T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:82- Finding
Unpinned Remote Shell Script Download and Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill Publish Adapter Real
Security checks for vulnerabilities and agentic risk
Overview
This skill should be reviewed carefully because it asks users and CI jobs to run an unverified GitHub script while the packaged metadata does not match the described tool.
Do not install or use this as-is in a real project or CI release job unless the publisher bundles the reviewed adapter script or pins it to an immutable commit with checksum or signature verification. Before publishing, review exactly what files will be packaged and ensure no secrets or credentials are included or exposed to the job.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:294- Finding
Mutable Remote Payload Execution in CI/CD Publishing Workflow
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md if [ ! -f "SKILL.md" ]; then
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The package metadata identifies this artifact as a 'skill-validator' that validates OpenClaw skills, while the surrounding skill context describes a 'publish-adapter' intended to bypass known ClawHub publishing problems. This identity mismatch is dangerous because it can mislead reviewers, automated tooling, and users about the skill’s actual purpose, and in this context the 'bypass' framing increases suspicion of deceptive packaging or repurposing to evade scrutiny.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises automatic repair actions such as fixing script permissions, creating missing files, and correcting formats, but it does not clearly describe the exact local changes that will be made or require confirmation first. In practice, this can lead users to run file-modifying actions that alter permissions or repository state unexpectedly, which is risky in development environments.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill repeatedly instructs users to publish skills to ClawHub and GitHub, and even describes creating tarballs and GitHub repositories, but it never clearly warns that these actions can upload project contents, metadata, and possibly embedded secrets to third-party services. In a publishing adapter context, remote transmission is expected, but the lack of explicit consent and scope disclosure makes accidental data exposure more likely.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
常见问题
- "jq命令未找到"
bash sudo apt-get install jq # Ubuntu/Debian brew install jq # macOS
- "jq命令未找到"
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description is written only in Chinese ("技能检验工具：验证OpenClaw技能的结构和完整性"), which imposes a specific language choice in user-facing metadata. There is no indication elsewhere in this file that users can choose a language or that the skill is intentionally limited to a Chinese-speaking context.
- Content