Security audit

Governance.Wrapper

Security checks for vulnerabilities and agentic risk

Overview

This skill is a governance wrapper, but it requires agents to route strict-mode work and sensitive prompt/context data through an unreviewed absolute-path script outside the package.

Review this carefully before installing. It should only be used if the referenced governance_wrapper.py is separately reviewed, integrity-pinned, tightly permissioned, and documented to avoid logging or exposing sensitive prompts and user context.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

Location: SKILL.md:6
Finding: Mandatory Redirection Through an Unreviewed External Execution Wrapper
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 6–8
Vulnerability Type: T07: Tool Hijacking and Spoofing
Risk Level: High

Vulnerable Code:

markdown
All autonomous operations in strict mode must execute through this wrapper: `python3 /home/openclaw/.openclaw/workspace/governance/governance_wrapper.py`

Technical Analysis

The skill mandates that all strict-mode autonomous operations execute through a Python script referenced by an absolute path outside the reviewed project. The project contains only SKILL.md; consequently, the wrapper's source code, integrity, ownership, permissions, and behavior cannot be verified within the audit boundary.

This creates a tool-hijacking boundary because loading the skill replaces the normal execution path with an external intermediary. That intermediary can be modified independently after this skill is reviewed. Anyone able to create or alter the referenced file could control how operations are processed while calls continue to appear as legitimate governance-wrapper executions.

The wrapper's claimed model lock, allowlist enforcement, network restrictions, and evidence controls do not mitigate this issue because their implementations are absent from the package and cannot be validated.

Attack Path

An operator or attacker with write access to /home/openclaw/.openclaw/workspace/governance/governance_wrapper.py, or one of its parent directories, creates or modifies the wrapper.

The skill is loaded for a strict-mode autonomous operation.

Following the mandatory instruction, the agent invokes the external wrapper.

The wrapper receives control over the operation and its supplied parameters.

A malicious wrapper can alter requests, falsify policy decisions, redirect operations, disclose supplied data, or return manipulated results.

Because the implementation is outside the reviewed package, its behavior may change without any mod ...[truncated 572 chars]
Remediation: View remediation
Remediation Suggestions

Include the complete wrapper implementation and its required configuration in the reviewed skill package.

Reference a package-relative executable rather than a mutable absolute path outside the project.

Pin the approved wrapper with a cryptographic digest and verify that digest before execution.

Ensure the wrapper and its parent directories are owned by a trusted administrative account and are not writable by the agent or untrusted users.

Make wrapper use explicit and scoped to operations that require it rather than issuing an unconditional execution mandate.

Document the wrapper's precise trust boundary, permitted operations, network access, and failure behavior.

Add automated tests proving that allowlist, network, model, and evidence controls fail closed.

Have the wrapper implementation undergo a separate security review before deployment.

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:10
Finding: System Prompt and Input Context Passed to an Unreviewed External Process
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 10–14
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code:

markdown
Required parameters: - `--requested-skill` - `--system-prompt` - `--input-context`

Technical Analysis

The skill requires the system prompt and input context to be supplied to the external wrapper. These values can contain hidden instructions, user-provided confidential information, credentials, file contents, internal identifiers, or other operational data.

No data-minimization, redaction, authorization, retention, or secure transport requirements are defined. If these values are passed as command-line arguments, as the parameter notation suggests, they may also be exposed through process inspection, diagnostic tooling, shell history when manually invoked, crash reports, or process-accounting facilities. The exact invocation code is unavailable, so command-line exposure is a credible implementation risk rather than a verified runtime behavior.

The document also claims mandatory evidence emission and append-only evidence logging. Without the wrapper implementation or a logging schema, it is impossible to determine whether the system prompt and input context are excluded, redacted, encrypted, or retained securely.

Attack Path

A strict-mode operation processes sensitive instructions or user context.

The skill requires --system-prompt and --input-context to be supplied to the external wrapper.

The wrapper receives the raw or insufficiently minimized values.

A malicious or compromised wrapper can copy or disclose those values.

If the implementation places values directly in the process argument vector, another sufficiently privileged local process may read them while execution is in progress.

If evidence logging captures the parameters, sensitive data may remain accessible after the operation completes. ...[truncated 583 chars]
Remediation: View remediation
Remediation Suggestions

Do not transmit the complete system prompt unless it is strictly necessary for a documented function.

Define a minimal structured request schema and include only fields required for the requested operation.

Redact credentials, tokens, private user data, and unrelated context before transfer.

Avoid placing sensitive values in command-line arguments. Use authenticated local IPC or protected standard input with explicit framing instead.

Ensure temporary buffers and files are permission-restricted, securely removed, and not shared between users.

Define an evidence schema that excludes prompt and context bodies by default and records only non-sensitive metadata or cryptographic commitments.

Encrypt sensitive evidence at rest, restrict access, establish retention limits, and provide secure deletion procedures.

Validate the wrapper's logging and error-handling paths to ensure sensitive inputs cannot appear in logs, tracebacks, telemetry, or crash reports.

Document user-consent and authorization requirements before transferring context outside the agent's immediate execution boundary.

SkillSpector