T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:43- Finding
Execution of Unpinned Remote PowerShell Scripts
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw工作目录医生
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent OpenClaw workspace repair helper, but its recommended workflow asks users to download and run unpinned PowerShell scripts from a personal GitHub repository that is outside the reviewed package.
Review this skill carefully before installing. Do not run the referenced PowerShell scripts unless you have inspected the exact downloaded files, trust the repository owner, and understand what paths they may change or delete. Prefer a version that bundles reviewed scripts or pins them to a specific commit with hashes and a dry-run-first workflow.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The activation section says the skill activates when the user mentions any listed keyword, but several phrases such as “路径错误”, “workspace问题”, and “工作目录异常” are generic and could overlap with many unrelated support conversations. The file also does not provide exclusion conditions or negative examples to clarify when the skill should not trigger.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes broad, ordinary phrases such as '路径错误', 'workspace问题', and '工作目录健康' that can plausibly appear in normal user requests unrelated to explicitly invoking this skill. Overly broad triggers increase the chance of unintended activation, which can cause the agent to apply filesystem-diagnostic or repair behavior in the wrong context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The display name, description, triggers, usage instructions, and safety notes are written for Chinese readers, but the file does not state that the skill is intended only for Chinese-language users or offer an opt-in language choice. This can violate language/locale policy when a skill effectively forces one language without justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The description is presented only in Chinese and does not indicate that language selection is optional or that the skill is intended solely for a Chinese-language audience. This can conflict with language/locale policy expectations when no opt-in or justified locale restriction is documented.
- Content
Static analysis
No suspicious patterns detected.