ClawHub
Back to skill

Security audit

Handoff

Security checks for vulnerabilities and agentic risk

Overview

The skill has a clear handoff-document purpose, but its path handling is under-scoped and could lead an agent to read or modify files outside the intended shared vault.

Review this skill before installing. It is useful for shared handoff notes, but it should be tightened so project names and permanent target paths are restricted to the intended vault directories before any read, search, write, or edit occurs.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:55
Finding

Unsanitized Path Parameters Permit Traversal Outside the Shared Vault

Content
View full analysis
/` 2) Prefer checking an `INDEX.md` if present; otherwise search by recency. 3) If `--date` is provided, narrow to that date folder first. ``` `SKILL.md:73`: ```markdown - `--permanent ` permanent-doc mode (ONLY propose updates unless `--apply`) ``` ### Technical Analysis The skill constructs filesystem locations using the user-controlled `project`, `date`, and `target_doc_path` parameters. Its instructions do not require these values to be validated, canonicalized, or checked against an allowed root directory. Consequently, absolute paths or traversal components such as `..` may cause the resolved path to escape the intended directories: - `$HOME/.openclaw/shared/handoff/` - `$HOME/.openclaw/shared/knowledge/` The `load` workflow is particularly exposed because it directs the agent to search, read, and summarize matching files without requiring confirmation for reads. The confirmation-before-writing rule reduces accidental modification risk but does not prevent unauthorized file disclosure. For permanent documents, explicit confirmation is required before modification, but the instructions still fail to ensure that the target is actually inside the permanent knowledge directory. ### Attack Path 1. An attacker invokes the load workflow with a traversal-based project value, for example: ```text /handoff load ../../../../ ``` 2. The agent interpolates the supplied value into: ```text $HOME/.openclaw/shared/handoff// ``` 3. Filesystem path resolution escapes the shared handoff directory. 4. Following the skill instructions, the agent searches the resulting external directory for an ` ...[truncated 1144 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.