ClawHub
Back to skill

Security audit

Ratelimiter

Security checks for vulnerabilities and agentic risk

Overview

This skill runs a small local in-memory rate limiter, and the reviewed behavior matches that purpose without hidden data collection or persistence.

Install only in an isolated Python environment, prefer pinned dependency versions, and run the server on localhost only. Do not put real API secrets in rate-limit keys, since keys are listed by the local API.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:4
Finding

Unpinned Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:4
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code:

yaml
metadata: {"openclaw":{"emoji":"⏱️","requires":{"bins":["python"]},"install":[{"id":"pip","kind":"uv","packages":["fastapi","uvicorn","pydantic"]}]}}

Technical Analysis

The installation metadata specifies fastapi, uvicorn, and pydantic without exact versions, cryptographic hashes, or a reviewed lockfile. Consequently, installation resolves whichever compatible releases and transitive dependencies are available from the package source at that time.

This creates a supply-chain risk: compromise of a package publisher, malicious publication of a future release, or compromise of a transitive dependency could introduce attacker-controlled code after the Skill has already been reviewed. No currently malicious package or dependency-confusion namespace was confirmed during this source audit; the finding concerns the unsafe dependency-resolution policy.

Attack Path

  1. An attacker compromises a listed package, one of its transitive dependencies, or the package distribution channel.
  2. The attacker publishes a malicious release under a dependency name accepted by the unconstrained installation specification.
  3. A user installs or reinstalls the Skill after that release becomes available.
  4. The package manager resolves and installs the malicious release because no reviewed version or hash is enforced.
  5. Malicious installation hooks or imported runtime code execute in the Skill environment.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the account installing or running the Skill. The resulting access could include data and credentials available to that account, modification of the Python environment, tampering with application behavior, and outbound network access permitted by the host. The pract ...[truncated 85 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every direct dependency to an exact, reviewed version.
  • Generate and commit a lockfile that also fixes transitive dependency versions.
  • Require cryptographic hashes for downloaded distributions where the installation system supports them.
  • Install packages only from an explicitly trusted package index over authenticated TLS.
  • Prefer reviewed immutable artifacts and disable unintended fallback indexes to reduce dependency-confusion exposure.
  • Use automated vulnerability and provenance scanning, but apply dependency updates only after review and testing.
  • Perform installation and runtime execution under a dedicated, least-privileged account or isolated environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · ratelimiter/app.py (reported line 10)May include surrounding context.

python
GET    /v1/check/{key}      — check if a request is allowed
  POST   /v1/consume/{key}    — consume one request from quota
  POST   /v1/reset/{key}      — reset quota for a key
  DELETE /v1/limits/{key}     — delete a rate limit
"""

from fastapi import FastAPI, HTTPException

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documents and requires network-capable behavior (running an HTTP server and invoking it via curl) but does not declare any explicit tool scope or permissions metadata. This creates a governance and least-privilege gap: an agent platform may permit broader network use than intended or fail to warn users that the skill exposes and uses HTTP endpoints.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

Create a rate limit

bash
curl -s -X POST http://localhost:8012/v1/limits \
  -H "Content-Type: application/json" \
  -d '{"key": "openai-api", "max_requests": 60, "window_seconds": 60}' | jq

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file documents quota reset and deletion actions, which can irreversibly alter the skill's in-memory state, but it does not warn users about the impact of these operations. Under the markdown-specific warning criterion, behaviors affecting system integrity or stored state should be disclosed so users understand the consequences before invoking them.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.