ClawHub
Back to skill

Security audit

Skill Creator Enhanced (Vault Awareness)

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent skill-authoring helper, with a notable caution that its packaging validator warns about possible secrets but does not block packaging them.

Install only if you want Codex to help create or modify skills. Review generated or edited SKILL.md files before use, keep changes user-directed, and do not rely on the packager as a secret scanner because detected plaintext keys are warnings rather than blocking errors.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/quick_validate.py:143
Finding

Detected Plaintext API Credentials Do Not Block Skill Packaging

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared purpose centers on authoring or modifying AgentSkills, but the code chunk does not create, update, package, or structure skills. Its primary function is to validate existing skill metadata files and report errors/warnings. While this behavior is related to skills, it is materially different from the declared purpose. The secret-pattern scanning and metadata consistency checks are also undeclared capabilities, though still within the broader validation domain.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The description frames the skill as a tool for creating or updating AgentSkills. The actual code does not create, update, structure, or package skills; it defines unit tests for a validation component (quick_validate.validate_skill). Its primary purpose is to verify validator behavior on frontmatter edge cases, using temporary directories and file writes as test setup. That is materially different from the declared purpose, so this is a mismatch.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

The skill explicitly instructs the agent to initialize, edit, and package skills, including writing SKILL.md and adding bundled resources. In an environment where skills are executable guidance, self-modification or creation of agent capabilities can be risky because it enables persistent changes to future behavior and can be abused to introduce unsafe instructions or overbroad capabilities.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

md
1. Understand the skill with concrete examples
2. Plan reusable skill contents (scripts, references, assets)
3. Initialize the skill (run init_skill.py)
4. Edit the skill (implement resources and write SKILL.md)
5. Package the skill (run package_skill.py)
6. Iterate based on real usage

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

md
#### How It Works

1. Skills declare the canonical env var they need via `primaryEnv` in frontmatter metadata
2. The vault (`~/.openclaw/secrets.json`) stores the actual secret value
3. Config holds a SecretRef pointer (`{source:"file", provider:"default", id:"/KEY_NAME"}`)
4. At runtime, the env var is resolved from the vault and injected into `process.env`
5. Skill scripts read from `$ENV_VAR` — they never see the vault mechanics

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

The instruction to update SKILL.md is another form of persistent agent self-modification because it changes future task behavior through skill content. Even though the purpose is legitimate authoring, this pattern becomes dangerous if a prompt-injected request tricks the agent into altering instructions, permissions, or credential-handling guidance for later sessions.

Content

Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.

md
If you used `--examples`, delete any placeholder files that are not needed for the skill. Only create resource directories that are actually required.

#### Update SKILL.md

**Writing Guidelines:** Always use imperative/infinitive form.

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/init_skill.py (reported line 352)May include surrounding context.

python
# Print next steps
    print(f"\n[OK] Skill '{skill_name}' initialized successfully at {skill_dir}")
    print("\nNext steps:")
    print("1. Edit SKILL.md to complete the TODO items and update the description")
    if resources:
        if include_examples:
            print("2. Customize or delete the example files in scripts/, references/, and assets/")

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test_package_skill.py (reported line 67)May include surrounding context.

python
def test_skips_symlink_to_external_file(self):
        skill_dir = self.create_skill("symlink-file-skill")
        outside = self.temp_dir / "outside-secret.txt"
        outside.write_text("super-secret\n")
        link = skill_dir / "loot.txt"
        out_dir = self.temp_dir / "out"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test_package_skill.py (reported line 92)May include surrounding context.

python
def test_skips_symlink_to_external_file(self):
        skill_dir = self.create_skill("symlink-file-skill")
        outside = self.temp_dir / "outside-secret.txt"
        outside.write_text("super-secret\n")
        link = skill_dir / "loot.txt"
        out_dir = self.temp_dir / "out"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test_package_skill.py (reported line 109)May include surrounding context.

python
def test_skips_symlink_to_external_file(self):
        skill_dir = self.create_skill("symlink-file-skill")
        outside = self.temp_dir / "outside-secret.txt"
        outside.write_text("super-secret\n")
        link = skill_dir / "loot.txt"
        out_dir = self.temp_dir / "out"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: skill-creator
description: Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
---

# Skill Creator

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description says 'Use when designing, structuring, or packaging skills with scripts, references, and assets,' which is broad enough to overlap with many general skill-authoring or documentation tasks. It does not provide explicit scope limits or negative examples to clarify when this skill should not trigger.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.