ClawHub
Back to skill

Security audit

Skillforge

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small local Skill.md generator with no hidden data collection, persistence, or destructive behavior found.

Install only in an environment where running a local Python API server is acceptable. Review or pin the Python dependencies if reproducible or high-assurance installation matters, and do not expose the localhost service to untrusted networks.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:4
Finding

Unpinned Third-Party Runtime Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

yaml
metadata: {"openclaw":{"emoji":"🔨","requires":{"bins":["python"]},"install":[{"id":"pip","kind":"uv","packages":["fastapi","uvicorn","pydantic","pyyaml"]}]}}

Technical Analysis

The installation configuration requests fastapi, uvicorn, pydantic, and pyyaml without exact versions or integrity hashes. Consequently, dependency resolution can select mutable future releases rather than a fixed, previously reviewed dependency set.

This creates a supply-chain and build-reproducibility risk. If an upstream package, maintainer account, or distribution channel is compromised, a later installation could retrieve an affected release. These dependencies are directly used by the application: Uvicorn starts the service, FastAPI and Pydantic are imported by the API, and PyYAML is imported by the generator. Malicious code in a resolved package could therefore run during installation, executable startup, or module import.

No evidence indicates that the currently named packages are malicious, typosquatted, or presently compromised. Exploitation depends on an upstream compromise or unsafe future release.

Attack Path

  1. An attacker compromises an upstream dependency, its maintainer account, or the package distribution channel.
  2. The attacker publishes a malicious version under one of the dependency names listed in SKILL.md.
  3. A user installs the skill after that release becomes eligible for dependency resolution.
  4. Because no exact versions or hashes are specified, the resolver selects and downloads the malicious release.
  5. Attacker-controlled code executes during package installation, Uvicorn startup, or application module import.
  6. The malicious dependency can act with the privileges of the account or environment running the installation and ...[truncated 642 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to an exact, reviewed version, for example:
    yaml
    "packages":["fastapi==<reviewed-version>","uvicorn==<reviewed-version>","pydantic==<reviewed-version>","pyyaml==<reviewed-version>"]
  2. Generate and commit a lock file that records the complete transitive dependency graph.
  3. Require package hashes during installation where the installation mechanism supports them.
  4. Install only from an explicitly configured trusted package index over authenticated TLS.
  5. Use automated dependency vulnerability and provenance scanning, and review updates before modifying pins.
  6. Run installation and the API under a dedicated, least-privileged account without unnecessary access to secrets, sensitive files, or privileged host interfaces.
  7. Rebuild and test the locked environment regularly so security updates can be adopted deliberately without reverting to unconstrained resolution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

Generate a SKILL.md

bash
curl -s -X POST http://localhost:8003/v1/forge-skill \
  -H "Content-Type: application/json" \
  -d '{"name": "My Cool Tool", "description": "Does cool things.", "instructions": "Step 1: Be cool."}' | jq

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

Generate a SKILL.md

bash
curl -s -X POST http://localhost:8003/v1/forge-skill \
  -H "Content-Type: application/json" \
  -d '{"name": "My Cool Tool", "description": "Does cool things.", "instructions": "Step 1: Be cool."}' | jq