Birdbuddy

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:26 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Bird Buddy query helper, but users should handle the required account password carefully.

Install only if you are comfortable giving the skill and the pybirdbuddy dependency access to your Bird Buddy email/password and feeder data. Prefer a secret manager or tightly protected environment variables over a committed or shared .env file, and consider pinning/reviewing the pybirdbuddy package version before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16
• Finding: Unpinned Security-Sensitive Third-Party Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-17` and `README.md:9-10` **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md:16-17`: ```markdown ## Requirements - `pybirdbuddy` Python package: `pip install pybirdbuddy` ``` `README.md:9-10`: ```markdown ## Requirements - `pip install pybirdbuddy` ``` The installed dependency is imported and entrusted with account credentials at `run.py:9` and `run.py:25`: ```python from birdbuddy.client import BirdBuddy ``` ```python bb = BirdBuddy(BB_EMAIL, BB_PASSWORD) ``` ### Technical Analysis The installation instructions retrieve the latest available `pybirdbuddy` release without specifying an audited version, cryptographic hashes, a lock file, or a trusted package source. Package installation can execute package-controlled build or installation logic, and the resulting library executes in the same Python process as the Skill. This dependency is particularly security-sensitive because `run.py` passes the user's Bird Buddy email address and password directly to its `BirdBuddy` class. A compromised upstream release, package-index account, distribution artifact, or package source could therefore access those credentials and execute arbitrary code under the operating-system account running the Skill. There is no evidence in the audited project that the current dependency is malicious. The issue is the absence of controls preventing an unreviewed future package version from being installed and executed. ### Attack Path 1. An attacker compromises the upstream package maintainer, publishing account, package-index distribution, or another part of the package supply chain. 2. The attacker publishes a modified `pybirdbuddy` release containing malicious installation or runtime code. 3. A user follows the documented `pip install pybirdbuddy` command, which resolves to the compromised latest release. 4. The malicious dependency executes d ...[truncated 904 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `pybirdbuddy` to a specific version that has been reviewed and tested: ```text pybirdbuddy==<audited-version> ``` 2. Maintain dependencies in a lock file with cryptographic hashes, such as a hash-locked `requirements.txt`. 3. Install with hash verification: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Document the expected package index and upstream repository rather than relying on the user's default package-index configuration. 5. Review dependency updates before changing the pinned version, including package ownership, release provenance, build configuration, and transitive dependencies. 6. Run the Skill under a dedicated, minimally privileged operating-system account or sandbox with access only to the required credentials and network destinations. 7. Prefer short-lived authentication tokens over reusable account passwords if the upstream service and library add support for them. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: run.py:12
• Finding: Bird Buddy Password Stored and Loaded from a Plaintext Environment File<![CDATA[ ## Vulnerability Details **File Location**: `README.md:12-17` and `run.py:12-20` **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: Medium ### Vulnerable Code `README.md:12-17` instructs users to persist credentials in a local `.env` file: ```markdown ## Setup Add to your skill's `.env`: ``` BIRDBUDDY_EMAIL=[e-mail] BIRDBUDDY_PASSWORD=yourpassword ``` ``` `run.py:12-20` automatically reads that file without checking its ownership or permissions: ```python # Load .env from same directory as this script env_file = Path(__file__).parent / ".env" if env_file.exists(): for line in env_file.read_text().splitlines(): if "=" in line and not line.startswith("#"): k, v = line.split("=", 1) os.environ.setdefault(k.strip(), v.strip()) BB_EMAIL = os.environ.get("BIRDBUDDY_EMAIL") BB_PASSWORD = os.environ.get("BIRDBUDDY_PASSWORD") ``` ### Technical Analysis The Skill legitimately requires Bird Buddy authentication to perform its declared remote feeder queries. However, persistent storage of a reusable account password in a plaintext `.env` file is not the minimum necessary credential-handling mechanism. The implementation reads `.env` from the project directory but does not verify that the file: - Is owned by the expected user. - Is not a symbolic link. - Has restrictive permissions. - Is excluded from source control, backups, logs, and artifact packaging. Any process or local user able to read the project directory may obtain the password. Project-directory credentials are also susceptible to accidental source-control commits, archive inclusion, workspace synchronization, and backup exposure. The parser additionally places values into the process environment. Although required environment variables are part of the declared Skill interface, inherited environment exposure can make credentials accessible to child processes or diagnostic tooling launched from the same process context. No ...[truncated 1709 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer runtime secret injection through the OpenClaw secret-management mechanism or an operating-system credential store instead of a project-local `.env` file. 2. Do not document plaintext `.env` storage as the preferred setup method. If retained as a fallback, clearly identify its risks. 3. Add `.env` to `.gitignore` and package-exclusion configuration. Provide an `.env.example` containing placeholders only. 4. Require restrictive file permissions before reading the file, such as owner read/write only (`0600` on POSIX systems), and reject files with unsafe permissions. 5. Verify file ownership and reject symbolic links or other unexpected file types before loading credentials. 6. Avoid propagating secrets to unnecessary child processes and clear references when they are no longer required where practical. 7. Use a unique Bird Buddy password that is not reused by other accounts. 8. Prefer scoped, revocable, short-lived API tokens if Bird Buddy provides such an authentication mechanism in the future. 9. Add secret-scanning checks to version-control and release pipelines to prevent accidental credential publication. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation

Content

from datetime import datetime, timedelta, timezone
from birdbuddy.client import BirdBuddy

# Load .env from same directory as this script
env_file = Path(__file__).parent / ".env"
if env_file.exists():
    for line in env_file.read_text().splitlines():

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from birdbuddy.client import BirdBuddy

# Load .env from same directory as this script
env_file = Path(__file__).parent / ".env"
if env_file.exists():
    for line in env_file.read_text().splitlines():
        if "=" in line and not line.startswith("#"):

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to place Bird Buddy account credentials directly in a .env file, but provides no warning that these are sensitive secrets or guidance to prevent accidental disclosure. While using environment variables is common, documenting raw email/password storage without secure-handling advice increases the chance of credentials being committed to source control, exposed in logs, or left in insecure local environments.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill invokes code and relies on environment variables, but it does not declare an explicit tool scope such as permissions or allowed-tools. That makes the skill's operational capabilities less transparent to the hosting agent framework and users, increasing the risk of unexpected access to sensitive data like credentials or local files.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs users to place Bird Buddy account email and password in environment variables, but provides no warning about credential sensitivity, storage hygiene, or safer alternatives. This can normalize insecure credential handling and increase the chance that secrets are exposed through logs, shell history, debugging output, or overly broad agent access.