T09 · Insecure Skill Coding Practices
Error
- Location
watchdog.py:171- Finding
TLS Certificate Validation Is Explicitly Disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawhub Skill Infra Watchdog
Security checks for vulnerabilities and agentic risk
Overview
This monitoring skill mostly matches its stated purpose, but it asks for broad OpenClaw capabilities and its HTTPS/SSL checks are unsafe enough to give false health results.
Review before installing. Use it only if you are comfortable granting broad monitoring-related capabilities, and do not rely on its HTTPS or SSL-expiry results until certificate validation and expiry parsing are fixed. Prefer a version with narrower manifest permissions and explicit user control for any alerts or scheduled checks.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
skill.json:14- Finding
Skill Manifest Requests Capabilities Beyond Implemented Requirements
- Content
View full analysis
- Remediation
View remediation
` - `df -h ` - `free -b` 3. Add alerting or scheduling capabilities only when the corresponding functionality is implemented, reviewed, and explicitly enabled by the operator. 4. Require explicit user confirmation before enabling outbound messaging or persistent scheduling. 5. Document why each requested capability is necessary and add a release check that rejects unused permissions in the manifest. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
infra-watchdog add-monitor
--type http
--name "Main API"
--url https://api.example.com/health
--expected-status 200
--timeout 5text
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def check_docker(self, container_id: str) -> Tuple[str, float, str]: """Check Docker container status. Returns (status, 0, details).""" try: result = subprocess.run( ['docker', 'inspect', container_id], capture_output=True, text=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def check_disk(self, mount_point: str = '/') -> Tuple[str, float, str]: """Check disk usage. Returns (status, 0, details).""" try: result = subprocess.run( ['df', '-h', mount_point], capture_output=True, text=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def check_memory(self) -> Tuple[str, float, str]: """Check memory usage. Returns (status, 0, details).""" try: result = subprocess.run( ['free', '-b'], capture_output=True, text=True,
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The SSL expiry check disables certificate verification and hostname checking, then reports only a generic 'Certificate valid' message without actually parsing and evaluating the certificate's expiration date. This can cause false assurance: expired, spoofed, or otherwise invalid certificates may be treated as healthy, undermining monitoring and delaying detection of certificate failures or MITM conditions.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python def cmd_cron_install(args): """Install cron job for periodic checks.""" config = load_config() interval = config.get('check_interval_minutes', 5)
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This code creates a persistent data directory in the user's home workspace, and later stores configuration and monitoring results in local files and a SQLite database. While some success messages are printed, there is no explicit disclosure that the skill persistently records monitor targets and check history on disk, which is relevant to user data handling.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill actively sends HTTP requests to user-specified targets and opens TCP connections to remote hosts as part of monitoring. Although this behavior is central to the skill's purpose, the code does not clearly warn users during setup or command execution that endpoint information and connection metadata will be transmitted to those remote systems.
- Content
Static analysis
No suspicious patterns detected.