T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/run_batch.py:17- Finding
Batch execution permits confirmation and authorization bypass
- Content
View full analysis
- Remediation
View remediation
Security audit
Batch Compile
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its knowledge-base import purpose, but it needs review because it can start batch jobs without enforcing confirmer identity and sends a powerful Gitea token to a default HTTP endpoint.
Install only in a controlled OpenClaw/Gitea environment. Before use, require HTTPS, replace the site-admin token with a narrowly scoped service account, pin dependencies, and fix run_batch.py so the confirmer identity is mandatory and revalidated before any background job or knowledge-base write starts.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/gitea_api.py:28- Finding
Site-administrator Gitea token may be transmitted over plaintext HTTP
- Content
View full analysis
dict: return {"Authorization": f"token {ADMIN_TOKEN}", "Content-Type": "application/json"} def api(method: str, path: str, *, json_body: dict | None = None, params: dict | None = None, ok: tuple[int, ...] = (200, 201, 204)): if not GITEA_URL: raise GiteaError("GITEA_URL is not configured") resp = requests.request( method, f"{GITEA_URL}/api/v1{path}", headers=headers(), json=json_body, params=params, timeout=30, ) ``` ### Technical Analysis The example configuration uses an unencrypted `http://` endpoint. Setup copies this example directly into `.env` when no configuration exists. The API client then places `GITEA_ADMIN_TOKEN` in the `Authorization` header on requests to that endpoint. HTTP provides neither confidentiality nor authenticated transport. A network-positioned attacker can observe or alter requests and responses. Because the credential is identified as an administrator token and the API module supports administrative repository operations, compromise carries substantially greater impact than exposure of a narrowly scoped read token. The client does not reject cleartext URLs, warn the user, or require an explicit development-only exception. ### Attack Path 1. An operator r ...[truncated 1448 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Setup installs unpinned third-party dependencies without integrity verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (76)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The presence of a dedicated system configuration repository that stores user, team, chat binding, permission, event, and task state introduces a sensitive control plane far beyond simple batch import. If this capability is bundled into the same skill without explicit permission scoping, segregation, and data-handling limits, an error or abuse path could tamper with authorization, routing, or audit state for the wider system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The presence of a dedicated system configuration repository that stores user, team, chat binding, permission, event, and task state introduces a sensitive control plane far beyond simple batch import. If this capability is bundled into the same skill without explicit permission scoping, segregation, and data-handling limits, an error or abuse path could tamper with authorization, routing, or audit state for the wider system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The presence of a dedicated system configuration repository that stores user, team, chat binding, permission, event, and task state introduces a sensitive control plane far beyond simple batch import. If this capability is bundled into the same skill without explicit permission scoping, segregation, and data-handling limits, an error or abuse path could tamper with authorization, routing, or audit state for the wider system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The presence of a dedicated system configuration repository that stores user, team, chat binding, permission, event, and task state introduces a sensitive control plane far beyond simple batch import. If this capability is bundled into the same skill without explicit permission scoping, segregation, and data-handling limits, an error or abuse path could tamper with authorization, routing, or audit state for the wider system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The presence of a dedicated system configuration repository that stores user, team, chat binding, permission, event, and task state introduces a sensitive control plane far beyond simple batch import. If this capability is bundled into the same skill without explicit permission scoping, segregation, and data-handling limits, an error or abuse path could tamper with authorization, routing, or audit state for the wider system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The presence of a dedicated system configuration repository that stores user, team, chat binding, permission, event, and task state introduces a sensitive control plane far beyond simple batch import. If this capability is bundled into the same skill without explicit permission scoping, segregation, and data-handling limits, an error or abuse path could tamper with authorization, routing, or audit state for the wider system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The presence of a dedicated system configuration repository that stores user, team, chat binding, permission, event, and task state introduces a sensitive control plane far beyond simple batch import. If this capability is bundled into the same skill without explicit permission scoping, segregation, and data-handling limits, an error or abuse path could tamper with authorization, routing, or audit state for the wider system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The presence of a dedicated system configuration repository that stores user, team, chat binding, permission, event, and task state introduces a sensitive control plane far beyond simple batch import. If this capability is bundled into the same skill without explicit permission scoping, segregation, and data-handling limits, an error or abuse path could tamper with authorization, routing, or audit state for the wider system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The presence of a dedicated system configuration repository that stores user, team, chat binding, permission, event, and task state introduces a sensitive control plane far beyond simple batch import. If this capability is bundled into the same skill without explicit permission scoping, segregation, and data-handling limits, an error or abuse path could tamper with authorization, routing, or audit state for the wider system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The presence of a dedicated system configuration repository that stores user, team, chat binding, permission, event, and task state introduces a sensitive control plane far beyond simple batch import. If this capability is bundled into the same skill without explicit permission scoping, segregation, and data-handling limits, an error or abuse path could tamper with authorization, routing, or audit state for the wider system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The presence of a dedicated system configuration repository that stores user, team, chat binding, permission, event, and task state introduces a sensitive control plane far beyond simple batch import. If this capability is bundled into the same skill without explicit permission scoping, segregation, and data-handling limits, an error or abuse path could tamper with authorization, routing, or audit state for the wider system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The presence of a dedicated system configuration repository that stores user, team, chat binding, permission, event, and task state introduces a sensitive control plane far beyond simple batch import. If this capability is bundled into the same skill without explicit permission scoping, segregation, and data-handling limits, an error or abuse path could tamper with authorization, routing, or audit state for the wider system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The presence of a dedicated system configuration repository that stores user, team, chat binding, permission, event, and task state introduces a sensitive control plane far beyond simple batch import. If this capability is bundled into the same skill without explicit permission scoping, segregation, and data-handling limits, an error or abuse path could tamper with authorization, routing, or audit state for the wider system.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python except ImportError: return here = Path(__file__).resolve().parent for candidate in (here / ".env", here.parent / ".env"): if candidate.exists(): load_dotenv(candidate) return
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This module provisions and manages a persistent control-plane repository containing users, teams, chat bindings, permissions, and jobs, which materially exceeds the stated batch-compilation/import-tracking purpose of the skill. Hidden identity/team management state increases the blast radius of the skill and can enable unauthorized governance, cross-user linkage, or policy decisions in a repository the user may not expect to exist.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code exposes primitives for invite-code generation and record/state management that support team onboarding and chat identity workflows not justified by the declared batch-compile function. In context, these capabilities suggest latent identity and access-control features that could be misused to associate users/chats or expand access boundaries beyond what operators expect from an import tool.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh #!/usr/bin/env bash set -e python3 -m pip install -r requirements.txt if [ ! -f .env ]; then cp env-example.txt .env; fi echo "setup complete"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill describes extensive use of local file access, network access, environment-backed credentials, and write operations, but it does not declare an explicit tool scope or permission boundary. In an agent setting, that omission weakens reviewability and increases the risk of over-privileged execution, especially because the workflow touches repositories, uploaded archives, and knowledge-base writes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill title and operational instructions are written in Chinese and the prescribed user-facing prompts are also in Chinese, which implies the skill is intended to interact in a fixed language. There is no indication that the user can choose another language or that the Chinese-only behavior is required for a region-specific compliance reason.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The provided skill manifest context describes a capability to batch-compile material sources into knowledge bases with preview, confirmation, job tracking, archiving, codebase overview generation, and import reports. In contrast, the code-level description is only 'paper-kb v3 skill: batch_compile', which does not reflect that behavior and materially understates the skill's declared purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The error messages returned to users at L45, L48, and L51 are hard-coded in Chinese. For a general-purpose cancellation script, this imposes a specific language on users without opt-in or justification, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code defines multiple user-visible labels, titles, and summaries entirely in Chinese, such as button labels and card text, with no indication that the skill is China-specific or that users can choose another language. That creates a natural-language locale policy concern because the skill appears to enforce a specific language by default.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The write function updates catalog.json via g.put_file, which is a file-modifying operation, but there is no confirmation prompt, user-facing log/print, or explanatory comment/docstring disclosing that the skill will write repository contents. For code files, safety-relevant writes should have some visible disclosure unless clearly documented elsewhere, which is not present in this file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
regen_index rebuilds content and writes index.md through g.put_file, modifying repository files without any confirmation, user-visible message, or explanatory comment/docstring. This is a safety-relevant file write because it changes repository state and may overwrite prior index content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Several natural-language error messages are hard-coded in Chinese, and the file provides no indication that users can opt into another language or that the skill is intentionally restricted to a Chinese-speaking context. This can violate language/locale policy when the skill is used in broader environments.
- Content
Static analysis
No suspicious patterns detected.