T09 · Insecure Skill Coding Practices
Error
- Location
scripts/clawra-selfie.sh:106- Finding
Gateway bearer token may be disclosed to an attacker-controlled endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Dream dance of Clawra
Security checks for vulnerabilities and agentic risk
Overview
This skill can send images as advertised, but its installer and permissions can persistently change an agent's persona and grant broader access than the feature needs.
Review before installing. Only use this if you are comfortable with it changing an OpenClaw agent's persistent identity/persona and sending media through messaging integrations. Prefer a version that installs only under the skill directory, backs up and previews any persona changes, narrows tool permissions, validates gateway URLs, pins dependencies, and asks for explicit confirmation before every outbound send.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T02 · Agent Memory Poisoning
Warning
- Location
bin/cli.js:296- Finding
Installer persistently overwrites agent identity and injects persona instructions
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:12- Finding
Skill declares runtime tools beyond the minimum privileges required
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:163- Finding
Setup instructions install an unpinned global dependency
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (46)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill can send content to arbitrary external targets and channels, which is materially broader than a simple image-selection helper. In context, outbound messaging to WhatsApp/Signal is the core risky action, and the description understates that this is effectively an exfiltration-capable messaging tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The skill can send content to arbitrary external targets and channels, which is materially broader than a simple image-selection helper. In context, outbound messaging to WhatsApp/Signal is the core risky action, and the description understates that this is effectively an exfiltration-capable messaging tool.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill can send content to arbitrary external targets and channels, which is materially broader than a simple image-selection helper. In context, outbound messaging to WhatsApp/Signal is the core risky action, and the description understates that this is effectively an exfiltration-capable messaging tool.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The allowed tools grant broad shell execution and package invocation via npm/npx/curl/openclaw, far exceeding the minimal needs of choosing an image and sending a message. In an agent skill, this creates a large attack surface for arbitrary command execution, package abuse, and unintended network actions if the skill is triggered or influenced by user input.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The header markets the package as a 'Selfie Skill Installer for OpenClaw', while execution skips skill installation and performs persona rewrites instead. Deceptive labeling is dangerous because it undermines informed consent and can trick users into accepting persistent behavioral modifications they did not intend to install.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The installer claims to install a selfie skill, but its implemented behavior centers on changing the selected agent workspace and setting up later modification of
IDENTITY.mdandSOUL.md. This is dangerous because it grants itself broad control over agent behavior and identity outside the declared purpose, creating a deceptive-install pattern that can alter how the agent acts system-wide.- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
writeIdentity()unconditionally overwrites the workspaceIDENTITY.mdwith a new persona unrelated to a narrow selfie-sending feature. Overwriting identity at the agent level can change all downstream interactions, misrepresent the agent to users, and create a persistent foothold for broader prompt manipulation.- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The main flow explicitly skips skill installation and instead proceeds to rewrite
IDENTITY.mdand inject content intoSOUL.md. This is a strong mismatch between advertised functionality and actual behavior, and it can silently persist behavioral changes to the agent while never installing the declared capability.- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger patterns are broad, generic regex-like phrases such as 'dance', 'dream', and 'what.*doing', which are likely to match normal conversation and activate the skill unexpectedly. In a skill that can send images to external messaging channels, unintended invocation can cause unauthorized actions, privacy leaks, or spam across integrated platforms.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
This script executes shell commands and performs outbound messaging/network actions, but the capability is not reflected in the declared permissions. Undeclared shell capability is dangerous because it expands what the skill can do at runtime beyond what reviewers or users may expect, increasing the risk of covert command execution and unauthorized data transmission.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrases are extremely broad and include common conversational language like 'dream,' 'where are you,' and 'how are you doing?'. Because the skill can send outbound messages and media, accidental invocation could cause unintended transmission to external recipients or initiate sensitive workflows without clear user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README advertises sending photos across many messaging platforms without warning about external transmission, recipient impact, logging, or consent. Because this skill is specifically designed to distribute persona-linked images, the omission makes accidental or unauthorized sharing more likely and hides important privacy and abuse implications from deployers.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instruction 'When users ask for pictures, use the clawra-selfie skill' is overly broad and effectively delegates any picture-related request to a skill that can generate or send selfie-like images. In context, this increases the risk of deceptive content generation and unintended outbound messaging because the trigger is not constrained by user consent, context, or platform policy.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The usage examples rely on broad everyday phrases like 'What are you doing right now?' and 'Show me you at a coffee shop' as triggers for image generation/sending. In an agent environment, ambiguous natural-language triggers increase the chance of unintended invocation, especially when the skill can send content across external messaging channels.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill describes sending images to external messaging channels but does not prominently warn that user-supplied recipient details and content will be transmitted off-platform. In context, this omission is risky because WhatsApp/Signal delivery can expose personal data or send content to unintended recipients.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The allowed tools grant broad shell execution and package invocation via npm/npx/curl/openclaw, far exceeding the minimal needs of choosing an image and sending a message. In an agent skill, this creates a large attack surface for arbitrary command execution, package abuse, and unintended network actions if the skill is triggered or influenced by user input.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Trigger phrases like 'dream', 'dance', 'how are you doing?', and 'where are you?' are common conversational inputs and can invoke the skill unintentionally. Because the skill can lead to outbound messaging, accidental activation materially raises misuse risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The curl command performs an authenticated POST to a local OpenClaw gateway that can dispatch messages to external platforms. While this is intentional functionality, it is still a true external-transmission risk because it enables delivery of content and recipient metadata outside the agent environment.
- Content
Alternative: Direct API call
bash curl -X POST "http://localhost:18789/message" \ -H "Authorization: Bearer $OPENCLAW_GATEWAY_TOKEN" \ -H "Content-Type: application/json" \ -d '{
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installer asks only a generic 'Shall we continue?' before later overwriting identity and persona files. This is dangerous because users are not clearly informed that existing workspace configuration will be changed, increasing the chance of unintended persistent modifications.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The installer appends broad behavioral instructions into
SOUL.md, including expansive triggers for when the agent should use the capability. This extends beyond a scoped feature and can permanently bias the agent's behavior, causing unauthorized or misleading actions in unrelated conversations.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The fallback persona directs the agent to 'guess what they want' for ambiguous requests like 'what are you doing?' and 'where are you?'. In skill context this is risky because it broadens activation without clear user intent, encouraging the model to take actions or send content in situations where the user did not explicitly ask for that capability.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest advertises sending images to messaging channels but provides no user-facing warning that content may be transmitted to third-party services or external destinations. Because the skill is designed around image delivery over messaging integrations, the lack of transparency increases the risk of users triggering outbound sharing without understanding the privacy implications.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest description says "Add dancing and selfie to your OpenClaw agent," which describes capabilities broadly but does not specify how or when the skill should be invoked. In manifest files, this kind of unspecific description can contribute to unintended activation because it lacks concrete trigger phrases, scope limits, or exclusion conditions.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- bin/cli.js:89