Crewai Team

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:31 AM UTC
• Version: 1.0.0

Overview

This skill mostly does what it claims, but it ships executable code with a bundled API credential and unsafe install guidance that users should review before installing.

Install only after the hardcoded API key is removed and rotated, the code is changed to require an explicit user-provided secret, and the install instructions avoid curl-to-shell with pinned or locked dependencies. Assume product ideas sent through this skill may leave your machine for DashScope-compatible model calls and possible web search.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: USAGE.md:12
• Finding: Unverified Remote Installer Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `USAGE.md:12-20` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash ### Method 2: Use uv (recommended, faster) # Install uv curl -LsSf https://astral.sh/uv/install.sh | sh # Install dependencies cd ~/.openclaw/workspace/crewai_team uv pip install -r requirements.txt ``` ### Technical Analysis The installation instructions download a script from an external URL and immediately pipe it into `sh`. The content is neither pinned to a reviewed version nor validated with a cryptographic checksum or signature. The effective code executed by this command can change after the Skill has been reviewed. Following redirects through `curl -L` also means that the final script may originate from a different endpoint. Although `astral.sh` is associated with the uv project, the command still relies on the continued integrity of the remote service, DNS resolution, TLS trust chain, hosting infrastructure, and installer distribution process. This execution method is not necessary for the declared PRD-generation functionality. `USAGE.md:5-9` already supplies a Python and pip installation path, and `SKILL.md` only declares Python 3.10 as a required binary. The remote shell execution therefore exceeds the minimum behavior necessary to install or run the Skill. ### Attack Path 1. An attacker compromises the installer endpoint, its hosting infrastructure, a redirect target, or another component in the remote delivery chain. 2. The attacker modifies the response returned by `https://astral.sh/uv/install.sh`. 3. A user follows the recommended installation instructions. 4. `curl` downloads the attacker-controlled response and passes it directly to `sh`. 5. The shell executes the payload without giving the user an opportunity to inspect or verify it. 6. The payload operates with all permissions held by the user running the command. ### Impact Assessment Success ...[truncated 715 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation recommendation. 2. Prefer installation through a trusted operating-system package manager or a reviewed Python installation workflow. 3. If a standalone uv artifact is required: - Pin an exact uv release. - Download the artifact to disk rather than piping it into a shell. - Obtain the expected checksum or signature through an independently authenticated channel. - Verify the checksum or signature before execution. - Allow the user to inspect the downloaded content. 4. Run installation with an unprivileged account and avoid `sudo` unless a specific operation demonstrably requires it. 5. Document the existing pip-based installation path as the default. 6. Pin and verify the Python dependencies installed after uv is available. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: run_openclaw.py:13
• Finding: Apparent Live DashScope API Credential Hardcoded Across Executable Source Files<![CDATA[ ## Vulnerability Details **File Locations**: - `run_discussion.py:14-15` - `run_hierarchical.py:14-15` - `run_interactive.py:14-15` - `run_minimal.py:14-15` - `run_mobile.py:14-15` - `run_openclaw.py:13-14` - `run_with_log.py:15-16` - `team_config_discussion.py:12-16` - `team_config_hierarchical.py:17-21` - `team_config_minimal.py:12-16` - `team_config_mobile.py:12-16` - `team_config_multi_model.py:13-17` - `team_config_simple.py:13-16` **Vulnerability Type**: Hardcoded secret and plaintext credential exposure **Risk Level**: High ### Vulnerable Code The runner files directly assign the same credential-shaped value to the process environment: ```python os.environ["OPENAI_API_KEY"] = "sk-sp-[REDACTED EXPOSED CREDENTIAL]" os.environ["OPENAI_API_BASE"] = "https://coding.dashscope.aliyuncs.com/v1" ``` The team configuration files also embed and reuse the credential directly: ```python DASHSCOPE_API_KEY = "sk-sp-[REDACTED EXPOSED CREDENTIAL]" DASHSCOPE_BASE_URL = "https://coding.dashscope.aliyuncs.com/v1" os.environ["OPENAI_API_KEY"] = DASHSCOPE_API_KEY os.environ["OPENAI_API_BASE"] = DASHSCOPE_BASE_URL ``` The credential value is intentionally redacted in this report to avoid further disclosure. The audited files contain the complete plaintext value. ### Technical Analysis A provider credential matching the form of a live API key is committed directly to multiple executable Python files. The scripts automatically use this value when contacting the DashScope-compatible endpoint. Embedding a secret in source code makes it available to every person or system that can read the project, including source archives, backups, build logs, code-indexing systems, and repository mirrors. Removing the current lines does not remove the value from earlier repository history. Assigning the key to `os.environ` additionally makes it available to other libraries in the same process and potentially to child processes. The hardcoded assignment can also overwrite a ...[truncated 2090 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke the exposed credential immediately; source-code removal alone is insufficient. 2. Generate a replacement key with the narrowest provider permissions, model access, budget, and rate limits required. 3. Remove the credential from every listed file. 4. Purge the credential from repository history, release archives, build artifacts, caches, and mirrors where feasible. 5. Load the key only from a secret manager or an explicitly supplied environment variable: ```python import os api_key = os.environ.get("DASHSCOPE_API_KEY") if not api_key: raise RuntimeError("DASHSCOPE_API_KEY must be configured") ``` 6. Do not copy the value into another generic environment variable unless the library strictly requires it. Pass the key directly to the API client where possible. 7. Never overwrite an existing user credential silently. 8. Add secret-scanning checks to local development and CI pipelines. 9. Add a properly ignored `.env.example` containing placeholders only, and ensure `.env` is excluded from version control. 10. Review provider access logs and billing records for unauthorized use of the exposed key. ]]>

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1
• Finding: Unbounded and Unverified Third-Party Dependency Resolution<![CDATA[ ## Vulnerability Details **File Locations**: - `requirements.txt:1-5` - `USAGE.md:5-9` - `USAGE.md:18-20` - `SKILL.md:62` **Vulnerability Type**: Insecure dependency and supply-chain configuration **Risk Level**: Medium ### Vulnerable Code ```text crewai>=0.1.0 crewai-tools>=0.0.1 langchain-community>=0.0.1 langchain-openai>=0.0.1 duckduckgo-search>=4.0.0 ``` The dependencies are installed directly from the configured Python package index: ```bash cd ~/.openclaw/workspace/crewai_team python3.10 -m pip install -r requirements.txt ``` The alternate installation workflow similarly resolves the same unpinned requirements: ```bash cd ~/.openclaw/workspace/crewai_team uv pip install -r requirements.txt ``` `SKILL.md` also recommends direct installation without version constraints: ```bash python3.10 -m pip install crewai crewai-tools ``` ### Technical Analysis Every requirement uses a lower-bound constraint rather than an exact reviewed version. As a result, an installation performed after this audit may resolve to versions that did not exist and were not reviewed at audit time. No lock file or package hashes constrain the artifacts selected by pip or uv. Python package installation can execute package build logic, and imported dependencies run with the permissions of the Skill process. Consequently, dependency integrity is part of the Skill's effective code-execution boundary. No evidence was found that the listed package names are currently typosquatted or intentionally malicious. The confirmed issue is the unsafe dependency-resolution policy: future, compromised, or incompatible releases can be selected automatically without review. ### Attack Path 1. A dependency publisher account or package-distribution channel is compromised, or a future release contains malicious installation or runtime behavior. 2. The attacker publishes a version satisfying the broad `>=` constraint. 3. A user installs the Skill dependencies at a later date. 4. pip ...[truncated 972 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a reviewed lock file containing exact versions for all direct and transitive dependencies. 2. Generate and record cryptographic hashes for approved distribution artifacts. 3. Enforce hash validation during installation, such as through pip's `--require-hashes` workflow. 4. Replace broad lower-bound constraints in deployment requirements with exact reviewed versions. 5. Ensure all installation documentation uses the same locked dependency source. 6. Remove the unversioned `pip install crewai crewai-tools` instruction from `SKILL.md`. 7. Perform dependency updates through a controlled process that includes: - Release-note and ownership review. - Vulnerability scanning. - Package-origin verification. - Automated tests. - Manual approval for security-sensitive changes. 8. Install dependencies in an isolated virtual environment under an unprivileged account. 9. Configure the package installer to use only explicitly trusted indexes and disable unneeded extra indexes. 10. Periodically regenerate locks so that security patches are adopted deliberately rather than through unrestricted resolution. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (105)

Credential Access

High

• Category: Privilege Escalation

Content

echo 'export DASHSCOPE_API_KEY="sk-your-actual-key-here"' >> ~/.zshrc
source ~/.zshrc

# 方式 C：创建 .env 文件
cd ~/.openclaw/workspace/crewai_team
cp .env.example .env
# 编辑 .env 文件，填入 API Key

• Confidence: 84% confidence
• Finding: The instructions direct users to create a local .env file containing an API key, but provide no warning about protecting that file from source control, backups, or other local disclosure paths. In agent or workspace-based environments, secrets stored in project directories are especially prone to accidental inclusion in logs, archives, or repository commits.

Credential Access

High

• Category: Privilege Escalation

Content

# 方式 C：创建 .env 文件
cd ~/.openclaw/workspace/crewai_team
cp .env.example .env
# 编辑 .env 文件，填入 API Key
```

• Confidence: 84% confidence
• Finding: This line continues the recommendation to store secrets in a .env file without surrounding operational security guidance. The risk is not the existence of a .env file itself, but encouraging secret placement in the workspace without controls, which can lead to inadvertent credential exposure.

Credential Access

High

• Category: Privilege Escalation

Content

# 方式 C：创建 .env 文件
cd ~/.openclaw/workspace/crewai_team
cp .env.example .env
# 编辑 .env 文件，填入 API Key
```

### 步骤 3：测试

• Confidence: 84% confidence
• Finding: Telling the user to edit a .env file and place the API key there promotes plaintext secret storage in the project directory. In the context of an agent skill workspace, this is somewhat more dangerous because tools, tests, or other agents may read, log, or package workspace contents.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Sensitive API keys hardcoded alongside undeclared external LLM service configuration are true vulnerabilities because they can enable unauthorized service use and obscure outbound data flows. The skill context makes this more dangerous because PRD generation commonly involves confidential strategic and technical material.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 安装 uv
curl -LsSf https://astral.sh/uv/install.sh | sh

# 安装依赖
cd ~/.openclaw/workspace/crewai_team

• Confidence: 98% confidence
• Finding: The `| sh` pattern is dangerous because it converts unverified network content directly into code execution in a single step, removing opportunities for inspection or integrity validation. In a setup guide for an agent skill, this is more dangerous because users are likely to copy-paste commands verbatim, increasing the chance of blind execution.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# 复制环境变量配置
cp .env.example .env

# 编辑 .env 文件，填入你的 DashScope API Key
# 从 https://dashscope.console.aliyun.com/ 获取

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 复制环境变量配置
cp .env.example .env

# 编辑 .env 文件，填入你的 DashScope API Key
# 从 https://dashscope.console.aliyun.com/ 获取
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script hardcodes an API key directly into source code and sets it at runtime, which is a real secret-exposure vulnerability. Anyone with access to the repository, logs, screenshots, or redistributed package can recover and abuse the credential for unauthorized API use, billing fraud, or access to associated services; in a PRD-generation runner, embedding secrets is not justified by the stated functionality and increases risk.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script hard-codes an API key directly into source and exports it into the process environment. This is dangerous because anyone with repository, artifact, log, or screenshot access can recover the credential and use it to make unauthorized API calls, incur cost, or access associated model resources; in the skill context, PRD generation does not require embedding a secret in code, so the exposure is unjustified and more clearly risky.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The code silently uses a hard-coded API credential without informing the user, obscuring the fact that external authenticated requests will be made under a bundled identity. This increases the chance of unauthorized billing, hidden data transfer to a third-party endpoint, and accidental reuse of a compromised credential; the skill's narrow purpose makes this more suspicious because there is no clear reason to conceal credentialed outbound access.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script embeds a live API key directly in source code and exports it into the runtime environment, which creates an immediate secret-exposure risk through source control, logs, screenshots, or reuse by anyone with file access. In this skill context, PRD generation does not require shipping a credential inside the codebase, so the hardcoded secret is unjustified and materially increases the chance of unauthorized API use and billing abuse.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script embeds a live-looking API key directly in source code and then configures it at runtime. Hardcoded secrets are dangerous because they are easily leaked through source control, logs, package distribution, or reuse by anyone who obtains the file, enabling unauthorized API access and possible billing or data exposure.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The code silently injects a hardcoded API credential into environment variables, causing downstream libraries and agents to use the secret without any user awareness. In a multi-agent skill context, this increases risk because the secret may be consumed, logged, or indirectly exposed by other components, while also masking that the script is making authenticated external calls.

Static analysis

No suspicious patterns detected.