coding-framework

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:47 AM UTC
• Version: 13.0.0

Overview

This coding workflow skill is broad and partly coherent, but it needs Review because it force-loads unreviewed external skill files, includes unsafe command execution paths, and persists task/log data beyond a narrow coding task.

Install only after review and hardening. Before use, remove or replace absolute-path external skill loading with packaged pinned dependencies, disable permissive external-agent modes, fix shell=True gate execution, restrict file reads to the project, redact or disable command logging, and make memory/archives/auto-commit behavior explicit and opt-in.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (7)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:71

Finding

Mandatory Loading of Unreviewed External Skill Instructions

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: scripts/instinct-manager.py:147

Finding

Persistent Behavioral-Rule Injection with Global Promotion

Content

View full analysis

None: """Record a new instinct observation.""" ensure_dirs() project_id = detect_project() if not args.global_mode else None project_dir = get_project_dir(project_id) os.makedirs(project_dir, exist_ok=True) trigger_hash = hashlib.sha256(args.trigger.encode()).hexdigest()[:8] instinct_id = f"instinct-{trigger_hash}" instinct_path = os.path.join(project_dir, f"{instinct_id}.json") if os.path.exists(instinct_path): instinct = load_instinct(instinct_path) instinct["observations"] += 1 if args.confirm: instinct["confirmations"] += 1 if args.contradict: instinct["contradictions"] += 1 else: instinct = { "id": instinct_id, "trigger": args.trigger, "action": args.action, "domain": args.domain, "scope": "global" if args.global_mode else "project", "project_id": project_id, "observations": 1, "confirmations": 1 if args.confirm else 0, "contradictions": 1 if args.contradict else 0, "confidence": 0.3, "created_at": now_iso(), "last_used": now_iso(), "tags": args.tags.split(",") if args.tags else [], } instinct["confidence"] = calculate_confidence( instinct["observations"], instinct["confirmations"], instinct["contradictions"] ) save_instinct(instinct_path, instinct) ``` ```python global_path = os.path.join(GLOBAL_DIR, instinct_id) instinct["scope"] = "global" instinct["promoted_at"] = now_iso() save_instinct(global_path, instinct) ``` ### Technical Analysis The command accepts arbitrary `--trigger` and `- ...[truncated 1774 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/loop-controller.py:808

Finding

Arbitrary Command Execution Through Unsanitized Gate File Arguments

Content

View full analysis

dict: """Run one gate check.""" full_cmd = command if files: if name in ("pytest", "unittest", "npm-test"): pass else: full_cmd = f"{command} {' '.join(str(f) for f in files)}" try: result = subprocess.run( full_cmd, shell=True, capture_output=True, text=True, timeout=timeout, encoding="utf-8", errors="replace" ) ``` ```python def cmd_gates(args: argparse.Namespace) -> None: files = [f.strip() for f in args.files.split(",") if f.strip()] if args.files else [] compile_commands = [] for f in files: if f.endswith(".py"): compile_commands.append(("compile-py", f"python -m py_compile {f}")) elif f.endswith((".js", ".jsx")): compile_commands.append(("compile-js", f"node --check {f}")) elif f.endswith((".ts", ".tsx")): compile_commands.append(("compile-ts", f"npx tsc --noEmit {f}")) elif f.endswith(".sh"): compile_commands.append(("compile-sh", f"bash -n {f}")) ``` ```python p_gates = subparsers.add_parser("gates", help="Run three-layer gate checks") p_gates.add_argument("--files", help="Comma-separated file list") ``` ### Technical Analysis The `--files` argument is parsed directly into strings without path normalization, repository-containment checks, existence validation, or rejection of shell metacharacters. Those values are interpolated into command strings and passed to `subprocess.run` with `shell=True`. An attacker only needs to ensure the supplied value ends in a recognized extension after including a shell expression. The shell then interprets separators, substitutions, redirec ...[truncated 1197 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: hooks/post-exec-log.sh:12

Finding

Persistent Audit Logging of Unredacted Command-Line Secrets

Content

View full analysis

/dev/null; then COMMAND=$(echo "$EVENT_DATA" | jq -r '.command // "unknown"') EXIT_CODE=$(echo "$EVENT_DATA" | jq -r '.exitCode // -1') DURATION=$(echo "$EVENT_DATA" | jq -r '.duration // 0') STDERR=$(echo "$EVENT_DATA" | jq -r '.stderr // ""' | head -c 200) else COMMAND=$(echo "$EVENT_DATA" | grep -o '"command"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed 's/.*: *"//;s/"$//') fi WORKSPACE="${OPENCLAW_WORKSPACE:-.}" LOG_DIR="$WORKSPACE/memory" LOG_FILE="$LOG_DIR/hook-audit.log" mkdir -p "$LOG_DIR" 2>/dev/null || true echo "[$TIMESTAMP] [PostExec] [$DECISION] [$STATUS] cmd=$COMMAND exit=$EXIT_CODE duration=${DURATION}ms" \ >> "$LOG_FILE" 2>/dev/null || true ``` ### Technical Analysis The hook records the complete command string from every execution event. It performs no redaction of passwords, API keys, bearer tokens, signed URLs, database connection strings, private-key paths, or sensitive values supplied after flags such as `--password`, `--token`, or `-H Authorization:`. The log is persistent under the workspace's `memory` directory. The script does not explicitly set restrictive permissions, impose retention limits, prevent version-control inclusion, or delete old records. Although standard security practice discourages secrets on command lines, automation frameworks must assume that such commands will occur and must avoid creating an additional long-lived copy. ### Attack Path 1. A user or agent runs a command containing a credential in an argument or URL. 2. The PostExec event provides the original command to the hook. 3. The hook appends the complete command to `memory/hook-audit.log`. 4. The secret remains available to other processes or users that can read the workspace, and may be ...[truncated 403 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: hooks/pre-exec-check.sh:34

Finding

Documented Security Pattern Database Is Not Enforced by the Pre-Execution Hook

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/loop-controller.py:206

Finding

Automatic Git Snapshot Commits Stage the Entire Repository

Content

View full analysis

dict: """Create a Git tag.""" if not is_git_repo(): return {"success": False, "message": "Not in a Git repository"} try: # Stage all changes first subprocess.run(["git", "add", "-A"], capture_output=True, timeout=10) # Create commit subprocess.run( ["git", "commit", "-m", f"chore: {message}", "--allow-empty"], capture_output=True, timeout=10 ) # Create tag result = subprocess.run( ["git", "tag", "-a", tag_name, "-m", message], capture_output=True, text=True, timeout=10 ) ``` The operation is enabled through the `--auto-commit` option and is run during iteration snapshots. ### Technical Analysis `git add -A` stages all tracked modifications, deletions, and untracked files visible to Git, rather than only files created or changed by the current iteration. The subsequent commit records that full staged state before creating a tag. This scope is broader than necessary for iteration rollback. It can include unrelated user work, local configuration, generated files, or credentials that are not covered by `.gitignore`. Once committed, sensitive content remains in repository history even if the working-tree file is later removed. The subprocess calls use argument arrays and are not command-injection sinks; the issue is excessive scope and insufficient approval around a destructive, persistent repository operation. ### Attack Path 1. A repository contains unrelated modified files or an unignored file holding sensitive information. 2. An iteration is initialized with `--auto-commit`. 3. Snapshot creation executes `git add -A`. 4. All visibl ...[truncated 565 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/review-orchestrator.py:202

Finding

Review Orchestrator Can Read and Delegate Arbitrary Local Files

Content

View full analysis

dict: """Generate a task prompt for an agent.""" agent_def = load_agent_definition(agent_name) file_contents = {} for f in files: p = Path(f) if p.exists() and p.is_file(): try: with open(p, "r", encoding="utf-8", errors="ignore") as fh: file_contents[str(f)] = fh.read() except (OSError, IOError): file_contents[str(f)] = "[Unable to read file]" elif p.is_dir(): file_contents[str(f)] = "[Directory; recursive reading required]" ``` ```python def validate_files(files: list) -> tuple: """Validate file paths.""" valid = [] errors = [] for f in files: p = Path(f) if p.exists(): valid.append(f) else: errors.append(f"File does not exist: {f}") return valid, errors ``` ### Technical Analysis Path validation checks only whether the supplied path exists. It does not resolve paths against a repository root, reject absolute paths, prevent parent-directory traversal, reject symlinks, filter sensitive filenames, or limit file size. For each accepted regular file, the orchestrator reads the complete contents and embeds them in a generated task for reviewer agents. Consequently, any readable local file can be moved into agent context if its path is supplied. The project does not itself transmit these files over a network. The exposure occurs through local context ingestion and delegation to reviewer sessions. ### Attack Path 1. An attacker influences the `--files` arguments passed to the review orchestrator. 2. The attacker supplies an absolute path, parent-relative path, or ...[truncated 776 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (119)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md

---
name: coding-framework
description: "Orchestrate the complete coding workflow with multiple development modes (TDD/incremental/spec-dr..."
tags: [coding, backend, multi-agent, iterative, template-based]

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 580)May include surrounding context.

md

# 完整三层验证
python D:\Users\yindb2\AppData\Roaming\mx\openclaw-home\yindb2\.openclaw\workspace\skills\coding-framework\scripts\layered_validate.py src/main.py

# 跳过测试（仅语法+语义�?python D:\Users\yindb2\AppData\Roaming\mx\openclaw-home\yindb2\.openclaw\workspace\skills\coding-framework\scripts\layered_validate.py src/main.py --skip-tests

# JSON 输出
python D:\Users\yindb2\AppData\Roaming\mx\openclaw-home\yindb2\.openclaw\workspace\skills\coding-framework\scripts\layered_validate.py src/main.py --format json

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/external-agents.md (reported line 78)May include surrounding context.

gh pr create --head fix/issue-78 --title "fix: ..." --body "..."

5. 清理

git worktree remove /tmp/issue-78

text

### Worktree 冲突处理（v10.1 新增）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/security-patterns-detail.md (reported line 23)May include surrounding context.

md

### 系统安全（1-8）

1. **危险命令** (critical) — rm -rf /, format, diskpart, mkfs
2. **注册表操作** (critical) — reg add/delete, Set-ItemProperty HKLM
3. **账户管理** (critical) — net user, useradd, Add-LocalGroupMember
4. **服务管理** (high) — sc delete/config, systemctl, net start/stop

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/workflow-examples.md (reported line 111)May include surrounding context.

md

### 系统安全（1-8）

1. **危险命令** (critical) — rm -rf /, format, diskpart, mkfs
2. **注册表操作** (critical) — reg add/delete, Set-ItemProperty HKLM
3. **账户管理** (critical) — net user, useradd, Add-LocalGroupMember
4. **服务管理** (high) — sc delete/config, systemctl, net start/stop

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/security-patterns-detail.md (reported line 23)May include surrounding context.

md

### 系统安全（1-8）

1. **危险命令** (critical) — rm -rf /, format, diskpart, mkfs
2. **注册表操作** (critical) — reg add/delete, Set-ItemProperty HKLM
3. **账户管理** (critical) — net user, useradd, Add-LocalGroupMember
4. **服务管理** (high) — sc delete/config, systemctl, net start/stop

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/security-patterns-detail.md (reported line 23)May include surrounding context.

md

### 系统安全（1-8）

1. **危险命令** (critical) — rm -rf /, format, diskpart, mkfs
2. **注册表操作** (critical) — reg add/delete, Set-ItemProperty HKLM
3. **账户管理** (critical) — net user, useradd, Add-LocalGroupMember
4. **服务管理** (high) — sc delete/config, systemctl, net start/stop

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/security-patterns-detail.md (reported line 37)May include surrounding context.

md

9. **敏感数据传输** (high) — scp .ssh/.env, curl -d password
10. **代码执行风险** (high) — eval(拼接), exec(拼接), subprocess shell=True
11. **敏感信息泄露** (high) — 硬编码 API key, Bearer token
12. **路径遍历** (high) — ../../, %2e%2e, /etc/passwd

### 注入攻击（13-15）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

rm src/main.py is a direct destructive command that deletes a source file, and in a skill/reference document it may be copied and executed without scrutiny. In this context the command is more dangerous because it is presented as a recommended corrective step, which can lead to accidental data loss, disruption of a working tree, or deletion of uncommitted work.

Content

Scanner excerpt · references/tdd-anti-patterns.md (reported line 40)May include surrounding context.

md

# }

# 纠正：删除代码，先写测试
rm src/main.py
# 先写 tests/test_main.py
python scripts/tdd_runner.py red tests/test_main.py  # 确认红灯
# 再写 src/main.py

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/workflow-examples.md (reported line 111)May include surrounding context.

场景：用户执行危险命令

text

用户执行：rm -rf /tmp/build

coding-framework 处理流程：
1. PreExec hook 触发

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · rules/security-patterns.md (reported line 192)May include surrounding context.

severity: high pattern: ((password|passwd|pwd|secret|private_key|access_key)\s*=\s*['"][^'"]{4,}|(username|user|uid)\s*=\s*['"]admin['"]) message: "检测到硬编码凭证：凭证应存储在安全位置" suggestion: "使用环境变量、.env 文件或密钥管理服务" cwe: CWE-798

text

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation says only deletions affecting more than 50 files require manual approval, but the configured rule blocks matching bulk-delete patterns unconditionally. This policy/implementation mismatch can cause operators to misunderstand what is permitted, leading to unsafe workarounds, rule bypass attempts, or unexpected denial of legitimate maintenance operations.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

The script concatenates command fragments and file names into a single string and executes it with shell=True in the gate runner. In the context of an agent skill that may process externally influenced filenames or arguments, this substantially increases danger because a crafted filename like '; curl ... | sh' could execute arbitrary shell commands with the agent's privileges.

Content

Scanner excerpt · scripts/loop-controller.py (reported line 818)May include surrounding context.

python

full_cmd = f"{command} {' '.join(str(f) for f in files)}"

    try:
        result = subprocess.run(
            full_cmd, shell=True, capture_output=True, text=True,
            timeout=timeout, encoding="utf-8", errors="replace"
        )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/review-orchestrator.py (reported line 77)May include surrounding context.

python

AGENT_SELECTION_RULES = {
    "security-auditor": {
        "patterns": [r"password", r"secret", r"token", r"auth", r"login", r"encrypt", r"credential"],
        "extensions": [".env", ".pem", ".key", ".cert"],
        "keywords": ["security", "安全", "漏洞", "audit"],
    },
    "test-engineer": {

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructions are written almost entirely in Chinese and present the operating guidance in that language without offering the user a language choice or documenting a justified locale restriction. This creates a natural-language policy issue because it effectively imposes a language/locale on users by default.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger keywords are extremely broad and overlap with normal software conversation, making it easy for unrelated prompts to activate expansive workflow behavior automatically. In this skill, that matters because activation can cascade into reading other files, invoking tools, and applying rigid process rules without clear user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill hard-codes absolute host paths under the user's home directories and instructs the agent to read them directly, including archived and workspace skill stores. That expands access beyond the current project boundary and can expose unrelated local files, private prompts, credentials, or sensitive operational data if the agent follows these instructions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The design-gate triggers are broad enough that many ordinary implementation requests would force additional workflow steps and file reads. While not directly exfiltrating data, overbroad activation increases the chance of unnecessary tool use and unauthorized access to external skill documents in this skill's context.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The archival instructions direct the agent to persist execution logs, learnings, changes, and conversation-derived task history into local files. That creates broad, durable retention of potentially sensitive user requests, codebase details, secrets present in logs, and operational context beyond what is necessary to complete the task.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The hard rule in L0249-L0267 forbids file paths in plan/task/spec documents. Yet the Plan Mode format in L1148-L1166 defines '相关文件' with path lists and task checklist items like 创建数据模型 models/user.py, which is an active contradiction rather than a mere omission.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Lines L0249-L0253 state a hard rule that task specs, plans, and delegated briefs must not reference specific file paths or line numbers, only behavior. However, the examples and templates in L1148-L1166 include concrete paths such as models/user.py, api/auth.py, and pages/Login.tsx, directly contradicting that stated rule for plan content.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1349)May include surrounding context.

md

| 优先�?| 方式 | 适用场景 | 示例 |
|--------|------|----------|------|
| 1 | **Failing Test** | 有测试框架的项目 | `pytest tests/test_bug.py -v` / `npm test -- --grep "bug"` |
| 2 | **Curl/HTTP Script** | API/服务�?bug | `curl -X POST localhost:3000/api/bug-endpoint -d '{}'` |
| 3 | **CLI Invocation + Fixture** | CLI 工具 bug | `python cli.py process --input fixture.json` |
| 4 | **Throwaway Harness** | 无测试框架的函数/模块 | 临时 Python/JS 脚本调用目标函数 |
| 5 | **HITL Bash Script** | 需要人工验证的 UI/视觉 bug | `bash verify.sh`（最后手段，需人工确认�?|

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The progress-ledger and recovery workflow is designed to preserve task and session context across compaction and later continuation, including commit ranges and prior work state. Durable cross-session memory like this can retain sensitive project details and user instructions longer than expected, increasing exposure if the workspace is shared or later compromised.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The CoreCoder submode's instruction to record all fixes into memory logs creates unnecessary persistence of task-derived information. Depending on implementation, those logs may capture sensitive code changes, user requests, or debugging context that should not be broadly retained.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

In L1873-L1875, the CoreCoder safety rules say 'do not delete files, only move to bak'. Elsewhere, the workflow instructs deleting originals such as removing task files after archiving (L0411) and deleting debug-log lines with sed -i (L1373-L1377), which conflicts with that purported safety rule.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.