T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lib/storage.py:22- Finding
Predictable Temporary File Enables Symlink-Based File Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
Chart
Security checks for vulnerabilities and agentic risk
Overview
The skill locally creates and stores charts as disclosed, with minor local file-safety and wording issues but no hidden network, credential, or destructive behavior.
Install only if you are comfortable with local chart files and chart metadata being stored under ~/.openclaw/workspace/memory/chart. The publisher should tighten the description around CSV/JSON support and harden local storage to avoid temporary-file and chart-ID collision issues.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/make_chart.py:36- Finding
Truncated UUID Allows Silent Chart and Metadata Overwrite
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description presents a full chart generation and visualization engine. However, the supplied code chunk only performs storage initialization: it creates chart-related directories and, if absent, writes a JSON file with metadata. This is a supporting setup utility rather than the described charting functionality. While local storage of outputs is consistent with the description at a high level, the primary behavior of this code is materially narrower than the declared purpose. Additionally, the code writes to the user's filesystem, which is not reflected in the declared permissions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a chart generation engine that creates charts from user data and helps decide appropriate chart types. The supplied code chunk only reads stored chart records via load_charts() and prints existing chart metadata and output locations. This is a materially narrower and different behavior than generating charts or transforming datasets into visualizations. While listing stored charts may be a supporting utility within a charting system, this specific code chunk does not implement the primary declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The code does match the core local chart-generation claim: it creates charts locally with matplotlib, writes image files to a local output directory, and stores metadata. However, the declared description includes additional capabilities not present in this code chunk, especially turning CSV or JSON into a chart and deciding which chart type fits a dataset best. The actual implementation only accepts preformatted CLI arguments for labels, values, and optional x-values, and supports only bar, line, pie, and scatter charts. There is no dataset parsing from CSV/JSON and no chart-selection logic. No suspicious undeclared security-relevant behavior appears, but the description overstates the implemented functionality enough to count as a mismatch.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares file read/write behavior through its documented storage locations and script workflows, but it does not define any explicit tool scope such as permissions or allowed-tools. Missing capability scoping increases the chance that an agent may invoke the skill with broader filesystem access than intended, which can enable unintended reads or writes in the user's workspace.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The activation language is broad enough to trigger on many ordinary requests involving visualization, comparison, or deciding how to present data. Overbroad routing can cause this skill to be selected in contexts where file-writing behavior or local processing was not expected, increasing the risk of unintended data handling and workspace modifications.
- Content
Static analysis
No suspicious patterns detected.