T09 · Insecure Skill Coding Practices
Error
- Location
scripts/apply_policy.sh:4- Finding
Arbitrary Python Code Execution Through Unquoted Heredoc Expansion
- Content
View full analysis
- Remediation
View remediation
Security audit
Discord Dual Bot Orchestrator
Security checks for vulnerabilities and agentic risk
Overview
The skill appears aimed at managing two Discord bots, but it edits live bot configuration and backs up likely sensitive config files with weak scoping and unsafe script practices.
Review before installing. Use only with a dedicated least-privileged bot account, do not run the scripts with untrusted environment variables, store backups outside repositories or shared/synced folders with private permissions, and verify the generated OpenClaw configs before restarting gateways.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/backup_state.sh:4- Finding
Potential Exposure of Sensitive Configuration Through Insecure Backup Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill claims security-relevant behaviors such as channel allowlists, mention-gating, one-way bridging, and backup/rollback, but the provided content only references external scripts without implementing or proving those protections. This mismatch is dangerous because operators may rely on controls that do not actually exist, leading to misconfigured bots, unintended message exposure, or unsafe recovery assumptions.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh EOF echo "Initialized: $BASE_DIR/{bot-a,bot-b}" echo "Next: copy .env.template -> .env and replace placeholders."
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to run local scripts and write
.envfiles, which implies file read/write capabilities, but it declares no tool scope or permission boundaries. In an agent environment, missing explicit tool restrictions can cause overbroad access assumptions, making accidental modification of arbitrary files or unsafe handling of sensitive configuration more likely.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script performs file-copy operations on user state files from the home directory into a backup directory, which affects user data and may duplicate potentially sensitive contents. There is no confirmation prompt, explanatory comment, or user-facing warning describing that these files will be copied.
- Content
Static analysis
No suspicious patterns detected.