T03 · Remote Payload Retrieval and Execution
Error
- Location
SETUP.md:44- Finding
Unverified Remote Installer Is Executed Directly by a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Educlaw Ielts Planner
Security checks for vulnerabilities and agentic risk
Overview
The skill’s IELTS planning purpose is mostly coherent, but its setup and runtime instructions expose users to high-impact install, credential, calendar, and background automation risks that need review before use.
Install only after choosing safer setup paths: avoid the curl-to-bash installer unless you have independently verified it, prefer isolated or pinned dependency installation, restrict Google Calendar and bot permissions, protect config files containing tokens, and disable Discord/Telegram or cron jobs unless you actually need automated reminders and reports.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T08 · Insecure Dependencies
Warning
- Location
SETUP.md:194- Finding
Third-Party Python Dependency Is Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SETUP.md:149- Finding
API Keys and Bot Tokens Are Stored in Plaintext Configuration Files
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:235- Finding
Generated Values Are Interpolated into Shell-Executed SQL Without Parameter Binding
- Content
View full analysis
', , , '', '', \ '', 'Planned', , 10);" ``` Vocabulary values are handled in the same way: ```bash sqlite3 workspace/tracker/educlaw.db "INSERT INTO vocabulary \ (word, ipa, pos, meaning, collocations, example, topic, session_id) \ VALUES ('', '', '', '', '', '', '', \ (SELECT id FROM sessions WHERE event_id=''));" ``` Materials are also interpolated: ```bash sqlite3 workspace/tracker/educlaw.db "INSERT OR IGNORE INTO materials \ (title, type, reference, skill, phase, status) \ VALUES ('', '<type>', '<url_or_page>', '<skill>', <phase>, 'Not Started');" ``` Update examples use the same construction pattern: ```bash sqlite3 workspace/tracker/educlaw.db "UPDATE sessions SET status='Completed', score=7.5, notes='Good progress on gap-fill' WHERE event_id='IELTS Phase 1 | Session 1 - Listening: Section 1-2 Gap Fill';" ``` ### Technical Analysis Topics, titles, vocabulary definitions, examples, URLs, and notes can originate from user input, model-generated content, calendar data, or external web resources. The command templates surround these values with SQL quotes but do not define escaping or parameter binding. An apostrophe in an ordinary value such as `student's progress` is sufficient to terminate the intended SQL string and cause an error. Crafted input may append additional SQL expressions or statements. Because ...[truncated 2021 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (59)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
Piping a remote script directly into bash executes unverified code from the network with no integrity pinning, review step, or signature verification. If the hosting domain, transport, or delivered script is compromised, users can be induced to run arbitrary commands on their system during installation.
- Content
Option A: One-line install (recommended)
bash curl -fsSL https://get.openclaw.dev | bashOption B: npm global install
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
The shell pipeline from curl to bash is a classic chaining pattern that removes the opportunity to inspect downloaded content and directly hands network data to a command interpreter. In a setup guide, this is especially dangerous because it normalizes executing arbitrary remote content during installation.
- Content
Option A: One-line install (recommended)
bash curl -fsSL https://get.openclaw.dev | bashOption B: npm global install
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The quick-start section repeats the same unsafe remote-script execution pattern, increasing the likelihood that users will follow the most dangerous path. Because quick-start blocks are often copied blindly, this materially raises exploitation risk.
- Content
bash # 1. Install OpenClaw curl -fsSL https://get.openclaw.dev | bash # 2. Run setup wizard (configures API key + model) openclaw config
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
The repeated curl-to-bash chain in the quick-start section compounds risk because users are most likely to copy that concise command without review. Any compromise of the source or path would immediately yield code execution on the host.
- Content
bash # 1. Install OpenClaw curl -fsSL https://get.openclaw.dev | bash # 2. Run setup wizard (configures API key + model) openclaw config
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
Fetching and executing a remote installer script from the network is a classic supply-chain risk because any compromise of the hosting domain, transport, or script content results in arbitrary code execution. This is especially dangerous here because later steps configure tokens, OAuth credentials, and a persistent gateway that could all be subverted.
- Content
Cách A: Cài một dòng (khuyên dùng)
bash curl -fsSL https://get.openclaw.dev | bashCách B: Cài qua npm
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
Chaining curl output directly into bash combines network retrieval and execution in a single step, eliminating inspection barriers and making arbitrary command execution immediate. In setup docs, this pattern is dangerous because users are primed to trust and run it verbatim.
- Content
Cách A: Cài một dòng (khuyên dùng)
bash curl -fsSL https://get.openclaw.dev | bashCách B: Cài qua npm
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Cách A: Dùng file client secret JSON từ Bước 3.2
bash gcalcli --client-id /đường/dẫn/client_secret.json listTrình duyệt sẽ mở ra để xác thực. Đăng nhập Google và cho phép.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Cách A: Dùng file client secret JSON từ Bước 3.2
bash gcalcli --client-id /đường/dẫn/client_secret.json listTrình duyệt sẽ mở ra để xác thực. Đăng nhập Google và cho phép.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Cách sửa:
bash rm -f ~/.gcalcli_oauth gcalcli list # Xác thực lại
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Cách sửa:
bash rm -f ~/.gcalcli_oauth gcalcli list # Xác thực lại
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The quick-start repeats the same unsafe remote script execution pattern, increasing the likelihood users will follow the shortest path without scrutiny. Repetition in a summary section amplifies the practical exploitation risk of a compromised installer endpoint.
- Content
bash # 1. Cài OpenClaw curl -fsSL https://get.openclaw.dev | bash # 2. Chạy setup wizard (cấu hình API key + model) openclaw config
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The same chaining pattern is repeated in the quick-start, where users are most likely to copy-paste commands without reading caveats. This meaningfully raises exploitability if the remote installer is altered or intercepted.
- Content
bash # 1. Cài OpenClaw curl -fsSL https://get.openclaw.dev | bash # 2. Chạy setup wizard (cấu hình API key + model) openclaw config
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill is permitted to create and edit files in the workspace, including the study plan and database, which introduces persistent state changes. If invoked unexpectedly or supplied bad inputs, it can overwrite planning artifacts or corrupt tracking data, and the persistence makes mistakes durable across sessions.
- Content
md 1. **Delete Calendar events NOT tracked in the SQLite database** → NEVER delete events that EduClaw did not create. Only events with a matching event_id in `workspace/tracker/educlaw.db` sessions table may be deleted, and ONLY after user confirmation. 2. **Auto-select time slots** → MUST ask user first (Step 0). 3. **Place events outside chosen window** → ASK if blocked, don't auto-move. 4. **Delete files/emails** → Only CREATE and EDIT your own files. 5. **Retry on API errors** → STOP, report, suggest checks. 6. **Skip approval step** → Must have user consent before Calendar events. 7. **Create >14 events at once** → Batch by 2 weeks, ask to continue.
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md --- ## Channel-Specific Output Rules ### Discord Output - **Message limit:** 2000 characters max per message. Split if longer.
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md --- ## Channel-Specific Output Rules ### Discord Output - **Message limit:** 2000 characters max per message. Split if longer.
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The line describes 'Bilingual support (English & Vietnamese) with automatic language detection'. Under the policy rule, forcing or automatically selecting a language/locale without explicit user opt-in can be a natural-language policy concern, because it does not state that users can choose their preferred language.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The README advertises web search and Discord-based automation for study planning and progress reporting, but it does not warn users that study schedules, calendar metadata, or progress details may be transmitted to third-party services. This creates a real privacy and data-handling risk because users may enable these integrations without understanding what personal data leaves the local environment.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The setup guide expands the skill’s effective capabilities beyond IELTS planning by enabling Discord and Telegram bot channels, which create externally reachable interfaces for the agent. Even if not inherently malicious, adding network-facing messaging channels increases attack surface, privacy risk, and the chance the skill is used in contexts not clearly disclosed by the manifest.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
text This runs the setup wizard. It will: - Create `~/.openclaw/` directory - Prompt for model provider and API key - Set up basic config
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instructions tell users to place API credentials and bot tokens directly into configuration files without prominent secret-handling guidance. This creates a realistic risk of accidental disclosure through shell history, backups, screenshots, misconfigured file permissions, or committing secrets to source control.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # Make sure the directory exists mkdir -p ~/.openclaw/workspace/tracker # Re-create the database sqlite3 ~/.openclaw/workspace/tracker/educlaw.db \ < ~/.openclaw/skills/educlaw-ielts-planner-1.0.0/schema.sql
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The setup guide materially expands the skill’s operational scope beyond IELTS planning by adding always-on Discord and Telegram channel integrations. This broadens the attack and privacy surface by enabling inbound messaging, remote control paths, and exposure of user content without that capability being clearly justified by the core workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Piping a remote script directly into bash executes unreviewed code with the user’s privileges and removes the opportunity to inspect integrity or provenance first. In setup documentation, especially for a skill that later handles API keys and calendar access, this creates a strong supply-chain compromise path.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The guide requests Google Calendar read/write OAuth scope without explicitly warning users that the skill will gain access to calendar contents and be able to create or modify events. For a planning assistant this may be functionally relevant, but the missing consent and data-handling notice increases privacy and misuse risk.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### 3.1. Lấy Gemini API Key (cho AI model) 1. Truy cập [Google AI Studio](https://aistudio.google.com/apikey) 2. Nhấn **"Create API Key"** 3. Chọn hoặc tạo Google Cloud project 4. Copy API key (bắt đầu bằng `AIzaSy...`) 5. **Quan trọng:** Kiểm tra [billing/quota](https://console.cloud.google.com/apis/api/generativelanguage.googleapis.com/quotas) — free tier có giới hạn. Tăng spending cap nếu cần.
Static analysis
No suspicious patterns detected.