Skill Creator Enhanced (Vault Awareness)

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:53 AM UTC
• Version: 1.0.0

Overview

This is a coherent skill-authoring helper, with a notable caution that its packaging validator warns about possible secrets but does not block packaging them.

Install only if you want Codex to help create or modify skills. Review generated or edited SKILL.md files before use, keep changes user-directed, and do not rely on the packager as a secret scanner because detected plaintext keys are warnings rather than blocking errors.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/quick_validate.py:143
• Finding: Detected Plaintext API Credentials Do Not Block Skill Packaging<![CDATA[ ## Vulnerability Details **File Location**: `scripts/quick_validate.py:143-158, 190-193`; packaging flow in `scripts/package_skill.py:52-63` **Vulnerability Type**: Plaintext credential exposure caused by non-fatal secret validation **Risk Level**: Medium ### Vulnerable Code ```python # scripts/quick_validate.py:143-158 key_patterns = [ (r'sk-[a-zA-Z0-9]{20,}', "OpenAI-style API key"), (r'AIzaSy[a-zA-Z0-9_-]{33}', "Google API key"), (r'sk-ant-[a-zA-Z0-9]{20,}', "Anthropic API key"), (r'sk_[a-f0-9]{40,}', "ElevenLabs-style API key"), ] for pattern, label in key_patterns: if re.search(pattern, body): warnings.append(f"Possible hardcoded {label} detected in SKILL.md body") ``` ```python # scripts/quick_validate.py:190-193 if warnings: warning_text = "; ".join(warnings) return True, f"Skill is valid! Warnings: {warning_text}" ``` ```python # scripts/package_skill.py:52-63 print("Validating skill...") valid, message = validate_skill(skill_path) if not valid: print(f"[ERROR] Validation failed: {message}") print(" Please fix the validation errors before packaging.") return None print(f"[OK] {message}\n") ``` ### Technical Analysis The validator recognizes several common plaintext API-key formats in the `SKILL.md` body. However, detection only appends a warning, and the validation function subsequently returns `True`. The packaging function interprets this result as successful validation and continues creating the distributable `.skill` archive. Consequently, a credential matching one of the detected patterns can be knowingly packaged even though the project's documented credential policy prohibits storing plaintext keys in Skill files. The current scan is also limited to the `SKILL.md` body; other regular files included by the packager are not examined for secrets. This is a fail-open security control: the system identifies a potentially sensitive value but does not enforce the policy required to prev ...[truncated 1504 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat detected credential patterns as fatal validation errors rather than warnings: ```python detected_secrets = [] for pattern, label in key_patterns: if re.search(pattern, body): detected_secrets.append(label) if detected_secrets: return False, ( "Possible plaintext credentials detected: " + ", ".join(detected_secrets) ) ``` 2. Scan every regular file selected for packaging, not only `SKILL.md`. Apply text scanning where appropriate and explicitly handle binary files, file-size limits, and decoding failures. 3. Extend detection to additional provider formats and generic high-entropy assignments such as `API_KEY=...`, while avoiding printing secret values in diagnostic output. 4. Add an allowlist for known non-sensitive placeholders and test fixtures rather than allowing all findings to pass. 5. If false-positive overrides are necessary, require an explicit, auditable command-line option. Packaging should fail securely by default. 6. Add regression tests that verify: - A detected credential in `SKILL.md` causes validation and packaging to fail. - A credential in a script, configuration file, or reference document also blocks packaging. - Validation messages never reproduce the detected secret. - Placeholder values do not cause unintended failures when explicitly recognized as safe. 7. Before distribution, use an established secret scanner as an additional defense-in-depth check and revoke any credential that may already have been packaged. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose centers on authoring or modifying AgentSkills, but the code chunk does not create, update, package, or structure skills. Its primary function is to validate existing skill metadata files and report errors/warnings. While this behavior is related to skills, it is materially different from the declared purpose. The secret-pattern scanning and metadata consistency checks are also undeclared capabilities, though still within the broader validation domain.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The description frames the skill as a tool for creating or updating AgentSkills. The actual code does not create, update, structure, or package skills; it defines unit tests for a validation component (`quick_validate.validate_skill`). Its primary purpose is to verify validator behavior on frontmatter edge cases, using temporary directories and file writes as test setup. That is materially different from the declared purpose, so this is a mismatch.

Self-Modification

High

• Category: Rogue Agent

Content

1. Understand the skill with concrete examples
2. Plan reusable skill contents (scripts, references, assets)
3. Initialize the skill (run init_skill.py)
4. Edit the skill (implement resources and write SKILL.md)
5. Package the skill (run package_skill.py)
6. Iterate based on real usage

• Confidence: 85% confidence
• Finding: The skill explicitly instructs the agent to initialize, edit, and package skills, including writing `SKILL.md` and adding bundled resources. In an environment where skills are executable guidance, self-modification or creation of agent capabilities can be risky because it enables persistent changes to future behavior and can be abused to introduce unsafe instructions or overbroad capabilities.

Credential Access

High

• Category: Privilege Escalation

Content

#### How It Works

1. Skills declare the canonical env var they need via `primaryEnv` in frontmatter metadata
2. The vault (`~/.openclaw/secrets.json`) stores the actual secret value
3. Config holds a SecretRef pointer (`{source:"file", provider:"default", id:"/KEY_NAME"}`)
4. At runtime, the env var is resolved from the vault and injected into `process.env`
5. Skill scripts read from `$ENV_VAR` — they never see the vault mechanics

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Self-Modification

High

• Category: Rogue Agent

Content

If you used `--examples`, delete any placeholder files that are not needed for the skill. Only create resource directories that are actually required.

#### Update SKILL.md

**Writing Guidelines:** Always use imperative/infinitive form.

• Confidence: 85% confidence
• Finding: The instruction to update `SKILL.md` is another form of persistent agent self-modification because it changes future task behavior through skill content. Even though the purpose is legitimate authoring, this pattern becomes dangerous if a prompt-injected request tricks the agent into altering instructions, permissions, or credential-handling guidance for later sessions.

Self-Modification

High

• Category: Rogue Agent

Content

# Print next steps
    print(f"\n[OK] Skill '{skill_name}' initialized successfully at {skill_dir}")
    print("\nNext steps:")
    print("1. Edit SKILL.md to complete the TODO items and update the description")
    if resources:
        if include_examples:
            print("2. Customize or delete the example files in scripts/, references/, and assets/")

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Credential Access

High

• Category: Privilege Escalation

Content

def test_skips_symlink_to_external_file(self):
        skill_dir = self.create_skill("symlink-file-skill")
        outside = self.temp_dir / "outside-secret.txt"
        outside.write_text("super-secret\n")
        link = skill_dir / "loot.txt"
        out_dir = self.temp_dir / "out"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def test_skips_symlink_to_external_file(self):
        skill_dir = self.create_skill("symlink-file-skill")
        outside = self.temp_dir / "outside-secret.txt"
        outside.write_text("super-secret\n")
        link = skill_dir / "loot.txt"
        out_dir = self.temp_dir / "out"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def test_skips_symlink_to_external_file(self):
        skill_dir = self.create_skill("symlink-file-skill")
        outside = self.temp_dir / "outside-secret.txt"
        outside.write_text("super-secret\n")
        link = skill_dir / "loot.txt"
        out_dir = self.temp_dir / "out"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: skill-creator
description: Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
---

# Skill Creator

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description says 'Use when designing, structuring, or packaging skills with scripts, references, and assets,' which is broad enough to overlap with many general skill-authoring or documentation tasks. It does not provide explicit scope limits or negative examples to clarify when this skill should not trigger.

Static analysis

No suspicious patterns detected.