Security audit

Boris Workflow for OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill describes a plausible multi-agent workflow tool, but installation depends on unreviewed mutable remote code and inconsistent repository references, so users should review it before installing.

Install only after confirming the correct repository and reviewing the actual implementation, including requirements, CLI, Web UI startup script, and server code. Prefer a pinned release or commit, use a virtual environment, avoid exposing the Web UI beyond localhost, and back up ~/.boris before using the uninstall commands.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

Location: INSTALL.md:18
Finding: Mutable Remote Repository and Unpinned Dependencies Are Executed During Installation<![CDATA[ ## Vulnerability Details **File Location**: `INSTALL.md:18-29`, `INSTALL.md:95-97`; `SKILL.md:74-77`; `SKILL.json:5-6`, `SKILL.json:25-53`, `SKILL.json:120-123` **Vulnerability Type**: Mutable remote payload installation and insecure dependency management **Risk Level**: Medium ### Vulnerable Code `INSTALL.md:18-29`: ```bash cd ~/.openclaw/workspace/skills git clone https://github.com/mukston/boris-workflow.git cd boris-workflow ``` ```bash # Install required dependencies pip install -r requirements.txt # Or install as a package pip install -e . ``` `INSTALL.md:95-97`: ```bash cd ~/.openclaw/workspace/skills/boris-workflow git pull origin main pip install -r requirements.txt --upgrade ``` `SKILL.md:74-77`: ```bash # Install dependencies cd ~/.openclaw/workspace/skills/boris-workflow pip install -r requirements.txt ``` `SKILL.json:5-6`: ```json "homepage": "https://github.com/mukston-debug/boris-workflow", "repository": "https://github.com/mukston-debug/boris-workflow", ``` `SKILL.json:25-53`: ```json "dependencies": { "required": [ { "name": "pyyaml", "version": ">=6.0", "purpose": "YAML configuration parsing" }, { "name": "requests", "version": ">=2.28.0", "purpose": "HTTP client for API calls" } ], "optional": [ { "name": "fastapi", "version": ">=0.100.0", "purpose": "Web UI backend", "required_for": ["web-ui"] }, { "name": "uvicorn", "version": ">=0.23.0", "purpose": "ASGI server for Web UI", "required_for": ["web-ui"] }, { "name": "pydantic", "version": ">=2.0.0", "purpose": "Data validation for Web UI", "required_for": ["web-ui"] } ] }, ``` `SKILL.json:120-123`: ```json "entry_points": { "cli": "./bin/boris-run", "webui": "./webui/start.sh" }, ``` ### Technical Analysis The installation process instructs users to clone and execute content from the mutable default branch o ...[truncated 3486 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Include the complete executable implementation in the reviewed skill artifact, including the CLI, libraries, Web UI, tests, `requirements.txt`, and `pyproject.toml`. 2. Establish one canonical repository URL and use it consistently in `INSTALL.md`, `SKILL.json`, documentation, badges, and release metadata. 3. Replace default-branch installation with an immutable, versioned release: - Pin cloning instructions to a specific commit hash or cryptographically signed tag. - Publish checksums for release archives. - Document signature and checksum verification before installation. 4. Do not recommend `git pull origin main` as a production upgrade mechanism. Install a reviewed, signed release version instead. 5. Pin direct and transitive Python dependencies to reviewed versions using a lockfile. 6. Generate and enforce hashes, for example through a fully pinned requirements file used with `pip install --require-hashes`. 7. Avoid editable installation for ordinary users. Build a reproducible wheel in a controlled release pipeline and publish its hash and provenance. 8. Use a virtual environment with minimal filesystem and credential access during installation and execution. 9. Add automated supply-chain controls, including dependency vulnerability scanning, release signing, provenance attestations, and continuous verification of repository ownership. 10. Resubmit the complete implementation for code review before users execute the CLI or expose the Web UI. ]]>

SkillSpector

Vulnerability Patterns

Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ```bash # Remove the skill directory rm -rf ~/.openclaw/workspace/skills/boris-workflow # Remove configuration (optional) rm -rf ~/.boris
Confidence: 90% confidence
Finding: The documented command `rm -rf ~/.openclaw/workspace/skills/boris-workflow` performs forced recursive deletion, which is inherently dangerous because mistakes in path expansion, editing, or copy/paste can delete unintended files. In an installation guide, users may execute it without understanding the irreversible effect.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ```bash # Remove the skill directory rm -rf ~/.openclaw/workspace/skills/boris-workflow # Remove configuration (optional) rm -rf ~/.boris
Confidence: 90% confidence
Finding: The documented command `rm -rf ~/.openclaw/workspace/skills/boris-workflow` performs forced recursive deletion, which is inherently dangerous because mistakes in path expansion, editing, or copy/paste can delete unintended files. In an installation guide, users may execute it without understanding the irreversible effect.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: rm -rf ~/.openclaw/workspace/skills/boris-workflow # Remove configuration (optional) rm -rf ~/.boris # Uninstall Python package (if installed) pip uninstall boris-workflow
Confidence: 92% confidence
Finding: The command `rm -rf ~/.boris` recursively removes the user's Boris configuration directory, potentially deleting settings and local artifacts. Although marked optional, the guide does not warn users about what data may be lost, making accidental destructive use more likely.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: rm -rf ~/.openclaw/workspace/skills/boris-workflow # Remove configuration (optional) rm -rf ~/.boris # Uninstall Python package (if installed) pip uninstall boris-workflow
Confidence: 92% confidence
Finding: The command `rm -rf ~/.boris` recursively removes the user's Boris configuration directory, potentially deleting settings and local artifacts. Although marked optional, the guide does not warn users about what data may be lost, making accidental destructive use more likely.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Quick Configuration Create a user configuration file: ```bash mkdir -p ~/.boris
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The uninstall section instructs users to run recursive deletion commands on directories under their home folder without any explicit warning that these commands permanently delete files and configuration data. While the paths are specific rather than obviously destructive like `rm -rf /`, documentation that normalizes blind use of `rm -rf` can still cause accidental data loss, especially if users modify or copy the commands incorrectly.

Session Persistence

Medium

Category: Rogue Agent
Content: │ │ ──────────────────────── │ Model: [kimi-coding ▼] │ │ │ │ □ Research market trends │ Timeout: [300s ▼] │ │ │ │ □ Analyze competitors │ Retries: [2 ▼] │ │ │ │ □ Write summary report │ │ │ │ │ □ + Add Task │ [✓] Enable Verification │ │ │ └─────────────────────────────────────────────────────┘ │ │ │
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: │ │ ──────────────────────── │ Model: [kimi-coding ▼] │ │ │ │ □ Research market trends │ Timeout: [300s ▼] │ │ │ │ □ Analyze competitors │ Retries: [2 ▼] │ │ │ │ □ Write summary report │ │ │ │ │ □ + Add Task │ [✓] Enable Verification │ │ │ └─────────────────────────────────────────────────────┘ │ │ │
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: This markdown file documents automatic directory creation, timestamped artifact naming, cleanup policies, and later YAML/JSON export features, but it does not include any user-facing warning that running the workflow will write files to disk and retain artifacts. For a skill description, filesystem effects that may persist user task outputs should be disclosed so users understand data-handling impact before use.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The documentation instructs users to start a local web UI and browse to localhost:8080, but it does not warn that the service exposes workflow controls and results over HTTP. While this is not inherently malicious, users may assume the interface is private and safe by default, which can be risky on shared machines, forwarded ports, containers, or misconfigured hosts where localhost may become reachable beyond the intended boundary.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: INSTALL.md:121