Osori

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:10 PM UTC
• Version: 1.6.1

Overview

The skill mostly matches its stated project-management purpose, but a verified registry-repair bug can rewrite the local project registry even when high-risk repair is supposed to be blocked.

Review before installing. Back up ~/.openclaw/osori.json first, use narrow scan paths, expect gh-based GitHub lookups and optional Entire commands to use external CLIs, and avoid relying on the doctor high-risk gate until corrupt-registry recovery is fixed so blocked repairs cannot still rewrite the active registry.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/doctor.sh:366

Finding

High-Risk Registry Reinitialization Bypasses the Approval Gate

Content

View full analysis

Tuple[Dict[str, Any], List[str], str | None]: p = Path(path).expanduser() notes = ["registry corrupted: initialized empty v2"] backup_path = None if p.exists(): broken = f"{p}.broken-{_timestamp_suffix()}" shutil.copy2(p, broken) notes.append(f"corrupted backup saved: {broken}") reg = _empty_registry() backup_path = save_registry(str(p), reg, make_backup=True) ``` `scripts/registry_lib.py:260-266`: ```python try: with p.open("r", encoding="utf-8") as f: payload = json.load(f) except Exception: reg, notes, backup = _handle_corruption(str(p)) return LoadResult(registry=reg, migrated=True, migration_notes=notes, backup_path=backup) ``` ### Technical Analysis The doctor command identifies registry reinitialization after JSON corruption as a high-risk action. When `doctor --fix` is invoked without `--yes`, the action is added to `actions_blocked`, which should prevent it from being performed. However, after evaluating the risk gate, the command unconditionally invokes `load_registry()`. If the registry contains malformed JSON, `load_registry()` catches the parsing exception and calls `_handle_corruption()`. That function copies the corrupt file to a backup and then overwrites the active ...[truncated 2456 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (20)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · tests/run_tests.sh (reported line 804)May include surrounding context.

sh

setup_test
mkdir -p "$TEST_TMP/evil-project"
git -C "$TEST_TMP/evil-project" init -q 2>/dev/null
EVIL_NAME='test"; rm -rf /; echo "'
bash "$PROJECT_ROOT/scripts/add-project.sh" "$TEST_TMP/evil-project" --name "$EVIL_NAME" 2>&1 || true
valid=$(python3 - << PYEOF
import json

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · tests/run_tests.sh (reported line 804)May include surrounding context.

sh

setup_test
mkdir -p "$TEST_TMP/evil-project"
git -C "$TEST_TMP/evil-project" init -q 2>/dev/null
EVIL_NAME='test"; rm -rf /; echo "'
bash "$PROJECT_ROOT/scripts/add-project.sh" "$TEST_TMP/evil-project" --name "$EVIL_NAME" 2>&1 || true
valid=$(python3 - << PYEOF
import json

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises and instructs use of shell, file, environment, and network-capable operations, but it does not declare any explicit tool scope such as permissions or allowed-tools. That makes the effective authority ambiguous and increases the chance an agent will invoke powerful capabilities without user-visible constraints, especially because commands perform registry writes, filesystem scans, git operations, and GitHub/Telegram-related lookups.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description itself advertises trigger phrases such as 'work on X' and 'find project X' without meaningful scope constraints, encouraging broad matching by orchestrators or users. Because this skill can search the local filesystem, read git state, and modify a registry, ambiguous activation increases the risk of unintentional data exposure or execution of higher-privilege operations in the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The auto-trigger rules include broad natural-language phrases like 'work on X' and 'list projects' that can easily appear in ordinary conversation. In an agent environment, this can cause unintended activation of project-switching, scanning, context loading, or status commands, which may expose local paths, repository metadata, or trigger side effects without the user explicitly invoking the skill.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/doctor.sh (reported line 8)May include surrounding context.

sh

# Default (no flags):  analyze + preview (no changes applied)
# --fix:               analyze + preview + apply (prompts for high-risk)
# --dry-run:           analyze + preview only (explicit, never applies)
# --yes:               auto-approve low/medium risk (high still requires explicit --fix)
# --json:              machine-readable JSON output

set -euo pipefail

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/doctor.sh (reported line 496)May include surrounding context.

sh

# Default (no flags):  analyze + preview (no changes applied)
# --fix:               analyze + preview + apply (prompts for high-risk)
# --dry-run:           analyze + preview only (explicit, never applies)
# --yes:               auto-approve low/medium risk (high still requires explicit --fix)
# --json:              machine-readable JSON output

set -euo pipefail

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/doctor.sh (reported line 47)May include surrounding context.

sh

(default)   Analyze + preview plan (no changes applied)
  --fix       Analyze + preview + apply fixes
  --dry-run   Analyze + preview only (never applies, explicit)
  --yes       Auto-approve low/medium risk fixes (high risk still blocked without --fix)
  --json      Machine-readable JSON report

Risk Levels:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/find_handler.py (reported line 74)May include surrounding context.

python

# 2) Spotlight (macOS)
if shutil.which('mdfind'):
    r = subprocess.run(['mdfind', f'kMDItemFSName == "{resolved_name}"'], capture_output=True, text=True)
    lines = [line for line in r.stdout.strip().split('\n') if line.strip()]
    if lines:
        if root_key:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/find_handler.py (reported line 91)May include surrounding context.

python

for sp in search_paths:
    if not os.path.exists(sp):
        continue
    r = subprocess.run(
        ['find', sp, '-maxdepth', '4', '-type', 'd', '-name', f'*{name}*'],
        capture_output=True, text=True, timeout=10,
    )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/status_handler.py (reported line 25)May include surrounding context.

python

continue

    try:
        result = subprocess.run(
            ['git', '-C', path, 'status', '--short'],
            capture_output=True, text=True, timeout=3,
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/github_cache.py (reported line 193)May include surrounding context.

python

def run(cmd, timeout=8):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return p.returncode, p.stdout.strip(), p.stderr.strip()
    except Exception as e:
        return 1, "", str(e)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/switch_handler.py (reported line 24)May include surrounding context.

python

def run(cmd, timeout=8):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return p.returncode, p.stdout.strip(), p.stderr.strip()
    except Exception as e:
        return 1, "", str(e)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The switch handler makes outbound GitHub-related queries during a local project-switch workflow, which expands the skill's trust boundary beyond its stated local registry/context-loader purpose. This can leak repository metadata or usage patterns to external services and creates unexpected network side effects in a command that users may reasonably assume is offline/local-only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The markdown lists /add, /remove, /scan, and /doctor [--fix] as commands that change the local JSON registry, and later notes backups/migration behavior, but it does not clearly warn users at the command descriptions that these actions write to disk and may alter registry state. For markdown files, user-facing warnings are expected when behavior can affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

Lines L21-L29 describe using /scan to register all git projects under a path, but the markdown does not include any caution about scanning broad directories or the resulting bulk changes to the tool's project inventory. Because this behavior affects user workspace data organization, a brief user-facing warning would improve safety and clarity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file contains user-facing natural-language content exclusively in Korean, and there is no indication that the language is optional or chosen by the user. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script reads several environment variables, including OSORI_SCRIPT_DIR and OSORI_REG, to control import paths and registry loading. There is no warning or explanatory comment indicating that runtime behavior depends on environment-provided paths and registry locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code invokes external system commands via subprocess.run for both Spotlight lookup and find-based fallback discovery. While the operations are non-destructive, there is no confirmation prompt, comment, or docstring disclosing that the skill will execute local shell commands as part of its behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The gh_count helper executes the external gh CLI and writes cache data to ~/.openclaw/osori-cache.json, which are safety-relevant operations under the code-file warning criteria. While the docstring explains the technical purpose, there is no user-facing prompt, logging, or explicit warning that repository data will be fetched via subprocess and persisted locally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.