Pre-installation Security Check

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:39 AM UTC
• Version: 1.0.1

Overview

This security-check skill is not clearly malicious, but it can gate installs and install untrusted skills during its own review with weak containment details.

Review this carefully before installing. It is a security helper, but it asks for broad control over skill-install workflows and its own review procedure may install the target skill before safely inspecting it. Prefer a version that validates skill names, inspects an inert artifact before installation, and documents a disposable sandbox boundary.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: references/sandbox-procedure.md:13

Finding

Unvalidated Skill Identifier Is Interpolated into Shell Commands

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:30-32, references/sandbox-procedure.md:13-14
Vulnerability Type: Command injection through unvalidated input
Risk Level: High

Vulnerable Code

SKILL.md:30-32:

markdown

Parse the skill identifier:
- Full URL: `https://clawhub.ai/author/skill-name`
- Short: `skill-name` or `author/skill-name`

references/sandbox-procedure.md:13-14:

text

1. openclaw skill install {skill-name}
2. SKILL_PATH=~/.openclaw/workspace/skills/{skill-name}

Technical Analysis

The workflow accepts a skill identifier and inserts {skill-name} directly into commands represented as shell syntax. It does not require validation against a restrictive identifier grammar, shell escaping, argument separation, or path canonicalization.

If the generated task is interpreted by a shell, an identifier containing whitespace, command separators, command substitution, redirection, or path traversal sequences could change the intended command. The assignment to SKILL_PATH is also unquoted, allowing shell expansion and unintended argument splitting in subsequent commands.

Exploitability depends on the sub-agent executing these instructions through a shell, as the procedure directs. The project does not define a safe command API that would prevent shell interpretation.

Attack Path

1. An attacker supplies a crafted value where the workflow expects {skill-name}.
2. The primary Agent accepts the value because no strict validation rule is defined.
3. The value is copied into the sandbox task:

   text

   openclaw skill install {skill-name}
   

4. The sub-agent executes the generated command through a shell.
5. Shell metacharacters in the supplied value alter the command or introduce an additional command.
6. The injected command runs with the privileges and resource access granted to the sub-agent.

Impact Assessment

Successful exploitati ...[truncated 606 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate identifiers before creating any task or command. For example, permit only canonical identifiers matching:

   regex

   ^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)?$
   

2. Reject whitespace, shell metacharacters, control characters, absolute paths, and .. path components.
3. Resolve and verify derived paths remain under the expected skills directory.
4. Use a structured process-execution API with an argument array rather than constructing shell command strings.
5. If shell execution is unavoidable, quote every argument using a platform-appropriate escaping function; do not rely on manual interpolation.
6. Treat URLs separately: parse them with a URL parser, validate the expected host, and extract only validated author and skill path components.
7. Add negative tests covering semicolons, command substitution, spaces, newlines, redirection, globbing, and path traversal.

T09 · Insecure Skill Coding Practices

Error

• Location: references/sandbox-procedure.md:13

Finding

Untrusted Skills Are Installed Before Security Inspection

Content

View full analysis

Vulnerability Details

File Location: references/sandbox-procedure.md:13-20
Vulnerability Type: Unsafe execution order and insufficient sandbox guarantees
Risk Level: High

Vulnerable Code

text

COMMANDS:
1. openclaw skill install {skill-name}
2. SKILL_PATH=~/.openclaw/workspace/skills/{skill-name}
3. ls -laR $SKILL_PATH
4. find $SKILL_PATH -type f \( -name "*.sh" -o -name "*.py" -o -name "*.js" -o -perm -111 \)
5. grep -rE "curl.*sh|wget.*sh|eval|exec|rm -rf|sudo|~/.ssh|~/.aws|base64.*decode|nc -l|chmod +x|crontab" $SKILL_PATH
6. grep -rE "https?://|wss?://" $SKILL_PATH
7. head -50 $SKILL_PATH/SKILL.md

Technical Analysis

The procedure installs the target in step 1 and only inspects its files in steps 3 through 7. This reverses the secure analysis order: untrusted content is introduced into the workspace before static review determines whether it is dangerous.

The sessions_spawn configuration uses a separate sub-agent and requests cleanup, but no operating-system security controls are specified. There is no documented disposable filesystem, credential removal, network restriction, process isolation, read-only host mount, or guaranteed package uninstall. Agent-session separation alone does not demonstrate containment of installer side effects.

The pattern-based grep is also performed after installation and cannot prevent an installation hook or platform-supported activation behavior from running. Pattern matching is not a substitute for pre-installation source inspection because dangerous behavior can be obfuscated or expressed without the listed strings.

Attack Path

1. An attacker publishes a skill containing malicious install-time behavior or content that becomes active when installed.
2. The target receives a score that causes the conditional sandbox procedure to run.
3. The sub-agent executes openclaw skill install before reviewing the package.
4. The installation write ...[truncated 1125 chars]

Remediation

View remediation

Remediation Suggestions

1. Retrieve the target as an inert archive or repository snapshot without installing or loading it.
2. Pin the exact commit, version, and artifact digest that will later be installed.
3. Extract the artifact in a newly created disposable directory and inspect every file before execution.
4. Review SKILL.md, scripts, binaries, symbolic links, manifests, hooks, and generated commands before allowing installation.
5. If dynamic testing is necessary, use a disposable container or virtual machine with:
   • No host credentials or secret mounts
   • A read-only host filesystem
   • A temporary writable filesystem
   • Network access disabled by default
   • Process, memory, CPU, and time limits
   • No privileged mode or host socket access
   • Guaranteed destruction after analysis
6. Install only the exact artifact that passed inspection, rather than resolving the package again by name.
7. Explicitly uninstall and verify removal after testing, while recognizing that cleanup is not a substitute for isolation.
8. Replace simple grep-based approval with syntax-aware and manual review; use signatures only as supplemental indicators.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:45

Finding

Reputation-Based Scoring Can Bypass Content Inspection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:45-58, references/risk-scoring.md:7-32
Vulnerability Type: Unsafe trust model and security-check bypass
Risk Level: Medium

Vulnerable Code

SKILL.md:45-58:

markdown

See `references/risk-scoring.md` for the full scoring table.

Score is 0–100 (higher = safer):
- **80–100**: Very safe → skip sandbox, approve
- **60–79**: Safe → approve, optional sandbox
- **40–59**: Moderate → sandbox required
- **20–39**: High risk → sandbox required
- **0–19**: Very high risk → reject immediately

### 4. Sandbox Testing (Conditional)

**Run sandbox IF** score is 20–79 AND skill has executables or unknown author.

**Skip IF** score ≥ 80 (trusted), documentation-only, or score < 20 (reject).

references/risk-scoring.md:7-32:

markdown

| Risk Factor | Points |
|-------------|--------|
| **Source** | |
| Official OpenClaw | +50 |
| Trusted company (GitHub verified org) | +30 |
| Active community dev (>100 stars) | +10 |
| Personal dev (<100 stars) | -10 |
| No GitHub repo | -30 |
| **Code Type** | |
| Documentation only (SKILL.md) | +20 |
| Has scripts (Python/Bash) | -10 |
| Has binaries/executables | -30 |
| **Activity** | |
| Recent commits (<1 month) | +10 |
| Moderate activity (1-3 months) | 0 |
| Aging (3-6 months) | -10 |
| Stale (>6 months) | -20 |
| **Community** | |
| >1000 stars | +20 |
| 100-1000 stars | +10 |
| <100 stars | -5 |
| No stars visible | -10 |
| **ClawHub Assessment** | |
| All checks passed | +30 |
| Some warnings | -10 |
| Security concerns noted | -30 |

Technical Analysis

The workflow treats source reputation, stars, activity, and platform assessment as sufficient grounds to skip sandbox testing and approve installation. These indicators measure reputation and project activity; they do not establish that the exact artifact is safe.

A score of a ...[truncated 1608 chars]

Remediation

View remediation

Remediation Suggestions

1. Perform deterministic static inspection on every artifact regardless of reputation score.
2. Always inspect SKILL.md; do not classify documentation-only skills as inherently safe.
3. Use reputation, stars, organization status, and activity only as contextual signals, never as conditions for bypassing analysis.
4. Evaluate the exact version or digest that will be installed and bind the report to that immutable artifact.
5. Require dynamic testing for executable content unless the artifact has been independently reviewed and cryptographically attested.
6. Separate provenance confidence from code-safety findings in the report rather than combining them into one additive score.
7. Prevent automatic “SAFE” verdicts when content inspection is incomplete or unavailable.
8. Add explicit checks for instruction hijacking, sensitive-data access, external payload retrieval, persistence, tool modification, and unsafe command construction.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 52)May include surrounding context.

md

- **Check takes too long**: run `openclaw status`, kill hung subagents with `subagents kill <id>`
- **Sub-agent won't spawn**: run `/compact` to free context, or `openclaw gateway restart`
- **ClawHub unavailable**: retry, use GitHub-only analysis, or cancel
- **Cache issues**: `rm ~/.openclaw/skill-security-cache.json`

## License

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The phrase "when you ask about skill safety" is broad natural language that could overlap with ordinary conversation and does not clearly define the exact trigger scope. The README does not provide specific accepted phrases, exclusions, or negative examples to limit when the skill should activate.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 88% confidence

Finding

The trigger 'install skill' is close to a built-in install command and can shadow or preempt normal platform behavior. In context, this skill is designed to run before installation and then potentially steer the user into installation flow, so a conflicting trigger can create ambiguous control over sensitive package-install actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger phrases 'is this skill safe' and 'check skill security' are broad enough to activate in ordinary conversation about trust or safety, which can cause the skill to intercept unrelated requests. Because this skill is positioned as a mandatory pre-installation gatekeeper, overbroad triggering increases the chance of prompt hijacking, workflow confusion, or unintended blocking/steering of user actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 35% confidence

Finding

The interpretation table uses fixed English risk labels and actions such as 'Very safe' and 'Reject immediately.' However, this is just a reference document and does not instruct a system to force a user-facing language or locale, so the policy concern is weak.

Content

No source excerpt is available for this finding.