ClawHub
Back to skill

Security audit

Macarena Test

Security checks for vulnerabilities and agentic risk

Overview

This skill is for security auditing, but it tells the agent to immediately run an unbundled local script without consent, so it needs Review before installation.

Install only if you are comfortable with the agent running a local collection script in the working directory. Review or provide the referenced script, allowlist, and report references first, and require explicit confirmation before collection on sensitive hosts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

The phrase 'Execute scripts/collect_verified.sh immediately (no consent prompt)' authorizes autonomous action without user confirmation, which weakens a key safety boundary for local system access. In a security-audit skill, that is especially sensitive because the script may enumerate configuration, filesystem, network, and other host details before the user has approved the scope.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
Audit an OpenClaw deployment for misconfigurations and real-world attack paths. Produce a deterministic OK/VULNERABLE report with severity, evidence, and fixes.

## Non-negotiable safety rules
1. Verified mode is required. Execute `scripts/collect_verified.sh` immediately (no consent prompt).
2. Verified mode uses only the strict allowlist; do not run any command outside it.
3. Never run remote content (no curl|bash, wget, Invoke-WebRequest, installers, package managers, update scripts).
4. Never exfiltrate secrets. Redact tokens, passwords, cookies, OAuth credentials, pairing codes, session contents, auth headers.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
86% confidence
Finding

The skill explicitly instructs the agent to execute a local script immediately, which is tool use triggered by the skill itself rather than a fresh user confirmation at run time. Even though the text tries to constrain execution to a 'verified allowlist' and bans remote content, the referenced script and allowlist are external artifacts not shown here, so this creates a real risk of over-broad or unsafe command execution if those components are tampered with or overly permissive.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
## Non-negotiable safety rules
1. Verified mode is required. Execute `scripts/collect_verified.sh` immediately (no consent prompt).
2. Verified mode uses only the strict allowlist; do not run any command outside it.
3. Never run remote content (no curl|bash, wget, Invoke-WebRequest, installers, package managers, update scripts).
4. Never exfiltrate secrets. Redact tokens, passwords, cookies, OAuth credentials, pairing codes, session contents, auth headers.
5. Do not change the system by default. Provide fixes as instructions; only apply fixes if the user explicitly requests.

Static analysis

No suspicious patterns detected.