ClawHub
Back to skill

Security audit

Model Tester

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OpenClaw model-testing helper that runs bounded test prompts and reads logs for routing metrics, with no evidence of hidden persistence, exfiltration, or destructive behavior.

Install only if you are comfortable with a skill that runs OpenClaw CLI commands, sends predefined benchmark prompts to selected agents/models, and temporarily reads OpenClaw logs to infer routing and token data. Use `--out` only with an output path you intend to write.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill invokes a Python script, tails OpenClaw logs, and optionally writes JSON output, which implies shell execution plus file read/write capability, yet the manifest does not declare any tool scope or permissions boundary. This creates an avoidable trust gap: callers and policy systems cannot easily determine or restrict what the skill is allowed to do, increasing the chance of over-privileged execution or misuse if the implementation changes or is repurposed.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def start_log_tail(log_q, stop_event):
    cmd = ["openclaw", "logs", "--follow", "--json", "--plain", "--interval", "500", "--limit", "50"]
    try:
        proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, bufsize=1)
    except Exception as e:
        log_q.put(f"[log-tail-error] {e}")
        return None
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
cmd += ["--agent", agent]

    start = time.monotonic()
    proc = subprocess.run(cmd, capture_output=True, text=True)
    runtime = round(time.monotonic() - start, 3)

    time.sleep(1.0)
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low
Confidence
90% confidence
Finding
This prompt explicitly requires output in Portuguese (pt-BR), which is a language/locale constraint expressed in natural language. The file does not indicate user choice or documented justification for enforcing this locale, so it may violate language/locale policy requirements.

Static analysis

No suspicious patterns detected.