Security audit

Skill Pilot

Security checks across malware telemetry and agentic risk

Overview

SkillPilot is a coherent skill scheduler, but it needs review because it can run other installed skills with inherited environment variables and persist sensitive request history locally.

Review before installing if you keep secrets in environment variables or may route sensitive prompts through this skill. Use it only with trusted installed skills, consider running it in an isolated environment with minimal API keys, and periodically inspect or clear its ~/.openclaw skill-pilot history and config files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: f'exa.web_search_exa(query: "{safe_query}", numResults: 5)' ] result = subprocess.run( cmd, capture_output=True, text=True,
Confidence: 91% confidence
Finding: result = subprocess.run( cmd, capture_output=True, text=True, timeout=30, env=os.environ.copy()

subprocess module call

Medium

Category: Dangerous Code Execution
Content: # 执行脚本，继承环境变量 env = os.environ.copy() result = subprocess.run( cmd, capture_output=True, text=True,
Confidence: 97% confidence
Finding: result = subprocess.run( cmd, capture_output=True, text=True, timeout=timeout,

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The scheduler is not merely routing requests; it directly launches arbitrary local scripts and external executables. In a skill ecosystem where skills may be user-installed or third-party, this expands the attack surface to arbitrary code execution and unintended side effects under the agent's privileges.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The privacy claim is misleading: although `_hash_query()` hashes the query, `record()` also stores the raw `query` field in the JSONL history. This creates a real privacy leak because sensitive user prompts, secrets, or personal data may be persisted to disk despite documentation suggesting they are protected.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: A default trigger that activates on nearly any input lacking a few keywords is risky because it can cause unintended routing and execution of downstream tools without clear user intent. In this skill's context, that matters more because the documented behavior includes network probing, history recording, and execution of other skills, so accidental activation can lead to unnecessary external actions and data exposure surfaces.

Vague Triggers

Medium

Confidence: 77% confidence
Finding: Using ambiguous keywords like 'full' or '对比' to enter an expansive parallel-execution mode creates a prompt-routing vulnerability: ordinary user text may unintentionally trigger the highest-impact path. Because full mode runs all tools in a category and then updates defaults, accidental activation can amplify network activity, execute more child skills than expected, and poison learned preferences/history.

Vague Triggers

High

Confidence: 95% confidence
Finding: The guide defines the default trigger as essentially any input that does not contain a small set of special keywords, making activation overly broad and likely to capture unrelated user requests. In a skill-routing context, such catch-all behavior can cause unintended tool execution, surprising data handling, and accidental interception of tasks that should have gone elsewhere.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: Stating that no configuration is needed and demonstrating ordinary natural-language queries encourages users to treat the skill as a universal handler for arbitrary requests. That broad positioning increases the chance of over-invocation and unintended routing, especially when paired with automatic tool selection and learning behavior.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document says the system records performance, continuously optimizes, and updates defaults, but does not clearly warn users that configuration files and execution history will be modified. Undisclosed persistence and self-modification are risky because they can alter future behavior, retain sensitive query metadata, and reduce user control over tool selection.

Natural-Language Policy Violations

Medium

Confidence: 70% confidence
Finding: The router infers language characteristics from user content and silently changes capability requirements without user opt-in. In a skill-routing engine, that can cause unintended data handling, region-specific routing, or selection of different downstream skills based on linguistic profiling, which is a privacy and policy risk even if not a classic exploit primitive.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The engine forwards the full inherited environment to arbitrary skill scripts without user warning or minimization. In this context, installed skills are effectively untrusted plugins, so they can read API keys, tokens, and other secrets from environment variables and exfiltrate them.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: User queries are sent to an external CLI-backed search path without any notice, consent, or data classification guardrails. This can leak sensitive prompts, internal URLs, or proprietary information to a network service unexpectedly.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This path transmits user queries to Exa via mcporter without any user-facing warning. In an agent skill that may process arbitrary user content, silent forwarding of prompts or sensitive text to a remote provider creates a real privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code forwards user-provided URLs to an external fetch tool without warning or policy checks. Beyond privacy concerns, this may enable access attempts to internal-only resources if the fetch tool follows arbitrary URLs.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The execution log records raw user queries, URLs, errors, tried skills, and arbitrary context to files under the user's home directory without any consent, warning, minimization, or access-control hardening. In a routing/learning skill, this history can accumulate highly sensitive operational and personal data, increasing the blast radius of local compromise or unintended sharing.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The code persists tool performance telemetry, including usage counts, timing data, quality scores, and last-used timestamps, to a user-scoped config file without any notice, consent flow, or retention controls. While this is not direct code execution or privilege escalation, it creates a privacy and observability risk because behavioral metadata is stored silently and could reveal user activity patterns or tool usage history to other local processes or users with access to the home directory.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The code writes generated observability reports to a fixed path under the user's home directory without any explicit consent, disclosure, or data-minimization controls. Because the report can include environment details, proxy status, learned patterns, and skill performance metadata, it may persist potentially sensitive operational information on disk where other local processes or users could later access it.

Env Variable Harvesting

High

Category: Data Exfiltration
Content: **3. 环境变量传递** (`scripts/engine.py`) ```python # 检查点：subprocess.run 的 env 参数 env = os.environ.copy() # 继承环境变量 result = subprocess.run(cmd, env=env, ...) ```
Confidence: 79% confidence
Finding: os.environ.copy()

VirusTotal

48/48 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.