try {
      await exec({
        command: `rm -rf /home/nvi/.openclaw/workspace-${name}`,
        timeout: 10
      });
      console.log(`Workspace ${name} eliminado`);

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Even aside from shell metacharacter injection, concatenating attacker-controlled path segments into a recursive delete target can enable path traversal or unintended target selection. Because the operation is recursive and forceful, mistakes or abuse can cause irreversible availability and data-loss impact.

Content

Scanner excerpt · src/index.js (reported line 193)May include surrounding context.

js
async workspaceRemove(name: string): Promise<void> {
    try {
      await exec({
        command: `rm -rf /home/nvi/.openclaw/workspace-${name}`,
        timeout: 10
      });
      console.log(`Workspace ${name} eliminado`);

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Even aside from shell metacharacter injection, concatenating attacker-controlled path segments into a recursive delete target can enable path traversal or unintended target selection. Because the operation is recursive and forceful, mistakes or abuse can cause irreversible availability and data-loss impact.

Content

Scanner excerpt · src/index.js (reported line 193)May include surrounding context.

js
async workspaceRemove(name: string): Promise<void> {
    try {
      await exec({
        command: `rm -rf /home/nvi/.openclaw/workspace-${name}`,
        timeout: 10
      });
      console.log(`Workspace ${name} eliminado`);

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
77% confidence
Finding

The CLI documentation advertises workspace remove <name> as a normal workspace-management command, but the implementation performs rm -rf on a filesystem path derived from user input. This understates the destructive nature of the operation and creates an intent/code divergence in user-facing documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The natural-language instructions and command descriptions are presented entirely in Spanish, and the file does not indicate that this locale choice is optional or region-specific. Under the stated policy, forcing a specific language without user opt-in is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation advertises workspace remove <name> but does not clearly warn that it deletes a local workspace directory, which can cause irreversible data loss if a user misunderstands the command scope. In a multi-agent management skill, destructive workspace operations are more dangerous because operators may target the wrong workspace or assume a soft-delete behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill's user-visible messages, help text, and status output are consistently written in Spanish, and the file does not provide any opt-in, locale selection, or justification for restricting interaction to that language. This can violate language or locale policy when a skill forces a specific language without user choice.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · src/index.js (reported line 168)May include surrounding context.

js
async workspaceList(): Promise<void> {
    try {
      const result = await exec({
        command: `ls -la /home/nvi/.openclaw/workspace-*`,
        timeout: 5
      });
      console.log("Workspaces disponibles:");

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The natural-language description and command explanations are presented in Spanish, and the file does not state that the skill is Spanish-only or offer any language choice. Per the language/locale policy rule, forcing a specific language without opt-in can be a policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file documents workspace list/create/remove, where remove may affect user data or system state, but it provides no caution, confirmation note, or impact warning. Under the markdown criteria for missing user warnings, user-visible descriptions of potentially destructive behavior should disclose that effect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The architecture section states that the skill can send messages to all agents, view activity/logs, use exec/process for diagnostics, and run automatic checks every 30 minutes. These behaviors can affect privacy or system integrity, but the markdown provides no warning or disclosure to users about what data is accessed or what commands may run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The skill describes broadcast and agent messaging features without warning that messages may reach all registered agents and could expose sensitive operational or user data. In a hive-management context, broad messaging increases the chance of accidental oversharing, command misuse, or information disclosure across unrelated agents or workspaces.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest description is written only in Spanish ("Skill para gestionar y coordinar agentes de OpenClaw como una colmena") with no indication that the skill is intended only for Spanish-speaking users or that other languages are supported. This can violate language/locale policy guidance when a skill imposes a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The package description is written entirely in Spanish, which can indicate a language-specific skill presentation without offering a user language choice or documenting that the skill is intended only for Spanish-speaking contexts. Under the policy for natural-language violations, locale or language constraints should be explicit and justified if they are enforced.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.