Security audit

Bug Fixer

Security checks for vulnerabilities and agentic risk

Overview

This bug-fixing skill is mostly a local logging and triage helper, but it automatically writes persistent records and may run another installed Feishu notification script without clear user opt-in.

Review this skill before installing. It is not clearly malicious, but users should know it can create persistent OpenClaw log and repair files, and if a Feishu sender skill exists at the expected path, it may automatically send a repair report and execute that separate script. Prefer installing only if you are comfortable with those behaviors or can disable/gate the notification step.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Warning

Location: scripts/autonomous-fix.sh:241
Finding: Automatic Execution of an Unpinned External Notification Script## Vulnerability Details **File Location**: `scripts/autonomous-fix.sh`, lines 241–244 **Vulnerability Type**: Untrusted delegated tool execution **Risk Level**: Medium ### Vulnerable Code ```bash # Send to Feishu if configured if [ -f "${WORKSPACE}/skills/feishu-send-file/scripts/send-message.sh" ]; then cd "${WORKSPACE}/skills/skills/feishu-send-file" ./scripts/send-message.sh text "${report}" 2>/dev/null || log "Notification delivery failed" fi ``` The audited source actually changes directory using: ```bash cd "${WORKSPACE}/skills/feishu-send-file" ``` ### Technical Analysis The Skill automatically executes `send-message.sh`, a separately installed and mutable script that is not included in this project. Checking that a path is a regular file does not establish its provenance, integrity, ownership, or safety. Consequently, the effective behavior of this Skill depends on unaudited code located in the user's OpenClaw workspace. The notification is invoked automatically after processing a repair, without an explicit user confirmation or disclosure in `SKILL.md`. The delegated script receives a report containing the fix identifier, user-supplied error type, verification result, and the local path of the generated repair record. The external script may transmit this information to Feishu or another destination according to its own implementation. ### Attack Path 1. An attacker gains the ability to create or replace `${WORKSPACE}/skills/feishu-send-file/scripts/send-message.sh`. 2. The attacker installs a script that performs unauthorized local actions or transmits information externally. 3. A user invokes `autonomous-fix.sh` with an error to process. 4. The repair workflow reaches `notify_fix_complete`. 5. The Skill detects the attacker-controlled file and executes it without integrity or ownership validation. 6. The malicious script runs with the same operating-system privileges and environmen ...[truncated 608 chars]
Remediation: ## Remediation Suggestions 1. Do not automatically execute scripts from another mutable Skill directory. 2. Require explicit user opt-in before sending any external notification. 3. Replace arbitrary script execution with a narrowly scoped, documented notification interface. 4. Pin and audit the notifier implementation as part of this package if it is required functionality. 5. Verify the expected file's canonical path, owner, permissions, and cryptographic digest before execution. 6. Avoid inheriting unnecessary environment variables and privileges when invoking notification components. 7. Clearly document the notification destination and every field that may be transmitted. 8. Consider passing only a non-sensitive status identifier instead of local paths and diagnostic content.

T09 · Insecure Skill Coding Practices

Note

Location: scripts/autonomous-fix.sh:154
Finding: User-Controlled Input Interpreted as grep Options and Regular Expressions## Vulnerability Details **File Location**: `scripts/autonomous-fix.sh`, lines 154–164 and 209–220 **Vulnerability Type**: Insufficient input validation and unsafe command argument handling **Risk Level**: Low ### Vulnerable Code ```bash search_knowledge_base() { local error_type="$1" local root_cause="$2" # Search for similar historical repairs local similar_fix=$(grep -r "${error_type}" "${PITFALLS_DIR}" 2>/dev/null | head -1 || echo "") if [ -n "${similar_fix}" ]; then echo "Historical similar issue found: ${similar_fix}" else echo "No historical records" fi } ``` ```bash verify_fix() { local error_type="$1" # Simple verification: check whether the same error remains local recent_errors=$(grep -c "${error_type}" "${LOG_FILE}" 2>/dev/null || echo "0") if [ "${recent_errors}" -lt 2 ]; then echo "Verification passed - error did not recur" else echo "Verification warning - errors of this type remain" fi } ``` ### Technical Analysis `error_type` is taken directly from the first command-line argument and passed to `grep` as its pattern. It is not restricted to the predefined keys in `FIX_STRATEGIES`. Although shell quoting prevents ordinary shell metacharacters from becoming separate shell commands, it does not make the value safe for `grep`. The value remains an interpreted regular expression. A value beginning with `-` may also be treated as a command-line option because the calls do not use the `--` option terminator. Crafted regular expressions can produce broad or misleading matches and may consume excessive processing time against sufficiently large files. Option-like values can alter `grep` behavior or cause errors. In the verification path, manipulated matching behavior can produce an incorrect repair status. No direct shell command injection was identified in these calls ...[truncated 1114 chars]
Remediation: ## Remediation Suggestions 1. Validate `error_type` against the supported error-type allow list before using it: ```bash if [[ -z "${FIX_STRATEGIES[$error_type]+defined}" ]]; then echo "Unsupported error type" >&2 exit 2 fi ``` 2. Use fixed-string matching and an option terminator: ```bash grep -rF -- "${error_type}" "${PITFALLS_DIR}" grep -cF -- "${error_type}" "${LOG_FILE}" ``` 3. Apply a conservative syntax and length restriction if arbitrary error labels must be supported, such as allowing only letters, digits, underscores, and hyphens. 4. Handle `grep` exit statuses explicitly rather than conflating “no match” with execution errors. 5. Validate that `recent_errors` contains exactly one non-negative integer before using it in a numeric comparison. 6. Add tests covering leading-hyphen input, regex metacharacters, long input, unsupported error types, and missing log files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The activation condition is broad enough to trigger this skill for almost any reported bug, error, or unexpected behavior, which increases the chance the agent will invoke an autonomous repair workflow in situations where the user did not intend code or file modification. In context, this is riskier because the skill advertises autonomous diagnosis and repair, so overbroad matching can cause unintended changes to code or systems.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The documentation states the skill performs 'autonomous bug diagnosis and repair' and includes commands for automatic fixing, but it does not clearly warn users that it may modify code or files. This can lead to uninformed invocation of a destructive-capable workflow, especially since the process explicitly includes repair execution and writing to `.learnings/ERRORS.md`.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The top-level workflow comments state that the system analyzes, generates a fix, executes the fix, and verifies it. In practice, execute_fix primarily returns status strings such as '已标记' or '已执行' without actually modifying code or system state, and verify_fix only counts matching log lines rather than validating a real repair outcome.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The workflow writes fix records to disk automatically without confirmation, transparency, or a user-controlled approval step. In an autonomous agent context, silent file creation/modification can become risky because it normalizes unattended state changes and could later be extended to overwrite important files or store sensitive diagnostic content.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script sends bug-fix reports to an external Feishu integration, which exceeds the minimum capability needed for local bug diagnosis and repair and creates a data exfiltration path. The report includes error type, verification result, and file path, and future changes could easily expand that to include sensitive logs or root-cause data without user awareness.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script transmits report content to an external messaging tool without explicit disclosure or consent at the point of execution. In a bug-fixing skill, logs and diagnostics may contain sensitive operational data, so undisclosed outbound sharing materially increases privacy and security risk.

Natural-Language Policy Violations

Low

Confidence: 87% confidence
Finding: The instructional content and operational guidance are presented in Chinese, but the file does not state that the skill is intended only for Chinese-speaking users or offer an alternative language. This can violate a language/locale policy when users are not given an explicit choice or opt-in.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The script's instructional comments, log messages, and user-facing report content are predominantly in Chinese, with no indication that the language is configurable or user-selected. This can violate locale/language policy where tools must not force a specific language without opt-in.

Static analysis

No suspicious patterns detected.