T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate-pearls.js:36- Finding
Raw Private Workspace Data Can Be Transmitted to a Network Gateway
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawBuddy Buddy
Security checks for vulnerabilities and agentic risk
Overview
The skill largely matches its stated ClawBuddy buddy purpose, but it has review-worthy privacy and local-integrity risks around reading workspace memory, broad env loading, and temporary consultation files.
Review carefully before installing. Use only a dedicated skill-local .env, keep GATEWAY_URL on literal loopback, avoid generate --all on private workspaces unless you have reviewed the outgoing source set, inspect generated pearls before publishing or uploading, and avoid running the production systemd service until the /tmp consultation-file handling is hardened.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/human-reply.js:12- Finding
Predictable Temporary Consultation Files Permit Local Injection and Symlink Attacks
- Content
View full analysis
"Your guidance here"'); console.error(''); console.error('Check /tmp/buddy-consult-*.txt for pending consultations.'); process.exit(1); } const consultFile = `/tmp/buddy-consult-${sessionId}.txt`; fs.writeFileSync(consultFile, message, 'utf-8'); console.log(`✅ Guidance written for session ${sessionId}`); console.log(` The buddy listener will pick this up and generate a response.`); ``` The listener consumes and deletes the same predictable path: ```javascript const consultFile = `/tmp/buddy-consult-${sessionId}.txt`; const pollInterval = setInterval(() => { try { if (fs.existsSync(consultFile)) { const humanInput = fs.readFileSync(consultFile, 'utf-8').trim(); fs.unlinkSync(consultFile); clearInterval(pollInterval); clearTimeout(timeoutHandle); pendingConsults.delete(sessionId); console.log(`👤 Human responded (${humanInput.length} chars)`); resolve(humanInput); } } catch {} }, 3000); ``` ### Technical Analysis The consultation mechanism uses a predictable pathname in the globally shared `/tmp` directory. It does not: - Validate `sessionId` - Reject path separators or traversal components - Create a private per-user directory - Use exclusive file creation - Disable symbolic-link following - Verify file ownership or file type - Set an explicit restrictive file mode - Authenticate the source of the guidance `fs.writeFileSync()` follows existing symbolic links. The listener subsequently follows the same path whe ...[truncated 2200 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lib/env.js:46- Finding
Overbroad Environment-File Discovery Accesses Unrelated Credentials and Allows Configuration Precedence Abuse
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:31- Finding
Unpinned Remote Installer Commands Create a Supply-Chain Execution Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (100)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Uploading pearls to remote infrastructure is a distinct exfiltration path for local content, not merely SSE buddy interaction. Without a clear description, users may not appreciate that local markdown is transmitted off-host using bearer-token authentication.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Uploading pearls to remote infrastructure is a distinct exfiltration path for local content, not merely SSE buddy interaction. Without a clear description, users may not appreciate that local markdown is transmitted off-host using bearer-token authentication.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Uploading pearls to remote infrastructure is a distinct exfiltration path for local content, not merely SSE buddy interaction. Without a clear description, users may not appreciate that local markdown is transmitted off-host using bearer-token authentication.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Uploading pearls to remote infrastructure is a distinct exfiltration path for local content, not merely SSE buddy interaction. Without a clear description, users may not appreciate that local markdown is transmitted off-host using bearer-token authentication.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Uploading pearls to remote infrastructure is a distinct exfiltration path for local content, not merely SSE buddy interaction. Without a clear description, users may not appreciate that local markdown is transmitted off-host using bearer-token authentication.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Uploading pearls to remote infrastructure is a distinct exfiltration path for local content, not merely SSE buddy interaction. Without a clear description, users may not appreciate that local markdown is transmitted off-host using bearer-token authentication.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Uploading pearls to remote infrastructure is a distinct exfiltration path for local content, not merely SSE buddy interaction. Without a clear description, users may not appreciate that local markdown is transmitted off-host using bearer-token authentication.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Uploading pearls to remote infrastructure is a distinct exfiltration path for local content, not merely SSE buddy interaction. Without a clear description, users may not appreciate that local markdown is transmitted off-host using bearer-token authentication.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Uploading pearls to remote infrastructure is a distinct exfiltration path for local content, not merely SSE buddy interaction. Without a clear description, users may not appreciate that local markdown is transmitted off-host using bearer-token authentication.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Uploading pearls to remote infrastructure is a distinct exfiltration path for local content, not merely SSE buddy interaction. Without a clear description, users may not appreciate that local markdown is transmitted off-host using bearer-token authentication.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Uploading pearls to remote infrastructure is a distinct exfiltration path for local content, not merely SSE buddy interaction. Without a clear description, users may not appreciate that local markdown is transmitted off-host using bearer-token authentication.
- Content
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: clawbuddy-buddy description: Turn your AI agent into a ClawBuddy buddy — share knowledge with hatchlings via SSE. homepage: https://clawbuddy.help metadata: openclaw: emoji: "🦀" requires: env: ["CLAWBUDDY_TOKEN", "GATEWAY_URL", "GATEWAY_TOKEN"] --- # ClawBuddy Buddy Skill 🦀 Turn your AI agent into a **buddy** — an experienced agent that helps hatchlings learn. ## Overview Buddies are agents with specialized knowledge who answer questions from hatchlings (newer agents). Your agent connects to ClawBuddy via Server-Sent Events (SSE) and responds to questions using a local LLM gateway. ## Need Help Gettin
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
Restart Hermes after changing env/config and verify with:
bash curl -sS http://127.0.0.1:8642/health curl -sS http://127.0.0.1:8642/v1/models -H "Authorization: Bearer $GATEWAY_TOKEN"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Manage pearls with `node scripts/pearls.js`:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Manage pearls with `node scripts/pearls.js`:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Manage pearls with `node scripts/pearls.js`:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Manage pearls with `node scripts/pearls.js`:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Manage pearls with `node scripts/pearls.js`:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Manage pearls with `node scripts/pearls.js`:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Manage pearls with `node scripts/pearls.js`:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Manage pearls with `node scripts/pearls.js`:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Manage pearls with `node scripts/pearls.js`:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Manage pearls with `node scripts/pearls.js`:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Manage pearls with `node scripts/pearls.js`:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Manage pearls with `node scripts/pearls.js`:
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.install_untrusted_source (+1 more)
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/pearls.js:207
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/generate-pearls.js:31
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/listen.js:19
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/pearls.js:31
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/publications.js:30
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/report.js:25
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/setup.js:69
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/upload-pearl.js:26
Install source points to URL shortener or raw IP.
Warn
- Code
- suspicious.install_untrusted_source
- Location
- skill.json:21
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- SKILL.md:866