T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/openclaw_config.py:350- Finding
Authentication secrets are accepted through command-line arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai Config Admin
Security checks for vulnerabilities and agentic risk
Overview
This skill is a legitimate AI configuration manager, but it can persistently rewrite sensitive agent settings and credentials in ways users should review carefully.
Review this before installing if you use shared machines, CI workers, or sensitive provider credentials. Use it only for deliberate AI config changes, avoid passing real secrets as command-line arguments, inspect diffs before full-file replacements, check permissions on generated config and backup files, and remove old backups that may contain rotated credentials.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/codex_config.py:59- Finding
Credential-bearing configuration files are created without enforced restrictive permissions
- Content
View full analysis
None: path.parent.mkdir(parents=True, exist_ok=True) backup_config(path) with path.open("w", encoding="utf-8") as f: json.dump(data, f, ensure_ascii=False, indent=2) f.write("\n") ``` The corresponding backup operation in `scripts/openclaw_config.py:19-24` is: ```python def backup_config(path: Path) -> Path | None: if not path.exists(): return None stamp = datetime.now().strftime("%Y%m%d%H%M%S%f") backup_path = path.with_name(f"{path.name}.{stamp}.bak") shutil.copy2(path, backup_path) return backup_path ``` From `scripts/codex_config.py:59-63`: ```python def write_text(path: Path, text: str) -> None: path.parent.mkdir(parents=True, exist_ok=True) backup_file(path) with path.open("w", encoding="utf-8") as f: f.write(text) ``` From `scripts/codex_config.py:235-237`: ```python if args.cmd == "replace-auth-from-stdin": data = load_json_text(sys.stdin.read()) write_text(auth_path, json.dumps(data, ensure_ascii=False, indent=2) + "\n") ``` From `scripts/claude_config.py:46-51`: ```python def save_settings(path: Path, data: dict) -> None: path.parent.mkdir(parents=True, exist_ok=True) backup_file(path) with path.open("w", encoding="utf-8") as f: json.dump(data, f, ensure_ascii=False, indent=2) f.write("\n") ``` From `scripts/opencode_config.py:27-32`: ```python def save_config(path: Path, data: dict) -> None: path.parent.mkdir(parents=True, exist_ok=True) backup_config(path) with path.open("w", encoding="utf ...[truncated 2360 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The description claims a multi-tool configuration manager spanning OpenClaw, OpenCode, Codex CLI, and Claude Code, plus broader transformation abilities for natural-language, irregular JSON, and TOML inputs. This code chunk does not implement that broad scope. It only operates on Claude Code's settings.json (defaulting to ~/.claude/settings.json or a provided file), and only supports four actions: summary, replace entire config from stdin using valid JSON, set selected env vars, and replace a fixed list of Claude-related env vars. It does not parse TOML, does not handle natural-language input, does not manage other named tools or files, and does not provide generic provider/model management beyond a few Anthropic-related environment keys. While part of the declared description overlaps with Claude Code/settings.json handling, the declared purpose materially overstates the actual behavior of this specific code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The script is narrowly scoped to Codex CLI config/auth management. It reads and writes ~/.codex/config.toml and ~/.codex/auth.json, summarizes current settings, replaces entire files from stdin, and applies targeted updates to a fixed OpenAI provider section. The declared description substantially overstates the scope by covering multiple products and broader transformation capabilities that are absent from the code. While some declared functionality overlaps (Codex config replacement/update, provider/model setting, OPENAI_API_KEY presence in auth), the overall description does not accurately represent the actual behavior of this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The declared description is broader than the supplied code. The script is specifically an OpenClaw config editor for a JSON file, not a general multi-tool configuration manager. It has no logic for OpenCode, Codex CLI, Claude Code, auth.json/settings.json/config.toml handling, or natural-language/irregular-format conversion. While many listed OpenClaw-related actions are accurate (add/remove models/providers, set defaults, update provider credentials, write backups), the overall declared purpose materially overstates the scope and supported formats/tools. Therefore this is a description-behavior mismatch.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 92% confidence
- Finding
The skill is designed to access and modify sensitive agent configuration files under ~/.codex, which can control model providers, authentication mode, endpoints, and other runtime behavior. Because these files influence future agent execution and may contain secrets or trust settings, write access to them creates a high-risk persistence and redirection surface if the skill is abused or tricked by untrusted input.
- Content
md - OpenClaw: `~/.openclaw/openclaw.json` - OpenCode: `~/.config/opencode/opencode.json` - Codex CLI: `~/.codex/config.toml`, `~/.codex/auth.json` - Claude Code: `~/.claude/settings.json` ## Routing
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 93% confidence
- Finding
Access to ~/.claude/settings.json allows persistent modification of Claude Code environment settings, including base URLs, tokens, and model selection. That can redirect traffic to attacker-controlled services, alter trust boundaries, or persist unsafe settings across sessions, making this particularly dangerous in a skill that accepts natural-language instructions.
- Content
md - OpenClaw: `~/.openclaw/openclaw.json` - OpenCode: `~/.config/opencode/opencode.json` - Codex CLI: `~/.codex/config.toml`, `~/.codex/auth.json` - Claude Code: `~/.claude/settings.json` ## Routing
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
The documented command path shows the skill can operate directly on ~/.codex/config.toml, a sensitive runtime configuration file for the coding agent. Persistent modification of model/provider settings in this location can change future behavior, networking, and authentication assumptions beyond the current task.
- Content
bash python3 {baseDir}/scripts/codex_config.py --help python3 {baseDir}/scripts/codex_config.py --config-file ~/.codex/config.toml --auth-file ~/.codex/auth.json summary python3 {baseDir}/scripts/codex_config.py --config-file ~/.codex/config.toml replace-config-from-stdin <<'EOF' model_provider = "OpenAI" model = "gpt-5.4"
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
The replace-config-from-stdin workflow enables full replacement of the Codex CLI config, which is more dangerous than targeted updates because it can silently remove safeguards or add hostile settings. Full-file replacement on agent config creates a strong persistence primitive for malicious reconfiguration.
- Content
bash python3 {baseDir}/scripts/codex_config.py --help python3 {baseDir}/scripts/codex_config.py --config-file ~/.codex/config.toml --auth-file ~/.codex/auth.json summary python3 {baseDir}/scripts/codex_config.py --config-file ~/.codex/config.toml replace-config-from-stdin <<'EOF' model_provider = "OpenAI" model = "gpt-5.4" EOF
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 93% confidence
- Finding
The skill can invoke commands that modify ~/.claude/settings.json and set Claude-related env values, including authentication material. This can persistently alter how the agent authenticates and where it sends requests, potentially enabling credential misuse or endpoint hijacking.
- Content
bash python3 {baseDir}/scripts/claude_config.py --help python3 {baseDir}/scripts/claude_config.py --file ~/.claude/settings.json summary python3 {baseDir}/scripts/claude_config.py --file ~/.claude/settings.json set-env \ --anthropic-auth-token 'sk-...' \ --attribution-header '0'
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 94% confidence
- Finding
The replace-env operation can rewrite the Claude-related environment key set in a persistent settings file. Because these values control backend routing and authentication context, a malicious or mistaken change could redirect all future model traffic or disable expected protections.
- Content
bash python3 {baseDir}/scripts/claude_config.py --help python3 {baseDir}/scripts/claude_config.py --file ~/.claude/settings.json summary python3 {baseDir}/scripts/claude_config.py --file ~/.claude/settings.json set-env \ --anthropic-auth-token 'sk-...' \ --attribution-header '0' python3 {baseDir}/scripts/claude_config.py --file ~/.claude/settings.json replace-env \
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 94% confidence
- Finding
This example shows direct replacement of Claude settings with attacker-influencable base URL and token values. In context, the skill's purpose is configuration management, which makes such writes expected, but that same context also makes the impact greater because the changes are persistent and affect future agent trust and network destinations.
- Content
md python3 {baseDir}/scripts/claude_config.py --file ~/.claude/settings.json set-env \ --anthropic-auth-token 'sk-...' \ --attribution-header '0' python3 {baseDir}/scripts/claude_config.py --file ~/.claude/settings.json replace-env \ --anthropic-base-url 'https://example.invalid' \ --anthropic-auth-token 'sk-...' \ --attribution-header '0'
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 91% confidence
- Finding
Whole-file replacement of ~/.claude/settings.json from stdin is a high-risk primitive because it allows broad persistent reconfiguration with minimal structure enforcement. If influenced by adversarial input, it could remove unrelated protections, insert unsafe env values, or corrupt the agent's operating configuration.
- Content
--anthropic-base-url 'https://example.invalid'
--anthropic-auth-token 'sk-...'
--attribution-header '0' python3 {baseDir}/scripts/claude_config.py --file ~/.claude/settings.json replace-from-stdin <<'EOF' {"env":{"ANTHROPIC_BASE_URL":"https://example.invalid"}} EOFtext
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares broad file read/write behavior over sensitive local configuration files but does not define any explicit tool scope or permission boundaries. In a config-admin skill that can modify agent and provider settings, missing scope increases the chance of overbroad access, unintended writes, or abuse through prompt-driven actions.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
Mandatory backup creation introduces additional persistent copies of sensitive configuration files in-place, potentially including API keys, auth tokens, and provider endpoints. Those backup artifacts can expand the secret exposure surface, survive later cleanup, and be read by other tools or users depending on filesystem permissions.
- Content
md - Follow this skill and the existing script capabilities exactly. - Do not manually edit config files to bypass script limitations. - If the request is outside current script support, say so clearly and explain what is missing. - Before every write, create a backup in the same directory as the original file. - Perform backup and write through the bundled script, not manual editing. - Do not echo secrets such as `apiKey`, `OPENAI_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, tokens, or refresh tokens in replies.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The
replace-auth-from-stdinpath accepts JSON from stdin and overwrites the auth file, which can contain sensitive authentication material such as API keys or tokens. Although the code validates and writes the data, there is no confirmation prompt, log/print disclosure, or inline comment/docstring warning users that credential data will be stored or replaced.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code creates parent directories, makes a backup copy, and overwrites the target configuration file, but provides no confirmation prompt, user-facing print/log message, or explanatory comment/docstring around these file modifications. For a code file, safety-relevant file writes should have some visible disclosure unless clearly documented elsewhere, which is not evident in this file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The function stores a provided API key into the provider configuration, which is credential handling and persistence of sensitive data, but there is no confirmation, user-facing warning, or explanatory comment/docstring in the code. The same pattern is exposed through CLI commands, so users may not be clearly informed that secrets will be written to disk.
- Content