T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:9- Finding
Unvalidated Shell Configuration Is Executed via source
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai Pa
Security checks for vulnerabilities and agentic risk
Overview
This PA coordination skill is mostly coherent, but it handles sensitive contacts and owner email/calendar actions with weak scoping and includes an unsafe local config-loading command.
Review before installing. Require explicit approval before any directory write, calendar creation, email send, broadcast, or auth setup; replace shell sourcing with strict config parsing; align the declared contact source; and remove real-looking example contact details.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Warning
- Location
ai-pa/pa-directory.example.json:3- Finding
Personal Contact Information Is Hardcoded in a Distributed Example File
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest says contact data comes from data/pa-directory.json, but the instructions switch the primary source to /opt/ocana/openclaw/workspace/PA_LIST.md and also permit creating/modifying the JSON file. This inconsistency undermines trust boundaries and provenance of sensitive contact data, increasing the chance of reading from or writing to an unreviewed source.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Claiming PA_LIST.md is the primary source while the manifest declares data/pa-directory.json creates a specification mismatch that can defeat user expectations, automated review, and permission scoping. In a skill that handles sensitive contact information, ambiguity about the authoritative source makes data tampering, stale data use, or hidden behavior more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to create or modify a PA directory containing names, phone numbers, owner identities, and emails without any warning, minimization guidance, or approval guardrails. Because this is sensitive contact data, silent creation or editing can lead to privacy exposure, accidental corruption, or insertion of untrusted contact records that affect later communications.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest frames this as a directory/contact coordination skill, but the body also authorizes sending email and creating calendar events on the owner's account. That mismatch expands the skill's effective privileges and can mislead operators or policy layers that rely on the manifest for risk assessment, causing unintended outbound actions or account modifications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The calendar command performs a state-changing action on the owner's account and may notify attendees, but the skill presents it as a routine step without an explicit user warning or confirmation. In practice this can create unauthorized meetings, leak scheduling details to third parties, or trigger external notifications based on an agent's mistaken interpretation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes the skill primarily as reading a local directory, but the body also authorizes state-changing actions such as editing contact data, sending email as the owner, and creating calendar events. This scope mismatch can mislead users or orchestrators about the skill's real capabilities, increasing the chance it is invoked in contexts where sensitive side effects were not expected.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The invocation guidance is very broad, covering nearly any 'cross-PA task,' which can cause over-triggering of a skill that has access to contacts and can initiate communications or calendar actions. In context, that broad routing surface makes downstream privileged actions more dangerous because ambiguous requests may be handled by this skill without clear boundaries.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill includes a command to send email from the owner's account, which is a privileged outbound action not tightly scoped to PA-directory lookup or peer-PA coordination. If invoked loosely under this broad skill, it could be abused to send unauthorized messages, exfiltrate information, or impersonate the owner to external recipients.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The directory update instructions write sensitive personal and business contact information to disk without nearby warnings, access-control guidance, or data-handling constraints. This increases the risk of accidental persistence of unnecessary PII, silent modification of trusted contact data, and downstream misuse by other tools reading the file.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation first frames the directory as a file the skill reads, but later instructs the agent to modify it. Even if the write is operationally useful, the inconsistent description obscures that the skill can alter sensitive contact records, which may lead to accidental data corruption or unauthorized updates.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This example data uses Israeli phone numbers with a +972 country code and presents them as the default format, but the file does not state that the skill is Israel-specific or otherwise limited to that locale. For a reusable example manifest, this can implicitly enforce a locale-specific convention without documented justification or user choice.
- Content
Static analysis
No suspicious patterns detected.