OpenClaw Debugging Assistant

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:47 AM UTC
• Version: 1.1.0

Overview

The skill mostly performs disclosed debugging tasks, but it automatically loads an unaudited sibling C parser module at startup, which needs review before installation.

Review or remove the automatic c-support/lib import before installing. The normal debugging features are low risk when pointed only at files you intend to analyze, but the C support path should be packaged, pinned, or explicitly configured rather than discovered from an ambient sibling directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/main.py:11

Finding

Untrusted Out-of-Package Python Module Loading

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py, lines 11–18
Vulnerability Type: Unsafe dependency loading and Python path manipulation
Risk Level: Medium

Vulnerable Code

python

# Import C support library
c_support_path = Path(__file__).parent.parent.parent / 'c-support' / 'lib'
if c_support_path.exists():
    sys.path.insert(0, str(c_support_path))
    try:
        from c_parser import CParser
        C_SUPPORT_AVAILABLE = True
    except ImportError:
        C_SUPPORT_AVAILABLE = False

Technical Analysis

The script constructs a path outside the audited skill package, prepends it to sys.path, and imports c_parser from that location. Since the directory is inserted at index zero, a file named c_parser.py in the external directory takes precedence over modules available through normal trusted import locations.

Python executes module-level code during import. Consequently, merely launching scripts/main.py can execute arbitrary code supplied through the external module, even when the user selects a command unrelated to C tracing. The implementation does not validate the module's origin, ownership, permissions, version, or cryptographic integrity.

The except ImportError block does not mitigate this issue. It only handles an import failure after Python has attempted to initialize the selected module; malicious module-level instructions may already have executed.

Attack Path

1. An attacker obtains write access to the expected sibling location, c-support/lib, outside the project root.
2. The attacker creates or replaces c-support/lib/c_parser.py.
3. The malicious file includes attacker-controlled module-level Python instructions.
4. A user invokes any documented command through scripts/main.py.
5. During startup, the script prepends the attacker-influenced directory to sys.path.
6. Python imports the attacker's c_parser.py and executes its module-level payload before command-line argument processing ...[truncated 694 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the C parser within the skill as a properly defined Python package and use an explicit relative import instead of modifying sys.path.
2. If the parser must remain external, require its location through explicit trusted configuration rather than deriving an ambient sibling path.
3. Validate the resolved module path before importing it. Ensure that it resides under an approved root and reject symbolic-link or path-redirection escapes.
4. Restrict ownership and write permissions on the dependency directory so that untrusted users cannot replace its contents.
5. Pin the dependency to an approved version and verify its cryptographic hash or signed package metadata during installation.
6. Avoid loading the C dependency at global startup. Import it only inside the C tracing operation after the dependency has been validated.
7. Catch import errors only for availability handling; do not treat exception handling as a substitute for dependency authenticity controls.

A preferred structure is a packaged dependency with an import similar to:

python

from .c_support.lib.c_parser import CParser

This should be combined with standard package installation, version pinning, and integrity verification.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documentation describes commands that read local files (for example --file error.log, --file src/main.py) and references external/API-related analysis, yet it declares no explicit tool scope such as permissions or allowed-tools. Missing scope declarations can cause the runtime to grant broader-than-expected access or leave operators unaware that the skill may access files or network resources, increasing the risk of unintended data exposure or over-privileged execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file contains the primary user-facing description and feature list in Chinese, while the document does not state that the skill is region-specific or give users an explicit language/locale option. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.