ClawHub
Back to skill

Security audit

Securitysuite

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a disclosed local security-scanning API, with operational cautions around local-server exposure, large batch requests, and unpinned dependencies rather than hidden malicious behavior.

Install only if you are comfortable running a local Python API that processes submitted skill text. Keep Uvicorn bound to localhost, do not expose port 8010 to untrusted networks without authentication and request-size limits, avoid submitting secrets or proprietary prompts, and prefer pinned dependency versions for repeatable installs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
securitysuite/models.py:148
Finding

Unbounded Batch Item Size Enables Resource Exhaustion

Content
View full analysis
BatchResponse: results = [] safe = 0 flagged = 0 for skill_content in request.skills: name, verdict, scan_f, undeclared, inj_p, _, _ = _run_full_audit(skill_content) ``` ### Technical Analysis `BatchRequest.skills` limits the number of list entries to 100 but does not constrain the length of each string. In contrast, the single-skill and text input models impose explicit limits of 500,000 and 100,000 characters. Each batch entry is synchronously processed by `_run_full_audit`, which invokes several pattern scanners and scope extractors. A request can therefore contain up to 100 arbitrarily large strings, resulting in substantial request-parsing memory use and repeated CPU-intensive scanning. Because this work runs synchronously inside an `async` endpoint, it can also block the application event loop. The issue is exploitable by any party able to reach `/v1/batch`. The documented Uvicorn command binds to localhost by default, which reduces default exposure, but the endpoint has no authentication or application-level body-size control if the service is exposed through another deployment configuration. ### Attack Path 1. An attacker obtains network access to the SecuritySuite API. 2. The attacker submits `POST /v1/batch` with up to 100 extremely large strings in the `skills` array. 3. The ASGI stack parses and retains the oversized JSON body. 4. The endpoint synchronously runs every large string through multiple scanners and extra ...[truncated 530 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:4
Finding

Unpinned Third-Party Dependencies Create Supply-Chain and Version-Drift Risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · securitysuite/reporter.py (reported line 8)May include surrounding context.

python
"""
Security report generator.

Combines scan, scope, and injection results into a structured
security report with severity ratings and recommendations.
"""

from .models import FindingDetail, FindingsBySeverity

# ── Pattern catalog with metadata ───────────────────────────────────────────

PATTERN_CATALOG = [
    # SkillScan patterns
    {
        "name": "credential_harvesting",
        "category": "malware",
        "description": "Skill references sensitive environment variables (API keys, tokens, passwords).",
        "severity": "CRITICAL",
        "recommendation": "Remove references to sensitive env vars or declare them in metadata.openclaw.requires.env.",

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · securitysuite/reporter.py (reported line 17)May include surrounding context.

python
severity ratings and recommendations.
"""

from .models import FindingDetail, FindingsBySeverity

# ── Pattern catalog with metadata ───────────────────────────────────────────

PATTERN_CATALOG = [
    # SkillScan patterns
    {
        "name": "credential_harvesting",
        "category": "malware",
        "description": "Skill references sensitive environment variables (API keys, tokens, passwords).",
        "severity": "CRITICAL",
        "recommendation": "Remove references to sensitive env vars or declare them in metadata.openclaw.requires.env.",
    },
    {
        "name": "data_exfiltration",
        "category": "malware",
        "description": "Skill makes outbound network requests that could send data to external services.",
        "severity": "HIGH",
        "recommendation": "Remove outbound network calls or document them clearly with legitimate purpose.",
    },
    {
        "nam

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · securitysuite/reporter.py (reported line 24)May include surrounding context.

python
{
        "name": "data_exfiltration",
        "category": "malware",
        "description": "Skill makes outbound network requests that could send data to external services.",
        "severity": "HIGH",
        "recommendation": "Remove outbound network calls or document them clearly with legitimate purpose.",
    },

Instruction Override

High
Category
Prompt Injection
Confidence
80% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · securitysuite/reporter.py (reported line 46)May include surrounding context.

python
{
        "name": "instruction_override",
        "category": "injection",
        "description": "Text attempts to override or ignore previous instructions.",
        "severity": "HIGH",
        "recommendation": "Sanitize user-facing text. Do not include instruction manipulation in skill content.",
    },

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · securitysuite/reporter.py (reported line 83)May include surrounding context.

python
"category": "injection",
        "description": "Attempts to extract system prompts or hidden instructions.",
        "severity": "MEDIUM",
        "recommendation": "Remove text that asks to reveal system prompts or instructions.",
    },
]

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill starts a local HTTP server and advertises multiple networked endpoints, but it declares no explicit tool scope or permissions describing that network capability. This weakens least-privilege controls and makes it harder for a host platform or reviewer to understand and constrain what the skill is allowed to do.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Scan text for prompt injection

bash
curl -s -X POST http://localhost:8010/v1/scan-text \
  -H "Content-Type: application/json" \
  -d '{"text": "What is the weather?"}' | jq

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The example sends the full contents of SKILL.md to an HTTP service for analysis. Even though the destination is localhost, this normalizes bulk transmission of potentially sensitive skill content to a network service, which can increase exposure if the service is misbound, proxied, logged, or later modified to forward data elsewhere.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

Audit a SKILL.md (full check)

bash
curl -s -X POST http://localhost:8010/v1/audit \
  -H "Content-Type: application/json" \
  -d "{\"skill_content\": $(cat SKILL.md | jq -Rs)}" | jq

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This endpoint example transmits the entire SKILL.md to generate a detailed report, again moving potentially sensitive local file content through a network interface. In context, that is more risky than the text-scan example because it encourages routine submission of full artifacts that may contain secrets, prompts, or proprietary instructions.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

Generate a security report with recommendations

bash
curl -s -X POST http://localhost:8010/v1/report \
  -H "Content-Type: application/json" \
  -d "{\"skill_content\": $(cat SKILL.md | jq -Rs)}" | jq

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The batch example submits multiple local skill files in one request, amplifying the same data-exposure risk by aggregating more content into a single network transmission. If the service is exposed beyond localhost or stores request data, this increases the blast radius and sensitivity of any compromise or misconfiguration.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

Batch audit multiple skills

bash
curl -s -X POST http://localhost:8010/v1/batch \
  -H "Content-Type: application/json" \
  -d "{\"skills\": [$(cat skill1.md | jq -Rs), $(cat skill2.md | jq -Rs)]}" | jq

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · securitysuite/reporter.py (reported line 24)May include surrounding context.

python
{
        "name": "data_exfiltration",
        "category": "malware",
        "description": "Skill makes outbound network requests that could send data to external services.",
        "severity": "HIGH",
        "recommendation": "Remove outbound network calls or document them clearly with legitimate purpose.",
    },