ClawHub
Back to skill

Security audit

Dynamic Tool

Security checks for vulnerabilities and agentic risk

Overview

The skill does not run commands itself, but it can steer agents toward powerful shell and file tools too broadly, including shell access for unrelated messages.

Review this before installing if your OpenClaw setup treats recommended tools as authorization or tool exposure. Do not use its output as the sole gate for shell, file write, or Feishu mutation tools; add an independent allowlist and require explicit user intent for exec/write-style actions.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
index.js:8
Finding

Unconditional Recommendation of the Privileged Shell Execution Tool

Content
View full analysis

Vulnerability Details

File Location: index.js:8-10
Vulnerability Type: Least-privilege violation through unconditional shell-tool exposure
Risk Level: Medium

Vulnerable Code

js
function selectToolNamesFromText(userText, maxTools = 8) {
    const t = (userText || "").toLowerCase();
    const selected = new Set();
    selected.add("exec");
    if (/天气|温度|华氏|摄氏|weather|wttr|temperature|temp\s*[\(\（]/.test(t) || /^\s*\d+\s*[度°]\s*/.test(t)) selected.add("exec");

The exec tool is added to every recommendation before the user's intent is evaluated. Therefore, messages that do not require command execution—including document, search, file, and unmatched requests—still receive a recommendation for a general-purpose shell tool.

The subsequent weather-specific condition does not restrict this capability because exec has already been added. Although this skill only returns recommendations and does not itself run commands, a gateway that uses the returned list to expose or authorize tools would unnecessarily grant the agent access to command execution.

Technical Analysis

This behavior violates least privilege. A dynamic tool policy should expose privileged tools only when the current task has a validated need for them. General-purpose shell execution has a substantially broader security boundary than the intent categories this skill handles: it may permit process execution, filesystem access, outbound network requests, and interaction with credentials available to the hosting process.

The risk is amplified for unmatched input. Because exec remains the only recommendation, getHint() can return the following shell-oriented instruction from index.js:28:

js
if (tools.includes("exec") && tools.length <= 2) return "Weather or shell; use exec with wttr.in for weather.";

This may encourage shell use even when the input did not match weather or another command-dependent intent. Exploita ...[truncated 1469 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the unconditional selected.add("exec").
  2. Add exec only after a narrowly defined intent requiring command execution has been positively identified.
  3. For weather requests, prefer a constrained weather or HTTP API tool over a general-purpose shell.
  4. Return an empty or non-privileged recommendation set for unmatched input.
  5. Change the hint logic so it distinguishes a confirmed weather intent from the mere presence of exec.
  6. Treat recommendations as advisory rather than authorization. Enforce an independent server-side allowlist and per-tool policy at the gateway.
  7. If shell execution is unavoidable, run it in a sandbox with minimal filesystem permissions, a restricted environment, network controls, command allowlisting, timeouts, and resource limits.
  8. Add tests confirming that unrelated, empty, document-only, and search-only messages do not receive exec.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill’s stated purpose is narrow tool recommendation based on user intent, but the documented behavior expands tool exposure beyond the declared scope and includes powerful tools like exec, read, and write. In a policy-routing skill, broad or inaccurate recommendations can cause downstream agents to invoke higher-risk tools unnecessarily, increasing the chance of command execution, file access, or policy bypass from ordinary user input.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The function always adds the exec tool even when the user message contains no matching weather or shell intent, making a powerful execution capability the default recommendation. In this skill context, that is especially dangerous because the component is supposed to reduce tool exposure and avoid tool loops, but instead it systematically biases the agent toward command execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill manifest promises a narrow intent-based policy for weather, document, and search, but the implementation expands recommendations to higher-risk capabilities like file read/write, drive, chat, wiki, and bitable tools. In a tool-selection component, this mismatch can silently broaden the agent’s accessible action surface and cause downstream policy logic to expose tools the user or operator did not expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The intent mapping is defined with specific Chinese and English keywords, but the document does not state that language handling is optional, configurable, or limited to a justified bilingual deployment context. This can be a natural-language policy concern because it implicitly hard-codes supported languages/locales without user opt-in or an explicit language choice mechanism.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.