Security audit

Learning Coach

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a learning-coach purpose, but its cron, network, install, and file-write helpers have enough unsafe scoping issues to require careful review before use.

Install only if you are comfortable with a skill that can create local learning records, fetch online resource feeds, and install persistent cron reminders. Review exact cron entries before applying them, avoid untrusted subject/workspace/source values, do not use the bootstrap --install option unless you accept global npm installation risk, and prefer running it in a dedicated workspace or user account until the scoping issues are fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup_cron.py:25
Finding: Cron Command Injection Through an Unquoted Workspace Path
Content: View full analysis
list[str]: py = "python3" base = workspace / "skills" / "learning-coach" / "scripts" weekly = base / "weekly_report.py" return [ f"30 7 * * * {py} {weekly} --mode daily-morning {TAG}", f"0 20 * * * {py} {weekly} --mode daily-evening {TAG}", f"0 10 * * 3,6 {py} {weekly} --mode curation-refresh {TAG}", f"0 7 * * 1 {py} {weekly} --mode weekly {TAG}", ] def main() -> int: ap = argparse.ArgumentParser() ap.add_argument("action", choices=["apply", "remove", "show"]) ap.add_argument("--workspace", default=str(Path.home() / ".openclaw" / "workspace")) args = ap.parse_args() # ... jobs = default_jobs(Path(args.workspace)) merged = filtered + jobs set_crontab("\n".join([x for x in merged if x.strip()]) + "\n") ``` ### Technical Analysis The user-controlled `--workspace` value is interpolated directly into cron command strings without shell quoting or validation. Although the script does not invoke these command strings immediately, cron later executes each command through a shell. `pathlib.Path` does not neutralize shell metacharacters such as semicolons, command substitutions, redirection operators, or comment characters. Consequently, a crafted workspace value can change the structure of the scheduled shell command. The script also modifies the user's complete crontab through `crontab -`, making the injected command persistent across sessions until the entry is removed. ### Attack Path 1. An attacker causes the script to be invoked with a malicious workspace value, for example: ```bash python3 scripts/setup_cron.py apply \ --workspace '/tmp/fake; touch /tmp/learning-coach-pwned #' ``` 2. `default_jobs()` e ...[truncated 867 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/source_ingest.py:15
Finding: Server-Side Request Forgery Through Arbitrary YouTube Feed URLs
Content: View full analysis
str: req = urllib.request.Request(url, headers={"User-Agent": "learning-coach/0.3"}) with urllib.request.urlopen(req, timeout=timeout) as r: return r.read().decode("utf-8", errors="replace") def youtube_feed_url(channel: str) -> str: c = channel.strip() if c.startswith("http"): return c # Accept channel id or @handle; caller can pass full URL for custom resolution. if c.startswith("UC"): return f"https://www.youtube.com/feeds/videos.xml?channel_id={c}" return f"https://www.youtube.com/feeds/videos.xml?user={c}" # ... for ch in args.youtube: try: url = youtube_feed_url(ch) xml_text = fetch_text(url) candidates.extend(parse_youtube_rss(xml_text, args.limit_per_source)) ``` ### Technical Analysis Any `--youtube` value beginning with `http` is treated as a feed URL and passed to `urllib.request.urlopen()`. The implementation does not enforce an approved hostname, require HTTPS, inspect the resolved IP address, or validate redirect destinations. The process can therefore be induced to issue requests to loopback, private, link-local, or otherwise internal addresses. Redirect handling may also permit an initially public URL to redirect to an internal service. The fetched response is parsed as XML. This limits direct disclosure for endpoints that do not return compatible XML, but it does not prevent blind SSRF, interaction with internal HTTP services, or extraction from an internal endpoint that returns attacker-compatible Atom XML. ### Attack Path 1. An attacker supplies an internal URL through the repeatable `--youtube` option: ```bash python3 scripts/source_ingest.py \ --youtube 'http://127. ...[truncated 1162 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/update_progress.py:29
Finding: Subject Path Traversal Allows Writes Outside the Subject Directory
Content: View full analysis
Remediation: View remediation
str: value = value.strip().lower() value = re.sub(r"[^a-z0-9]+", "-", value) return re.sub(r"-+", "-", value).strip("-") or "subject" ``` 2. Resolve the destination and verify containment before creating directories: ```python subjects_root = (Path(args.data_root) / "subjects").resolve() base = (subjects_root / slugify(args.subject)).resolve() if base.parent != subjects_root: raise ValueError("Invalid subject path") ``` 3. Reject absolute paths, path separators, null bytes, `.` components, and `..` components in subject identifiers. 4. Use atomic writes through a temporary file in the validated destination followed by `os.replace()`. 5. Where existing files are not expected to be replaced, use exclusive creation or explicit authorization checks. 6. Add tests covering absolute paths, repeated traversal components, mixed separators, and encoded path separators. ]]>

T08 · Insecure Dependencies

Warning

Location: scripts/bootstrap.py:24
Finding: Unpinned Global npm Package Installation Creates Supply-Chain Risk
Content: View full analysis
tuple[int, str]: p = subprocess.run(cmd, capture_output=True, text=True) return p.returncode, (p.stdout + p.stderr).strip() def maybe_install_clawhub() -> tuple[bool, str]: if has_bin("clawhub"): return True, "already installed" if not has_bin("npm"): return False, "npm not found" code, out = run(["npm", "i", "-g", "clawhub"]) return code == 0, out def main() -> int: ap = argparse.ArgumentParser() ap.add_argument("--install", action="store_true", help="Attempt installation for missing optional deps") # ... if args.install: for c in checks: if c.name == "clawhub" and not c.found: ok, msg = maybe_install_clawhub() c.found = ok or has_bin("clawhub") install_results[c.name] = msg ``` ### Technical Analysis When `--install` is specified, the bootstrap script installs the latest registry version of `clawhub` using `npm i -g`. No exact version, integrity hash, lockfile, package provenance, or approved registry is specified. npm packages may execute lifecycle scripts during installation. A compromised package release, compromised registry account, malicious registry configuration, or dependency-chain compromise could therefore execute code during bootstrap. The `-g` option increases scope by modifying the global npm installation location rather than a project-local, isolated environment. The operation is explicit rather than hidden, but it exceeds the minimum scope needed for an optional dependency. ### Attack Path 1. The expected package or one of its transitive dependencies is compromised, or the environment is configured to use an untrusted npm registry. 2. A user runs: `` ...[truncated 916 chars]
Remediation: View remediation
"]) ``` 2. Verify package integrity and provenance against an approved digest or signed release. 3. Force use of an approved HTTPS registry rather than inheriting an arbitrary user or system registry configuration. 4. Prefer a project-local installation in an isolated directory instead of `-g`. 5. Use `--ignore-scripts` where package lifecycle scripts are not required: ```bash npm install --ignore-scripts --save-exact clawhub@ ``` 6. Separate dependency checking from installation and display the exact version, registry, destination, and lifecycle-script policy before requesting confirmation. 7. Document that the optional package is not required for core learning-coach functionality and avoid automatic installation in unattended workflows. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as a learning coach but also specifies external feed ingestion from YouTube/X/web, network fetching, and disk writes. That mismatch is security-relevant because it can conceal data-ingestion and egress behavior behind an educational label, increasing phishing, untrusted content ingestion, tracking, and SSRF-like risk depending on implementation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a learning coach but also specifies external feed ingestion from YouTube/X/web, network fetching, and disk writes. That mismatch is security-relevant because it can conceal data-ingestion and egress behavior behind an educational label, increasing phishing, untrusted content ingestion, tracking, and SSRF-like risk depending on implementation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as a learning coach but also specifies external feed ingestion from YouTube/X/web, network fetching, and disk writes. That mismatch is security-relevant because it can conceal data-ingestion and egress behavior behind an educational label, increasing phishing, untrusted content ingestion, tracking, and SSRF-like risk depending on implementation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The skill is presented as a learning coach but also specifies external feed ingestion from YouTube/X/web, network fetching, and disk writes. That mismatch is security-relevant because it can conceal data-ingestion and egress behavior behind an educational label, increasing phishing, untrusted content ingestion, tracking, and SSRF-like risk depending on implementation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a learning coach but also specifies external feed ingestion from YouTube/X/web, network fetching, and disk writes. That mismatch is security-relevant because it can conceal data-ingestion and egress behavior behind an educational label, increasing phishing, untrusted content ingestion, tracking, and SSRF-like risk depending on implementation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a learning coach but also specifies external feed ingestion from YouTube/X/web, network fetching, and disk writes. That mismatch is security-relevant because it can conceal data-ingestion and egress behavior behind an educational label, increasing phishing, untrusted content ingestion, tracking, and SSRF-like risk depending on implementation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a learning coach but also specifies external feed ingestion from YouTube/X/web, network fetching, and disk writes. That mismatch is security-relevant because it can conceal data-ingestion and egress behavior behind an educational label, increasing phishing, untrusted content ingestion, tracking, and SSRF-like risk depending on implementation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a learning coach but also specifies external feed ingestion from YouTube/X/web, network fetching, and disk writes. That mismatch is security-relevant because it can conceal data-ingestion and egress behavior behind an educational label, increasing phishing, untrusted content ingestion, tracking, and SSRF-like risk depending on implementation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill is presented as a learning coach but also specifies external feed ingestion from YouTube/X/web, network fetching, and disk writes. That mismatch is security-relevant because it can conceal data-ingestion and egress behavior behind an educational label, increasing phishing, untrusted content ingestion, tracking, and SSRF-like risk depending on implementation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises and instructs use of file I/O, shell, network access, and cron management, but declares no explicit tool scope or permission boundaries. That creates an over-privileged/under-specified execution model where a host may grant broad capabilities without user-visible constraints, increasing the risk of unintended file modification, network egress, or persistence operations.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/bootstrap.py (reported line 25)May include surrounding context.
python
def run(cmd: list[str]) -> tuple[int, str]: p = subprocess.run(cmd, capture_output=True, text=True) return p.returncode, (p.stdout + p.stderr).strip()

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The bootstrap script can perform a global npm installation of 'clawhub', which exceeds simple dependency checking and introduces a supply-chain and environment-modification capability. In the context of a learning-coach skill, silently or opportunistically installing global software is broader than necessary and could expose users to malicious packages, compromised registries, or unintended system-wide changes.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/setup_cron.py (reported line 13)May include surrounding context.
python
def get_crontab() -> str: p = subprocess.run(["crontab", "-l"], capture_output=True, text=True) if p.returncode != 0: return "" return p.stdout

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/setup_cron.py (reported line 20)May include surrounding context.
python
def set_crontab(text: str) -> None: p = subprocess.run(["crontab", "-"], input=text, capture_output=True, text=True) if p.returncode != 0: raise RuntimeError(p.stderr.strip() or "failed to set crontab")

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest describes a learning coach focused on study planning, reminders, quizzes, grading, and adaptive roadmap updates. This file instead implements a generic ingestion pipeline that fetches YouTube RSS over the network, loads optional X/web feed JSON, and writes normalized content candidates, which is a broader content-harvesting behavior not reflected in the manifest description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file states that weekly_report.py writes two files under data/, but it provides no warning or disclosure about modifying the local filesystem. For markdown files, missing warnings about behaviors that affect user data or system state should be flagged when the description omits such notice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This Python code performs file creation and overwrite behavior by creating parent directories and writing a JSON output file, but it does not disclose that side effect through a prompt, warning comment, or descriptive message. The only visible output is the destination path, which does not clearly warn the user that data will be written under the subject directory or to a caller-supplied output path.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This code writes a JSON file to a path derived from user input or a default subject directory, but the only visible disclosure is printing the output path after the write completes. There is no prior warning, confirmation, or explanatory comment/docstring near the write operation describing that the skill will create directories and overwrite intervention data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.