ClawHub
Back to skill

Security audit

Envcheck

Security checks for vulnerabilities and agentic risk

Overview

This skill runs a local environment-readiness checker, and its behavior matches that purpose with limited privacy and dependency hygiene caveats.

Install only if you are comfortable running a local readiness-check API. Keep it bound to localhost, do not expose it on a network, and remember that anyone who can call it can learn whether named environment variables and binaries exist.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:4
Finding

Unpinned Third-Party Runtime Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code:

yaml
metadata: {"openclaw":{"emoji":"🔧","requires":{"bins":["python"]},"install":[{"id":"pip","kind":"uv","packages":["fastapi","uvicorn","pydantic"]}]}}

Technical Analysis

The installation metadata requests fastapi, uvicorn, and pydantic without exact versions, a reviewed lockfile, package hashes, or equivalent integrity constraints. Consequently, separate installations may resolve to different package versions and transitive dependency sets.

This is a supply-chain weakness rather than evidence that any currently named package is malicious. If a package publisher account, package release, dependency, or configured package index is compromised, installation could retrieve attacker-controlled code without any change to this project. Unrestricted upgrades can also introduce incompatible or newly vulnerable releases.

Attack Path

  1. An attacker compromises a declared package, one of its transitive dependencies, a publisher account, or the package index used by the installer.
  2. The attacker publishes a malicious version that satisfies the unconstrained dependency request.
  3. A user installs the Skill after that release becomes eligible for dependency resolution.
  4. The installer resolves and downloads the attacker-controlled release because no version or artifact hash is enforced.
  5. Malicious code may run during installation or when the dependency is imported or used by the API.

Exploitation depends on an upstream supply-chain compromise or untrusted package source; the audited repository itself does not contain a demonstrated malicious payload.

Impact Assessment

Successful exploitation could execute code with the privileges of the account installing or running the Skill. This may permit access to that account's files, environment ...[truncated 185 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to an exact, reviewed version rather than permitting unconstrained resolution.
  2. Generate and commit a reproducible lockfile that also fixes transitive dependency versions.
  3. Require cryptographic hashes for resolved artifacts where the package-management workflow supports them.
  4. Install packages only from an authenticated, trusted package index and prevent unintended fallback to untrusted indexes.
  5. Use automated dependency scanning and update pinned versions through a review and testing process.
  6. Run installation and the API service with least privilege and isolate them from unnecessary credentials and sensitive files.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill inspects environment variables and PATH-resolved binaries but declares no explicit tool scope or permissions boundary. That mismatch is risky because it normalizes environment introspection without transparent declaration, which can expose sensitive host context and make downstream skills rely on undeclared capabilities.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

Check environment

bash
curl -s -X POST http://localhost:8007/v1/check-env \
  -H "Content-Type: application/json" \
  -d '{"required_env": ["HOME", "PATH"], "required_bins": ["python", "git"]}' | jq

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

Check environment

bash
curl -s -X POST http://localhost:8007/v1/check-env \
  -H "Content-Type: application/json" \
  -d '{"required_env": ["HOME", "PATH"], "required_bins": ["python", "git"]}' | jq

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

bash
# Step 1: What does the skill need?
SCOPE=$(curl -s -X POST http://localhost:8002/v1/check-scope \
  -H "Content-Type: application/json" \
  -d "{\"skill_content\": $(cat SKILL.md | jq -Rs)}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This endpoint allows a caller to probe arbitrary environment variable names and learn which ones are set on the server. Even though it does not return values, presence/absence of sensitive variables such as API keys, cloud credentials, or deployment-specific secrets can leak useful reconnaissance information to an attacker and help them tailor follow-on attacks.

Content

No source excerpt is available for this finding.