PLC Skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:23 AM UTC
• Version: 1.0.0

Overview

This is a disclosed PLC programming reference skill with some setup cautions, but I found no hidden execution, exfiltration, or destructive behavior.

Before installing, verify the ClawHub CLI package source and consider pinning versions. Avoid running recursive sudo ownership fixes unless you understand the path contents, and back up local skill changes before using force update. Treat PLC and safety-related outputs as engineering drafts that require qualified review, field validation, and applicable safety standards.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: INSTALL.md:9

Finding

Unpinned Global npm Package Installation Creates Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

``` 2. Document the official npm package page, verified publisher identity, source repository, and expected package name so users can validate provenance before installation. 3. Publish and document an expected npm integrity value or package checksum for the reviewed release. Ensure release artifacts are reproducible or signed where practical. 4. Prefer a project-local dependency instead of a global installation when supported: ```bash npm install --save-dev clawhub@ ``` Invoke it through a pinned project script rather than relying on a mutable global executable. 5. If the package does not require lifecycle scripts, recommend installation with scripts disabled: ```bash npm install -g clawhub@ --ignore-scripts ``` This option should only be recommended after confirming that disabling scripts does not break legitimate installation behavior. 6. Add an update process requiring review of release notes, source changes, publisher identity, and integrity metadata before changing the documented version. 7. Replace the placeholder repository URL in `INSTALL.md` with the verified official repository URL so users are not encouraged to substitute an unverified source. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (40)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · INSTALL.md (reported line 135)May include surrounding context.

Continue.dev supports custom context providers.

Setup:

1. Edit ~/.continue/config.json:

json

{

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/common/program-templates.md (reported line 29)May include surrounding context.

md

- debounce or filter timing
- fault reset and recovery

## Output rule

Do not jump straight into a full monolithic program.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/vendors/siemens/siemens-overview.md (reported line 1)May include surrounding context.

md

# Siemens overview

Use this module when the request is clearly in the Siemens ecosystem.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The installation guide suggests verifying the skill by asking "Can you help me with PLC programming?" as a trigger example. This phrase is broad, conversational language that could overlap with ordinary requests and does not clearly define activation boundaries or exclusion conditions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 53)May include surrounding context.

Usage:

text

# In Claude Code chat
"Write a Siemens S7-1500 motor control function block in SCL"

Cursor

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The publishing example advertises 'safety programming guidelines' even though the skill metadata explicitly says it should not be preferred for high-confidence safety conclusions without confirmed field conditions. That mismatch can cause users or downstream agents to overtrust the skill for safety-critical advice, increasing the chance of unsafe control-system decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Documenting a force-update command without an explicit warning normalizes a destructive operation that can overwrite local modifications in the installed skill directory. In environments where users customize prompts, references, or local patches, this can cause loss of work or replacement of trusted local content with newly fetched content.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The guide suggests running sudo chown -R on a user-controlled workspace path to fix permissions. Recursive ownership changes under elevated privileges can mask underlying permission problems, unintentionally broaden write access, and are risky in environments where path contents may include symlinks or unexpected files.

Content

Scanner excerpt · INSTALL.md (reported line 250)May include surrounding context.

If you get permission errors during installation:

bash

# Fix ownership
sudo chown -R $USER ~/.openclaw/workspace/skills/

Contributing

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file presents all user invocation examples exclusively in Chinese and marks each as a definite trigger, with no indication that the skill is optional-language, locale-specific, or limited to Chinese-speaking users. That creates a natural-language policy concern because the skill appears to enforce a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The example user inputs are exclusively written in Chinese, and the file provides no indication that language selection is optional or that the skill is intentionally limited to a Chinese-language context. This can imply a fixed language expectation without user opt-in, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · evals/incomplete-input-cases.md (reported line 20)May include surrounding context.

md

- do not assume too much silently
- request or state assumptions about PLC family, software, and language
- avoid claiming final platform-specific implementation without confirmation

Forbidden:

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The evaluation cases conflict with the skill manifest by treating Siemens PLC requests as a wrong-platform non-trigger while the manifest explicitly states the skill should handle multi-vendor PLC work, including Siemens. This inconsistency can mis-train routing or evaluation behavior, causing valid PLC requests to be misclassified, skipped, or sent down the wrong path, which is particularly risky in industrial-control contexts where incorrect guidance can affect troubleshooting and operational decisions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown lists 'Should trigger' with only 'generation output format', which is a broad capability description rather than a specific activation phrase or bounded condition. It does not clarify what exact user requests should or should not invoke this case, increasing the chance of ambiguous matching.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The phrase 'explanation output format' is a generic description, not a narrowly scoped trigger, and it overlaps with many common coding-help requests. Without explicit examples or boundaries, it is unclear when this case activates versus related review or debugging cases.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file states only 'review output format' under 'Should trigger', which does not specify the actual phrasing, context, or constraints for activation. This ambiguity can cause overlap with other common requests such as explanation, debugging, or general code assistance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger description 'debugging output format' is too general and does not define concrete user language, scope, or non-triggering cases. Because it lacks boundaries, the skill behavior could be invoked for a wide range of routine troubleshooting requests unintentionally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The review cases present user prompts only in Chinese, and the file does not state that the skill is region-specific or that users may choose another language. This can amount to a language/locale policy issue because it implicitly constrains usage to a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This example likewise uses only Chinese-language input and provides no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document relies on natural-language categories like 'debug workflow,' 'review,' 'ambiguity,' and 'vendor identification' without deterministic boundaries, so many normal user requests could match multiple routes. In an agent skill that governs document selection, this ambiguity can be exploited or can accidentally steer responses toward irrelevant or weaker guidance, reducing reliability for industrial-control advice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger phrase for safety-sensitive questions is broad enough that ordinary PLC troubleshooting or design questions could be routed into safety-boundary guidance without clear constraints. In a PLC skill, ambiguous routing can cause the agent to over- or under-apply high-stakes guidance, producing misleading confidence or incomplete safeguards in industrial control contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The soft reset guidance recommends exposing an HMI-triggered reset that clears counters, state, and error flags, but it does not warn about operational hazards, authorization, or the need to ensure the machine is in a safe state before reset. In an industrial control context, an operator or integrator could implement this literally and allow unsafe state transitions, unexpected restart behavior, or clearing of fault context during troubleshooting.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manufacturer-based routing cues are broad enough to send requests into the Codesys module even when the user only mentions a brand, not an actual Codesys environment. In an agentic skill system, misrouting can cause the model to apply the wrong vendor assumptions, provide inaccurate implementation guidance, or overconfidently map platform-specific concepts in industrial control contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file states that the Machine Operation Recorder automatically records all device states, cycle times, and waveform data, and that it is triggered on shutdown or error. Because the description involves automatic recording of operational data, the file should include a clear warning that such capture may affect privacy, retention, or handling of user/system data.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/vendors/mitsubishi/fx3u-device-and-instruction-notes.md (reported line 51)May include surrounding context.

md

- verify reset path third
- verify whether another section rewrites the same done-dependent logic

Do not jump to "timer broken" or "counter broken" without checking the enabling logic and reset path.

## Instruction reasoning rules

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.