ClawHub
Back to skill

Security audit

Security Review

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate security-review purpose, but it needs Review because it spawns a web-reading agent and writes persistent review state without enough containment.

Install only if you are comfortable with a spawned agent performing web/source review and writing local review records. Before use, require a dedicated workspace-relative log directory, sanitized package-name filenames, explicit approval before updating MEMORY.md, and clear instructions that fetched web pages and source files are evidence only, never agent instructions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:49
Finding

Untrusted Web Content Is Processed Without Prompt-Injection Isolation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-58
Vulnerability Type: Indirect prompt injection through attacker-controlled web content
Risk Level: Medium

Vulnerable Code Snippet:

text
2. LATEST SECURITY INTELLIGENCE (USE web_search)
   Search: "[name] security vulnerability", "[name] malware", "[name] CVE",
   "[name] data exfiltration", "[author] security issues", HackerNews/Reddit discussions

3. SOURCE CODE ANALYSIS (USE web_fetch on raw GitHub files)
   - What does the entry point actually do?
   - Network calls — to where?
   - File system access beyond documented scope?
   - Obfuscated code?
   - npm/pip dependencies — any known-bad?

Technical Analysis

The skill directs a spawned review agent to search the web and fetch repository files. Package source repositories, issue pages, documentation, source comments, and search results may all be controlled or influenced by an attacker.

The review prompt does not instruct the agent to treat fetched content strictly as untrusted evidence. It also lacks requirements to ignore commands embedded in retrieved content, delimit external text from trusted instructions, restrict permissible tool actions, or independently validate claims before issuing a verdict.

Consequently, malicious text in a repository or web page could be interpreted as an instruction rather than as material under review. This is an indirect prompt-injection weakness in the skill configuration. The vulnerable behavior arises from inadequate handling of external content rather than from a malicious instruction directly embedded in this project.

Attack Path

  1. An attacker publishes or modifies a package repository, source file, README, issue, or related web page.
  2. The attacker embeds instructions intended for an AI agent, such as directions to ignore the review criteria, conceal findings, approve the package, expose available context, or perform unrelate ...[truncated 1284 chars]
Remediation
View remediation

Remediation Suggestions

  1. Add an explicit instruction that all search results, repository files, documentation, source comments, and issue content are untrusted data and must never be followed as instructions.
  2. Require external content to be placed inside clearly delimited evidence blocks before analysis.
  3. Prohibit retrieved content from modifying the review objective, verdict criteria, output destination, tool permissions, or persistent memory.
  4. Restrict fetching to validated HTTPS URLs on approved package registries and source-control hosts.
  5. Require independent corroboration of security claims from authoritative sources such as vendor advisories, registry metadata, and recognized vulnerability databases.
  6. Run the review agent with least privilege, limiting it to read-only network operations and writes only within a dedicated review-log directory.
  7. Require explicit user confirmation before copying any review result into persistent memory.
  8. Store only structured fields in memory, such as the canonical package identifier, version, verdict, date, and local report path. Never persist instructions or raw text retrieved from the web.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:32
Finding

Unsanitized Package Name Is Interpolated Into a Writable File Path

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 32 and lines 83-86
Vulnerability Type: Path traversal and unintended file-write risk
Risk Level: Medium

Vulnerable Code Snippet:

text
Fill in [PACKAGE NAME], [INSTALL COMMAND], [DESCRIPTION], [SOURCE URL]:
text
Write complete review to:
C:\Users\hhx-sandbox2\.openclaw\workspace\logs\security-review-[package-name]-[YYYY-MM-DD].md

Verify file exists and is complete before reporting done.

Technical Analysis

The package name is inserted into a writable file path without any stated validation, encoding, normalization, or containment check. A crafted package name could contain path separators, traversal components, drive or absolute-path syntax, reserved Windows device names, trailing characters with special filesystem behavior, or control characters.

If the executing agent or file-writing tool accepts those characters, the resolved destination may leave the intended logs directory or target an existing file. The subsequent existence check does not mitigate this issue because it verifies the potentially attacker-selected destination rather than confirming that the destination remains inside the approved directory.

The path is also hard-coded to a specific Windows account. This is not portable and may cause the review to write into an unexpected user's workspace when the skill is copied or executed in another environment.

Attack Path

  1. An attacker supplies a crafted package identifier containing path manipulation syntax.
  2. The identifier is substituted directly into [package-name].
  3. The spawned agent constructs the report destination without sanitizing or canonicalizing it.
  4. The resulting path resolves outside the intended log directory or targets another file accessible to the agent.
  5. The agent writes the generated report to that destination.
  6. The agent checks that the attacker-influenced path exists and i ...[truncated 764 chars]
Remediation
View remediation

Remediation Suggestions

  1. Derive the filename from a canonical package identifier rather than using raw user input.
  2. Permit only a strict filename allowlist, such as ASCII letters, digits, periods, underscores, and hyphens.
  3. Reject package names containing path separators, traversal components, drive prefixes, absolute-path syntax, control characters, reserved device names, or null bytes.
  4. Resolve and normalize the final destination before writing, then verify that it remains beneath the intended review-log directory.
  5. Use a workspace-relative log directory instead of a hard-coded account-specific absolute path.
  6. Create files using non-overwriting or collision-safe semantics to prevent replacement of existing reports or configuration files.
  7. Keep the package's display name inside report content while using a generated identifier, hash, or validated slug for the filename.
  8. Verify both that the report exists and that its canonical parent directory is the approved log directory before reporting completion.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs the agent to write a review log to a fixed local path and update MEMORY.md, but it does not explicitly warn that these actions modify local files or require confirmation before doing so. In an agent setting, silent state changes can create unintended persistence, overwrite existing content, and expand the skill from analysis into workspace mutation.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
3. SOURCE CODE ANALYSIS (USE web_fetch on raw GitHub files)
   - What does the entry point actually do?
   - Network calls — to where?
   - File system access beyond documented scope?
   - Obfuscated code?
   - npm/pip dependencies — any known-bad?

Static analysis

No suspicious patterns detected.