xclawskill

• Outcome: Review
• Latest audit: Sep 1, 2026 · 2:06 AM UTC
• Version: 1.5.2

Overview

The skill is largely transparent about its XClaw network features, but its installer and self-upgrade path can replace local code from mutable network sources while the skill also handles credentials and funds.

Review this skill before installing if you will use it with real XClaw funds, marketplace actions, or long-running agent presence. Prefer the README's download-and-checksum flow over curl|bash, install dependencies in an isolated environment, protect the state file because it contains agent credentials, verify --base-url before authenticating, and avoid self-upgrade unless you trust the repository and tag provenance.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import subprocess

    def _run(args):
        return subprocess.run(args, cwd=repo_root, capture_output=True, text=True)

    prev_head = _run(["git", "rev-parse", "HEAD"]).stdout.strip()
    tags = _run(["git", "ls-remote", "--tags", "--refs", "origin"])

• Confidence: 88% confidence
• Finding: The subprocess call itself uses a fixed argument list rather than shell=True, so classic command injection is not the issue. However, it is part of a self-upgrade path that invokes local git to fetch and checkout remote code, giving the skill the ability to modify its own installation outside its declared XClaw interaction scope; in an agent setting this materially expands the trust boundary and can lead to arbitrary code execution on the next run if the upstream repo or local git configuration is compromised.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill exercises sensitive capabilities including shell execution, filesystem reads/writes, environment-variable usage, and network access, yet it does not declare permissions in a machine-readable way. This weakens review and consent boundaries because an agent or user may invoke installation, upgrade, or networked actions without a clear up-front permissions contract.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The documented purpose frames the skill as a network interaction toolkit, but the behavior also includes local installation, persistent daemon/listener modes, local configuration writes, identity inspection, and self-upgrade that replaces local code. That mismatch can cause reviewers or orchestrators to underestimate the scope of code execution and persistence, increasing the chance that dangerous actions are approved under an overly broad description.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The launcher advertises and dispatches actions that are not declared in the skill metadata, including potentially sensitive operations such as self-upgrade, daemon, and listen. Hidden or undocumented entry points weaken reviewability and can expose privileged behaviors that users or orchestrators did not intend to permit, especially in an agent-network skill that can affect connectivity, messaging, and lifecycle behavior.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill contains a self-upgrade action that fetches remote tags, checks out new code, and replaces its own local codebase. This is dangerous because it grants a network-interaction skill an undeclared self-modification capability, enabling supply-chain compromise or persistence if a remote source, git remote, or local repository state is tampered with.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: These subprocess-driven git operations perform fetch and checkout of remote content, which is a privileged local-code modification capability unrelated to the manifest's advertised purpose. Even with SHA256SUMS verification, the hashes are retrieved from the same checked-out source tree, so they do not provide an independent trust anchor against a malicious upstream release.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The skill exposes additional long-running listen and daemon actions that are not described in the manifest. Undeclared persistent network behaviors increase operational risk because they can maintain ongoing connections, receive untrusted messages, and change the agent's runtime posture in ways a caller or reviewer would not expect from the declared functionality.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The installer automatically performs a network clone of a remote GitHub repository when local sources are absent, but does not present an explicit warning, prompt, version pin, or integrity verification. This makes installation dependent on mutable remote content and increases supply-chain risk if the repository or transport path is compromised.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script runs pip install automatically and even falls back to --break-system-packages variants, which can modify the user's Python environment in invasive ways without explicit consent. If the dependency set or index resolution is malicious or compromised, arbitrary code may execute during package installation, and the break-system-packages option can also destabilize the host environment.

Session Persistence

Medium

• Category: Rogue Agent

Content

# ── 5. 创建 xclaw-skill 命令 ────────────────────────────────────────────
BIN_DIR="${HOME}/.local/bin"
mkdir -p "$BIN_DIR"
chmod +x "$TARGET/scripts/xclaw_skill.py"
chmod +x "$TARGET/scripts/xclaw-skill"
ln -sfn "$TARGET/scripts/xclaw-skill" "$BIN_DIR/xclaw-skill"

• Confidence: 78% confidence
• Finding: The installer creates a persistent executable entry in ~/.local/bin via a symlink, making the skill easy to invoke in future sessions without re-validation. Persistence in itself is expected for installers, but it still changes the user's execution environment and could preserve access to later-updated or replaced code under the installed path.

External Script Fetching

High

• Category: Supply Chain

Content

| 资金转出 | `withdraw` | 发起链上提现，转出金额与目标地址不可逆 | 必须显式 `--confirm`；执行前回显地址与金额供核对；广播由平台执行器处理 |

**文件访问**：仅读写用户显式指定的状态文件、临时目录与技能安装目录，不读取其他用户文件。
**执行环境**：`verify` 等动作调用系统 Python；`curl | bash` 安装方式请先校验（见 README 安全章节）。

## Installation (agents: do this first if the skill is missing)

• Confidence: 99% confidence
• Finding: The installation flow recommends piping a remotely fetched script directly into bash, which creates a classic arbitrary code execution risk if the upstream source, transport, repository, or account is compromised. In this skill's context, that is especially dangerous because the installer can write files, create symlinks, and install packages on the host.

External Script Fetching

Low

• Category: Supply Chain

Content

# 同时安装 Python 依赖并创建 xclaw-skill 命令。
#
# 用法：
#   curl -fsSL https://raw.githubusercontent.com/qomob/xclawskill/main/install.sh | bash
#   或在仓库内直接运行： bash install.sh
#
set -euo pipefail

• Confidence: 89% confidence
• Finding: The documented installation method encourages direct execution of a remotely fetched script from GitHub raw content. This bypasses normal review of the script contents and trains users into a high-risk installation pattern where upstream compromise or tampering immediately becomes local code execution.

External Script Fetching

Low

• Category: Supply Chain

Content

repo_root = os.path.dirname(script_dir)
    if not os.path.isdir(os.path.join(repo_root, ".git")):
        return fail("self-upgrade", "非 git 安装，请重新运行 install.sh 安装最新版",
                    hint="curl -fsSL https://raw.githubusercontent.com/qomob/xclawskill/main/install.sh | bash")
    if not confirm:
        return fail("self-upgrade", "升级会替换本地代码，需要显式授权",
                    hint="确认后重跑并加 --confirm")

• Confidence: 75% confidence
• Finding: The code does not execute the curl|bash pipeline directly, but it presents it as remediation guidance to the operator. Recommending direct remote-script execution is unsafe because it bypasses package trust controls and encourages users to run arbitrary network-fetched code, which compounds the already risky self-upgrade design.

Known Vulnerable Dependency: cryptography==46.0.3 — 10 advisory(ies): GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); CVE-2026-69247 (cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle th); CVE-2026-69249 (python-cryptography: Duplicate self-signed intermediates can cause exponential p) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The dependency is pinned to cryptography==46.0.3, and the finding indicates multiple published advisories affecting that exact version. Because this skill interacts with an agent network and may handle authentication, encrypted messages, signatures, funds, or task results, weaknesses in a core cryptographic library can undermine confidentiality, integrity, or trust validation in especially sensitive workflows.

Chaining Abuse

High

• Category: Tool Misuse

Content

# 同时安装 Python 依赖并创建 xclaw-skill 命令。
#
# 用法：
#   curl -fsSL https://raw.githubusercontent.com/qomob/xclawskill/main/install.sh | bash
#   或在仓库内直接运行： bash install.sh
#
set -euo pipefail

• Confidence: 96% confidence
• Finding: Piping curl output directly into bash creates an immediate code-execution chain from unaudited remote content. In the context of an installer that also clones repositories and installs Python packages, this significantly amplifies supply-chain and arbitrary execution risk because a compromised endpoint can run attacker-controlled commands instantly.

Static analysis

Detected: suspicious.env_credential_access

Python code POSTs credential environment variables to an environment-controlled URL.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/xclaw_skill.py:267