技能商店客户端

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:03 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent skill-store installer, but its installer can write, overwrite, or delete local files based on untrusted server and archive data.

Review this skill carefully before installing. It should only be used with a trusted local skill-shop service and trusted packages, and ideally only after the installer is fixed to validate filenames, archive members, and destination paths, avoid unsafe deletion, and verify package integrity.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: main.py:77

Finding

Archive Path Traversal During Skill Package Extraction

Content

View full analysis

`. 5. `extractall()` processes the malicious member without an application-level containment check. 6. The entry is written outside the intended temporary extraction directory using the privileges of the installer process. ### Impact Assessment A successful exploit can overwrite or create arbitrary files accessible to the current process. If the installer runs as root—as suggested by the hard-c ...[truncated 327 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: main.py:107

Finding

Server-Controlled Skill Name Enables Arbitrary Directory Deletion and File Placement

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: main.py:47

Finding

Untrusted Download Filename Allows Arbitrary File Write

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises network access, shell execution, and file-writing behavior through its documented functionality, but it does not declare any explicit tool scope or permission boundaries. For a skill that can download and install packages, this lack of restriction is dangerous because it increases the chance of unintended command execution or filesystem modification beyond what a user expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill exposes an install command that downloads and installs software on the local system, but the description and usage text do not clearly warn the user that running it will modify the machine. This is dangerous because users may invoke the command expecting a harmless lookup action, while it actually performs network retrieval and local installation of potentially untrusted code.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrase "安装技能" is broad enough to match ordinary user requests about installing skills, which can cause this skill to activate in situations beyond a narrowly intended storefront context. Because this skill can install/download skill packages, overbroad activation increases the chance of unintended invocation and unsafe package installation workflows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a client for querying and one-click downloading/installing skill packages. While downloading and unpacking archives is expected, spawning the external unrar executable introduces process-execution capability that is not necessary to justify from the stated purpose and is materially more powerful than ordinary archive handling.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · main.py (reported line 84)May include surrounding context.

python

# 处理rar格式（需要unrar命令）
        elif str(file_path).lower().endswith('.rar'):
            import subprocess
            subprocess.run(['unrar', 'x', str(file_path), str(temp_extract_dir)], check=True)
        else:
            print(f"❌ 不支持的压缩格式: {file_path}", file=sys.stderr)
            return False

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installer deletes an existing skill directory with shutil.rmtree() immediately after detecting it exists, without prompting the user or verifying the path is safe. Because the directory name is derived from remote skill metadata, a malicious or malformed skill name could cause destructive overwrites or unexpected data loss within the skills workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This installer downloads an untrusted archive and copies its extracted contents into /root/.openclaw/workspace/skills/ without validating member paths, file types, or intended filesystem effects. Combined with zipfile.extractall() and tarfile.extractall(), this enables path traversal or placement of attacker-controlled files, and in this skill-store context it is especially dangerous because installed skills are likely to be executed later.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill metadata primarily targets Chinese-language use, but also hard-codes an English trigger ("search skill") without explaining supported languages or offering a user-facing language choice. This can create an implicit language policy inconsistency rather than a clearly documented locale decision.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.