PCAP Analyzer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:23 PM UTC
• Version: 0.1.0

Overview

The skill has a coherent PCAP-analysis purpose, but its command entry point can execute unsafe shell input and depends on an unreviewed external script.

Review before installing. This skill should be changed to invoke the bundled script or an argument-array command with safe path handling, and any external summarizer should be bundled or verified by digest and restrictive ownership. Use only with trusted PCAP paths and in a restricted environment until fixed.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: skill.yaml:6

Finding

Shell Command Injection Through Unquoted PCAP Path

Content

View full analysis

Vulnerability Details

File Location: skill.yaml, line 6
Vulnerability Type: OS command injection through unsafe template interpolation
Risk Level: High

Vulnerable Code

yaml

command:
  run: /home/tom/openclaw-tools/pcap_summary.sh {{pcap_path}}

Technical Analysis

The required pcap_path input is inserted directly into a command string without shell-safe quoting or argument-array separation. If the Skill runtime evaluates the run field through a command shell, shell metacharacters contained in the input will be interpreted as syntax rather than as part of a file path.

An attacker who can control pcap_path may include separators, command substitutions, redirections, or pipelines. For example, a value structurally equivalent to:

text

/tmp/capture.pcap; attacker_command

could produce the following effective shell command:

bash

/home/tom/openclaw-tools/pcap_summary.sh /tmp/capture.pcap; attacker_command

The bundled scripts/analyze.sh quotes "$PCAP" when invoking tools, but skill.yaml bypasses that script and invokes the external summarizer directly. Consequently, the safer argument handling in the bundled script does not mitigate the command-template vulnerability.

Attack Path

1. An attacker supplies or persuades the user to supply a crafted pcap_path containing shell syntax.
2. The runtime substitutes the value into the unquoted command.run template.
3. If the runtime executes that command through a shell, the shell parses the injected syntax.
4. The legitimate summarizer is invoked, followed by or combined with the injected command.
5. The injected command executes with the privileges and filesystem access of the Skill runner.

Impact Assessment

Successful exploitation permits arbitrary command execution in the Skill runner's security context. The attacker could read or alter files available to that account, access environment variab ...[truncated 276 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct shell commands by concatenating or directly interpolating user input.
• Configure the Skill runtime to invoke the executable with an argument array, keeping the executable and pcap_path in separate argv elements.
• If the framework supports only command strings, use its documented shell-escaping mechanism rather than relying on manual quoting.
• Change the entry point to the bundled script and preserve argument boundaries, for example by passing the PCAP path as one quoted argument.
• Resolve the submitted path to a canonical path and verify that it identifies an existing regular file.
• Enforce an allowlist for supported .pcap and .pcapng extensions as defense in depth. Extension checks must not replace safe argument handling.
• Add automated tests using paths containing spaces, quotes, semicolons, command substitutions, redirections, and leading hyphens to confirm that every value is treated strictly as a filename.

T07 · Tool Hijacking and Spoofing

Warning

• Location: skill.yaml:6

Finding

Execution Delegated to an Unbundled Mutable External Script

Content

View full analysis

Vulnerability Details

File Locations: skill.yaml, line 6; SKILL.md, lines 7–13; scripts/analyze.sh, lines 25–30
Vulnerability Type: External tool trust and local executable hijacking
Risk Level: Medium

Vulnerable Code

skill.yaml directly selects an executable outside the audited project:

yaml

command:
  run: /home/tom/openclaw-tools/pcap_summary.sh {{pcap_path}}

SKILL.md declares the same external file as a requirement:

yaml

"requires":
  {
    "bins": ["tshark", "awk", "sed"],
    "files": ["/home/tom/openclaw-tools/pcap_summary.sh"]
  },

The bundled wrapper also preferentially delegates execution to that file whenever it is executable:

bash

# Preferred: your existing summarizer (best output)
if [[ -x /home/tom/openclaw-tools/pcap_summary.sh ]]; then
  /home/tom/openclaw-tools/pcap_summary.sh "$PCAP" "$FOCUS"
  exit 0
fi

Technical Analysis

The Skill's primary implementation is stored at an absolute path outside the reviewed package. Its source, integrity, ownership, and update process cannot be established from the audited artifact. The behavior presented to users can therefore change without any modification to the reviewed project.

skill.yaml invokes the external file unconditionally, while the bundled wrapper executes it whenever the executable bit is set. Neither path verifies the file's cryptographic digest, owner, permissions, or provenance before execution. If an attacker or compromised process can replace or modify that file, legitimate-looking PCAP analysis requests will execute attacker-controlled logic.

This is a local trust-boundary weakness rather than evidence that the packaged code is itself malicious. Exploitation depends on the attacker obtaining write access to the external script or its parent directory. The fixed absolute path limits ordinary PATH-based hijacking, but it does not protect against replacement at that l ...[truncated 1288 chars]

Remediation

View remediation

Remediation Suggestions

• Package the complete summarizer inside the Skill and configure skill.yaml to invoke the bundled scripts/analyze.sh rather than an external mutable file.
• Remove the preferred external delegation branch if it is not essential to the documented function.
• If external execution is unavoidable, verify before every invocation that the script:
  • Is owned by the expected trusted account.
  • Is not writable by the Skill user, group, or other untrusted principals.
  • Resides in a parent directory with similarly restrictive ownership and permissions.
  • Matches a pinned cryptographic digest or a verified signed release.
• Fail closed when any integrity or permission check fails instead of silently executing the external implementation.
• Run the analyzer with least privilege, read-only access to the requested capture, a restricted environment, and network access disabled unless explicitly required.
• Document the external component's version and update process so that changes receive the same security review as the packaged Skill.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.