my-tools

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 1.0.0

Overview

This skill is a simple time-and-calculator helper, but its calculator path can run unsafe user-controlled Python through local execution.

Install only if you trust every user who can invoke the calculator and the execution environment is tightly sandboxed. The calculator should be replaced with a safe arithmetic parser, strict input limits, and structured non-shell argument passing before normal use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:23

Finding

Shell Command Injection Through User-Controlled Calculator Argument

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-26
Vulnerability Type: OS command injection
Risk Level: High

The skill instructs the agent to place a user-supplied mathematical expression into a shell command executed through the exec tool. The documented example is:

bash

python /root/.openclaw/workspace/skills/my_tools/calc.py “23 * 45 + 100”

Technical Analysis

The expression originates from an untrusted user and is inserted into a shell command without a required validation or escaping procedure. Moreover, the example uses typographic quotation marks (“ and ”), which Unix shells do not recognize as quoting characters. Shell metacharacters contained in the expression can therefore be interpreted by the shell rather than passed exclusively to calc.py.

Even if an implementation replaces the typographic marks with ordinary quotation marks, command injection remains possible if it builds a command string by direct concatenation and an attacker includes a matching quote in the expression.

Attack Path

1. An attacker submits a calculation request containing shell syntax, such as 1; id; #.
2. The agent follows SKILL.md and interpolates that expression into the documented command.
3. The shell treats the semicolons as command separators because the typographic marks provide no shell quoting.
4. calc.py is invoked with the first fragment, after which the injected id command executes.
5. An attacker could replace the proof-of-concept command with commands that read or alter files, inspect environment variables, or invoke other locally available programs.

Impact Assessment

Successful exploitation permits arbitrary command execution with the operating-system privileges of the agent or exec worker. The attacker could access any files, credentials, environment variables, and services available to that account, modify the workspace, or use the host's network access. This ...[truncated 156 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct a shell command by concatenating user input.
• Invoke the interpreter through a structured argument array with shell processing disabled, equivalent to:

  python

  subprocess.run(
      ["python", "/root/.openclaw/workspace/skills/my_tools/calc.py", expression],
      shell=False,
      check=True,
      capture_output=True,
      text=True,
  )
  

• Update the skill instructions to explicitly prohibit shell=True, command-string interpolation, and typographic quotation marks.
• Validate the expression against a strict arithmetic grammar before invoking any process.
• Apply length, numeric-size, execution-time, memory, and output-size limits.
• Run the calculator under a dedicated, unprivileged account with minimal filesystem and network access.

T09 · Insecure Skill Coding Practices

Warning

• Location: calc.py:2

Finding

Denial of Service Through Unbounded Arithmetic Evaluation

Content

View full analysis

Vulnerability Details

File Location: calc.py, lines 2-4
Vulnerability Type: Unsafe expression evaluation and resource exhaustion
Risk Level: Medium

The calculator evaluates the entire user-controlled expression directly:

python

try:
    expr = sys.argv[1]
    result = eval(expr, {"builtins": {}}, {})

Technical Analysis

Removing built-ins reduces straightforward access to dangerous functions, but it does not make eval a safe arithmetic parser. Python operators remain available, including exponentiation and operations on arbitrarily large integers.

A short expression can request an enormous computation or result, consuming excessive CPU time and memory. The subsequent conversion of a large result for printing can create additional CPU and memory pressure. There are no limits on expression complexity, operand size, computation time, memory consumption, or output size.

Catching Exception does not prevent resource exhaustion. The process may become unresponsive, be terminated by the operating system, or degrade other workloads before an exception can be handled.

Attack Path

1. An attacker submits a syntactically valid but computationally expensive expression, such as an exponentiation with an extremely large exponent.
2. The skill passes the expression to calc.py.
3. Line 3 invokes eval, and Python begins constructing the very large integer or processing another expensive operator chain.
4. The calculator consumes substantial CPU or memory before producing a result or error.
5. Repeated requests can exhaust worker capacity and deny calculator or agent service to other users.

Impact Assessment

Exploitation can terminate the calculator process, exhaust memory, consume CPU, and reduce availability of the agent or its shared host. If multiple invocations are allowed concurrently, repeated requests could affect other services on the same machine. No direct privilege escalation ...[truncated 70 chars]

Remediation

View remediation

Remediation Suggestions

• Replace eval with an arithmetic parser based on ast.parse in expression mode.
• Permit only explicitly approved nodes and operators, such as bounded integer literals and basic arithmetic operations.
• Reject names, attributes, calls, comprehensions, containers, subscripting, and all other non-arithmetic syntax.
• Impose strict limits on input length, AST node count, nesting depth, literal digit count, exponent size, intermediate value size, and output length.
• Execute calculations with an operating-system timeout and hard CPU and memory limits.
• Consider using fixed-width or bounded decimal arithmetic where arbitrary-precision integers are unnecessary.
• Return a controlled error when any configured complexity or resource limit is exceeded.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

eval() call detected

High

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

This code passes untrusted command-line input directly into eval(), which allows arbitrary Python expression execution. Although builtins is set to an empty dict, eval is still unsafe for attacker-controlled input because sandboxing is fragile and can often be bypassed or abused for denial of service or unintended object access depending on runtime behavior and surrounding context.

Content

Scanner excerpt · calc.py (reported line 4)May include surrounding context.

python

import sys
try:
    expr = sys.argv[1]
    result = eval(expr, {"builtins": {}}, {})
    print(f"{expr} = {result}")
except Exception as e:
    print(f"计算失败: {str(e)}")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill’s natural-language instructions and interaction model are entirely Chinese-specific, including trigger terms and behavior expectations, without offering a language choice or stating that it is intentionally limited to Chinese users. This creates a locale/language policy concern because the skill appears to enforce one language by default.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The time trigger matches very common words like “时间”, “日期”, and “几点”, which can cause the skill to activate in many routine conversations even when the user is not explicitly requesting tool use. Because activation leads to process execution via exec, an overly broad trigger increases the chance of unintended local command execution and makes prompt-routing easier to manipulate.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill mandates use of a general-purpose exec capability to perform simple tasks that do not inherently require shell/process execution. For the math function, passing user-supplied expressions into a script invocation expands the attack surface and can enable command injection or unsafe code paths inside the called script, while also granting broader local execution capability than the skill’s stated purpose suggests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The math trigger is broad and ambiguous, matching generic words and even raw expressions, which can cause automatic routing of untrusted input into a script-backed execution path. In this skill’s context, broad triggering is more dangerous because the resulting action is not a constrained calculator API but a local Python invocation that consumes user-controlled data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill is presented as a narrow two-function toolset, but its implementation relies on a general-purpose execution tool. This mismatch is dangerous because it normalizes granting unnecessarily powerful capabilities, making it easier for the agent to execute local code paths beyond the minimal functional need and increasing the blast radius of mistakes or prompt-triggered misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script prints its failure message only in Chinese (计算失败), which imposes a specific language on all users. There is no indication that the skill is region-specific or that users can opt into this locale, so this is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: calc.py:4