T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:20- Finding
Shell Command and Argument Injection Through Unvalidated, Unquoted Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
add-agent
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent with its agent-creation purpose, but it gives new agents broad inherited access and edits core configuration with weak scoping and unsafe input handling.
Review carefully before installing. Use this only if you intentionally want new agents to inherit the main agent's auth profiles, skills, and user context, and to have broad session visibility. Prefer separate credentials per agent, validate agent IDs and Telegram IDs strictly, review the exact openclaw.json diff before applying it, and keep a known-good backup outside the automated restore path.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:52- Finding
New Agents Receive Main-Agent Credentials and Global Session Visibility
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:121- Finding
Configuration Injection Through Direct Interpolation into JSON
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:184- Finding
Wildcard-Based Backup Restoration Is Ambiguous and Unreliable
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill handles highly sensitive operations—copying auth-profiles.json and writing Telegram bot tokens into configuration—without an upfront warning or explicit consent boundary. This increases the chance that users unknowingly duplicate credentials, broaden access between agents, or persist secrets in insecure locations, potentially enabling account takeover or lateral movement between agents.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger condition is broad and example-driven, so a natural-language request that merely resembles the sample could cause the skill to run. In this skill, activation leads to filesystem writes, credential handling, config mutation, and agent provisioning, so accidental or manipulated invocation can result in unintended creation of agents and persistence of secrets.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
- Professional: Maintain high standards for all outputs
Rules
- Do not execute high-risk operations without confirmation
- Always notify the user before executing operations that require manual approval
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes functionality that copies auth profiles and skills between agents but does not warn users that credentials or trusted capabilities may be duplicated across isolation boundaries. In a multi-agent setup, this can unintentionally broaden access, cause credential reuse, and make compromise of one agent affect others.
- Content
Static analysis
No suspicious patterns detected.