T03 · Remote Payload Retrieval and Execution
Error
- Location
USAGE.md:12- Finding
Unverified Remote Installer Executed Directly by a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Crewai Team
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly does what it claims, but it ships executable code with a bundled API credential and unsafe install guidance that users should review before installing.
Install only after the hardcoded API key is removed and rotated, the code is changed to require an explicit user-provided secret, and the install instructions avoid curl-to-shell with pinned or locked dependencies. Assume product ideas sent through this skill may leave your machine for DashScope-compatible model calls and possible web search.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
run_openclaw.py:13- Finding
Apparent Live DashScope API Credential Hardcoded Across Executable Source Files
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unbounded and Unverified Third-Party Dependency Resolution
- Content
View full analysis
=0.1.0 crewai-tools>=0.0.1 langchain-community>=0.0.1 langchain-openai>=0.0.1 duckduckgo-search>=4.0.0 ``` The dependencies are installed directly from the configured Python package index: ```bash cd ~/.openclaw/workspace/crewai_team python3.10 -m pip install -r requirements.txt ``` The alternate installation workflow similarly resolves the same unpinned requirements: ```bash cd ~/.openclaw/workspace/crewai_team uv pip install -r requirements.txt ``` `SKILL.md` also recommends direct installation without version constraints: ```bash python3.10 -m pip install crewai crewai-tools ``` ### Technical Analysis Every requirement uses a lower-bound constraint rather than an exact reviewed version. As a result, an installation performed after this audit may resolve to versions that did not exist and were not reviewed at audit time. No lock file or package hashes constrain the artifacts selected by pip or uv. Python package installation can execute package build logic, and imported dependencies run with the permissions of the Skill process. Consequently, dependency integrity is part of the Skill's effective code-execution boundary. No evidence was found that the listed package names are currently typosquatted or intentionally malicious. The confirmed issue is the unsafe dependency-resolution policy: future, compromised, or incompatible releases can be selected automatically without review. ### Attack Path 1. A dependency publisher account or package-distribution channel is compromised, or a future release contains malicious installation or runtime behavior. 2. The attacker publishes a version satisfying the broad `>=` constraint. 3. A user installs the Skill dependencies at a later date. 4. pip ...[truncated 972 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (105)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
The instructions direct users to create a local .env file containing an API key, but provide no warning about protecting that file from source control, backups, or other local disclosure paths. In agent or workspace-based environments, secrets stored in project directories are especially prone to accidental inclusion in logs, archives, or repository commits.
- Content
md echo 'export DASHSCOPE_API_KEY="sk-your-actual-key-here"' >> ~/.zshrc source ~/.zshrc # 方式 C：创建 .env 文件 cd ~/.openclaw/workspace/crewai_team cp .env.example .env # 编辑 .env 文件，填入 API Key
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
This line continues the recommendation to store secrets in a .env file without surrounding operational security guidance. The risk is not the existence of a .env file itself, but encouraging secret placement in the workspace without controls, which can lead to inadvertent credential exposure.
- Content
方式 C：创建 .env 文件
cd ~/.openclaw/workspace/crewai_team cp .env.example .env
编辑 .env 文件，填入 API Key
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
Telling the user to edit a .env file and place the API key there promotes plaintext secret storage in the project directory. In the context of an agent skill workspace, this is somewhat more dangerous because tools, tests, or other agents may read, log, or package workspace contents.
- Content
方式 C：创建 .env 文件
cd ~/.openclaw/workspace/crewai_team cp .env.example .env
编辑 .env 文件，填入 API Key
text ### 步骤 3：测试
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The
| shpattern is dangerous because it converts unverified network content directly into code execution in a single step, removing opportunities for inspection or integrity validation. In a setup guide for an agent skill, this is more dangerous because users are likely to copy-paste commands verbatim, increasing the chance of blind execution.- Content
bash # 安装 uv curl -LsSf https://astral.sh/uv/install.sh | sh # 安装依赖 cd ~/.openclaw/workspace/crewai_team
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 复制环境变量配置 cp .env.example .env # 编辑 .env 文件，填入你的 DashScope API Key # 从 https://dashscope.console.aliyun.com/ 获取
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
复制环境变量配置
cp .env.example .env
编辑 .env 文件，填入你的 DashScope API Key
从 https://dashscope.console.aliyun.com/ 获取
text
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script hardcodes an API key directly into source code and sets it at runtime, which is a real secret-exposure vulnerability. Anyone with access to the repository, logs, screenshots, or redistributed package can recover and abuse the credential for unauthorized API use, billing fraud, or access to associated services; in a PRD-generation runner, embedding secrets is not justified by the stated functionality and increases risk.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script hard-codes an API key directly into source and exports it into the process environment. This is dangerous because anyone with repository, artifact, log, or screenshot access can recover the credential and use it to make unauthorized API calls, incur cost, or access associated model resources; in the skill context, PRD generation does not require embedding a secret in code, so the exposure is unjustified and more clearly risky.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code silently uses a hard-coded API credential without informing the user, obscuring the fact that external authenticated requests will be made under a bundled identity. This increases the chance of unauthorized billing, hidden data transfer to a third-party endpoint, and accidental reuse of a compromised credential; the skill's narrow purpose makes this more suspicious because there is no clear reason to conceal credentialed outbound access.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script embeds a live API key directly in source code and exports it into the runtime environment, which creates an immediate secret-exposure risk through source control, logs, screenshots, or reuse by anyone with file access. In this skill context, PRD generation does not require shipping a credential inside the codebase, so the hardcoded secret is unjustified and materially increases the chance of unauthorized API use and billing abuse.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script embeds a live-looking API key directly in source code and then configures it at runtime. Hardcoded secrets are dangerous because they are easily leaked through source control, logs, package distribution, or reuse by anyone who obtains the file, enabling unauthorized API access and possible billing or data exposure.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code silently injects a hardcoded API credential into environment variables, causing downstream libraries and agents to use the secret without any user awareness. In a multi-agent skill context, this increases risk because the secret may be consumed, logged, or indirectly exposed by other components, while also masking that the script is making authenticated external calls.
- Content
Static analysis
No suspicious patterns detected.