Auto Skill Scanner

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:43 AM UTC
• Version: 1.0.4

Overview

This skill is a disclosed security scanner, but it automatically creates persistent daily jobs and sends reports to all discovered channels after one trigger.

Review before installing. This skill may be useful for monitoring installed skills, but invoking it once can create ongoing daily OpenClaw cron jobs and send findings to every channel/recipient discovered in your OpenClaw session metadata. Only install it if you are comfortable with that persistence and broad report distribution, and be prepared to inspect and remove created cron jobs manually.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: scripts/scan_and_report.py:62

Finding

Automatic Installation of Persistent Daily Scheduled Tasks

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/scan_and_report.py:48

Finding

Global Session Metadata Read Exceeds the Scanner's Minimum Privileges

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/skill_audit.py:193

Finding

Unbounded File and Archive Processing Can Exhaust Host Resources

Content

View full analysis

Tuple[List[Dict], Dict]: """Scan the entire skill for security issues.""" self.issues = [] # Check if it's a .skill file (zip) or directory if self.skill_path.suffix == '.skill': with zipfile.ZipFile(self.skill_path, 'r') as zf: for name in zf.namelist(): if name.endswith(('.py', '.sh', '.js', '.ts', '.yaml', '.yml', '.json', '.md')): try: content = zf.read(name).decode('utf-8', errors='ignore') # Create a fake Path object for the zip file fake_path = Path(name) self.scan_file(fake_path, content) except Exception: pass elif self.skill_path.is_file(): # Scan a single file try: content = self.skill_path.read_text(encoding='utf-8', errors='ignore') self.scan_file(self.skill_path, content) except Exception: pass else: # Scan directory for filepath in self.skill_path.rglob('*'): if filepath.is_file() and not filepath.name.startswith('.'): try: content = filepath.read_text(encoding='utf-8', errors='ignore') self.scan_file(filepath, content) except Exception: pass return self.issues, self.get_summary() ``` ### Technical Analysis The scanner reads each selected archive entry or filesystem file completely into memory before applying multiple regular expressions. It imposes no limits on: - Individual uncompressed file size. - Total bytes processed. - Archive expansion ratio. - Number of archive entries. - Directory file count ...[truncated 1892 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented behavior includes discovering active messaging channels and creating persistent cron jobs, but these sensitive actions are not transparently and narrowly disclosed as privileged operations. A skill that silently enumerates recipients and establishes persistence can lead to unauthorized data disclosure and ongoing execution beyond the user's immediate intent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior includes discovering active messaging channels and creating persistent cron jobs, but these sensitive actions are not transparently and narrowly disclosed as privileged operations. A skill that silently enumerates recipients and establishes persistence can lead to unauthorized data disclosure and ongoing execution beyond the user's immediate intent.

Content

No source excerpt is available for this finding.

YARA rule 'python_webshell': Python webshell — exec/eval/os.popen on request input [webshells]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known webshell pattern (PHP, Python, JSP, or ASPX webshell).

Content

Scanner excerpt · references/security-checks.md (reported line 15)May include surrounding context.

md

ew

This skill scans OpenClaw skills for security vulnerabilities before installation. It performs static analysis on skill files and provides a risk assessment.

## Security Check Categories

### 🔴 CRITICAL - Block Installation

These issues will cause automatic rejection of skill installation:

| Check | Pattern | Description |
|-------|---------|-------------|
| exec/eval with user input | `exec(request.args...)` | Dynamic code execution with unsanitized input |
| Hardcoded credentials | `password = "..."` | Credentials will be exposed to all users |
| Environment exfiltration | `os.environ[key]` → `requests.post()` | Sends secrets to external servers |
| Shell injection | `subprocess(user_input)` | Command injection vulnerabilities |
| File exfiltration | `open(os.environ[...])` | Reads files based on env vars |

### 🟠 HIGH - Require Confirmation

These issues will prompt a warning but allow manual override:

| Check | Pattern | Description |
|-------|---------|------------

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/security-checks.md (reported line 30)May include surrounding context.

md

| Network without timeout | `curl ...` (no -m) | May hang indefinitely |
| os.system usage | `os.system(cmd)` | Shell command execution |
| Raw socket connections | `socket.connect()` | Unknown network destinations |
| Sensitive paths | `/etc/passwd`, `/proc/` | System file access |

### 🟡 MEDIUM - Caution

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill advertises capabilities that imply reading installed skills, creating scheduled tasks, and sending reports over channels, but it declares no explicit tool scope or permissions. In an agent environment, undocumented access to file, shell, and network surfaces weakens user consent and makes any later implementation of these behaviors harder to constrain or audit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest description is written in Chinese and presents Chinese trigger language alongside one English phrase, while the rest of the skill instructions consistently assume Chinese usage. This can be a language/locale policy issue because the skill does not offer an explicit language choice or explain that it is intentionally limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill says reports are sent to configured channels, but it does not clearly warn that it will automatically discover active channels and push data to all of them. Even if the report is only a scan summary, broadcasting findings about installed skills or detected issues can leak sensitive environment details to unintended recipients.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The first-use flow creates a recurring daily cron job after a single trigger, but the persistence aspect is not warned about strongly enough. Hidden or easy-to-miss persistence increases the risk of unwanted ongoing execution, repeated data access, and continued outbound reporting after the user no longer expects the skill to run.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script reads session configuration to enumerate active channels and recipients, which is broader access than needed to locally scan skills. This can expose communication metadata and enables the skill to target discovered destinations automatically, increasing the blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script alters scheduler state by creating cron jobs even though the declared behavior is scanning installed skills and reporting findings. This persistence mechanism can make the skill self-propagating in practice, repeatedly executing itself and expanding its runtime footprint without the user's informed consent.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/scan_and_report.py (reported line 74)May include surrounding context.

python

"""Set up cron jobs for daily scanning if they don't exist."""
    # Check if cron jobs already exist
    try:
        result = subprocess.run(['openclaw', 'cron', 'list'], 
                             capture_output=True, text=True, timeout=10)
        if 'auto skill scanner' in result.stdout.lower() or 'skill audit' in result.stdout.lower():
            print("Cron jobs already exist, skipping setup.")

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Provisioning outbound cron tasks through the OpenClaw CLI is a privileged capability not obviously required for a scanner. In context, this combines discovery of user channels with persistent scheduled execution, making the skill more dangerous than a normal reporting utility because it can establish recurring outbound behavior automatically.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 78% confidence

Finding

This subprocess call provisions new cron jobs using data auto-discovered from session state, causing persistent side effects beyond simple scanning. Although it does not use shell=True and is not a direct command-injection sink, it expands the skill's authority by creating scheduled outbound actions tied to channels and recipients without clear user approval.

Content

Scanner excerpt · scripts/scan_and_report.py (reported line 110)May include surrounding context.

python

'--timeout-seconds', '60'
            ]
            
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
            if result.returncode == 0:
                print(f"Created cron job for {channel_name}")
            else:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code emits user-facing report content primarily in Chinese, including headings, summaries, and remediation guidance. The file does not provide any opt-in, fallback, or explanation that the skill is intended only for Chinese-speaking users, which violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · scripts/skill_audit.py (reported line 126)May include surrounding context.

python

{
            "name": "Pickle deserialization",
            "pattern": r'pickle\.loads?|pickle\.load\s*\(',
            "description": "Pickle deserialization - can execute arbitrary code",
            "severity": MEDIUM
        },
        {

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes a monitoring tool that automatically scans installed skills daily and pushes reports to channels like Telegram or Feishu. This file only implements a command-line scanner that accepts a path argument, prints a local report, and exits, with no automation, installed-skill discovery, or notification delivery behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The top-level documentation says the script scans skills and sends a security report, implying direct delivery behavior. In this file, report generation ends with printing to stdout, while the only delivery-related action is indirect cron setup, so the documented intent does not match the implemented behavior here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest narrows scope to scanning already installed OpenClaw skills. The implementation accepts any filesystem path, including a single file, any directory tree, or a .skill zip archive, which is broader than the stated installed-skill monitoring scope.

Content

No source excerpt is available for this finding.