ClawHub
Back to skill

Security audit

Risk Guard

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a local OpenClaw diagnostic helper, but it automatically deletes workspace .lock and .tmp files even though it presents deletion as requiring confirmation.

Review before installing. Use --dry-run for diagnostics unless you explicitly want cleanup, and do not run the script in a workspace where older .lock or .tmp files might still be important. The skill should be changed so cleanup is a separate explicit action with a listed confirmation step.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/diagnose.py:148
Finding

Automatic Deletion of Workspace Files Without Confirmation or Sufficient Validation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented purpose says the skill only diagnoses and requires confirmation before irreversible actions, yet the content explicitly allows automatic cleanup of .lock and .tmp files and does not show an enforceable confirmation mechanism. This mismatch is dangerous because operators may trust the skill as read-only while it performs deletions or other operational side effects without a guaranteed approval gate.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The header comments explicitly claim lock-file deletion requires confirmation, but check_lock_files deletes eligible files automatically unless --dry-run is set. This mismatch is dangerous because operators may trust the documented safety guarantees and run the script expecting non-destructive behavior, leading to unintended file removal.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/diagnose.py (reported line 76)May include surrounding context.

python
try:
        encoded = base64.b64encode(cmd.encode("utf-16-le")).decode()
        full_cmd = f'powershell.exe -NoProfile -NonInteractive -EncodedCommand {encoded}'
        result = subprocess.run(
            full_cmd, shell=True, capture_output=True,
            text=True, timeout=timeout,
            encoding="utf-8", errors="replace"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/diagnose.py (reported line 90)May include surrounding context.

python
def run_cmd(cmd, timeout=10):
    """执行普通命令"""
    try:
        result = subprocess.run(
            cmd, shell=True, capture_output=True,
            text=True, timeout=timeout,
            encoding="utf-8", errors="replace"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises operational behavior that involves shell execution, file access, environment access, and likely network checks, but it declares no explicit tool scope or permission boundaries. In an agent environment, missing least-privilege declarations can cause the skill to run with broader capabilities than intended, increasing the blast radius if the skill is triggered unexpectedly or later expanded.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrase 诊断 is broad enough to match ordinary user requests, which can cause the skill to activate outside its intended context. When a skill has shell and file-handling behavior, ambiguous activation increases the chance of unplanned execution of diagnostic commands or cleanup logic.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger section describes activation in loose terms without clear boundaries, making it easier for normal conversational requests to invoke the skill. In a skill that can inspect processes, ports, paths, and potentially remove files, ambiguous activation raises the risk of unintended execution and user surprise.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file’s banner, CLI description, status messages, and operator instructions are written exclusively in Chinese, indicating the skill is designed to communicate in a single language by default. The file does not offer any language selection, fallback, or justification that this is a region-specific tool, which makes it a natural-language locale policy issue under the stated rules.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnose.py (reported line 76)May include surrounding context.

python
try:
        encoded = base64.b64encode(cmd.encode("utf-16-le")).decode()
        full_cmd = f'powershell.exe -NoProfile -NonInteractive -EncodedCommand {encoded}'
        result = subprocess.run(
            full_cmd, shell=True, capture_output=True,
            text=True, timeout=timeout,
            encoding="utf-8", errors="replace"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnose.py (reported line 90)May include surrounding context.

python
def run_cmd(cmd, timeout=10):
    """执行普通命令"""
    try:
        result = subprocess.run(
            cmd, shell=True, capture_output=True,
            text=True, timeout=timeout,
            encoding="utf-8", errors="replace"

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is presented as a diagnostic and risk-confirmation tool, yet it automatically deletes .lock and .tmp files older than 10 minutes during normal execution. That creates an integrity risk because a user invoking self-check may trigger destructive changes without explicit consent, and those files may still be operationally significant despite age-based heuristics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description is written to address the user as "先生" and presents the skill behavior entirely in Chinese without indicating that language selection is optional. This can be a natural-language policy issue because it implicitly forces a specific language/locale and form of address without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The description consistently instructs interactions using the specific honorific/register "先生掌控" and frames confirmations as addressed to "先生". This imposes a language style on users without any opt-in or documented justification, which can violate language/locale neutrality expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The confirmation prompt addresses the user as "先生" and requires the interaction in that register. Because no opt-in or user preference mechanism is described, this is a natural-language policy concern related to forced language/style.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest lists activation phrases as "自检、诊断、风险确认" without clarifying context, exclusions, or when the skill should not activate. Terms like "自检" and especially "诊断" can occur in ordinary troubleshooting conversations, which may cause unintended invocation.

Content

No source excerpt is available for this finding.