ClawHub
Back to skill

Security audit

Kisa Guideline Hub Repo

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent Notion publishing purpose, but it needs Review because it loads a shared credential file, depends on missing unpinned code for authenticated publishing, and documents unattended scheduled runs.

Review before installing. Use a dedicated Notion integration with access only to the intended guideline database, keep only required Notion values in a skill-specific env file, verify the security-news-module source before running, and avoid enabling cron or LaunchAgent scheduling until dry-run, logging, and duplicate controls are clear.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/publish_guidelines.py:15
Finding

Workspace-wide credential file is loaded without least-privilege filtering

Content
View full analysis

Vulnerability Details

File Location: scripts/publish_guidelines.py, lines 15–16
Vulnerability Type: Excessive access to shared credentials
Risk Level: Medium

python
# 환경 변수 로드
from dotenv import load_dotenv
env_file = Path.home() / '.openclaw' / 'workspace' / '.env'
load_dotenv(env_file)

Technical Analysis

The script loads the entire shared workspace .env file into its process environment. The declared functionality only requires a limited set of Notion configuration values, principally NOTION_API_KEY, SECURITY_GUIDE_DATABASE_ID, and the documented fallback database ID.

Loading the complete shared file makes every variable stored there accessible to all code executing in the process, including the dynamically imported crawler, configuration, and publisher modules. This violates least privilege because unrelated credentials may be exposed even though they are not necessary for guideline collection or publication.

The Skill documentation confirms that the file may also contain SECURITY_NEWS_GLM_API_KEY, which is not required by this direct-publishing workflow. The audit found no code in the packaged script that intentionally transmits unrelated secrets, but the unnecessarily broad credential scope increases the consequences of a compromised, substituted, or vulnerable dependency.

Attack Path

  1. A user stores Notion credentials and other service credentials in ~/.openclaw/workspace/.env, as directed by the Skill documentation.
  2. The user invokes scripts/publish_guidelines.py.
  3. load_dotenv(env_file) loads every value from the shared file into the process environment.
  4. The script imports and invokes code from the external security-news-module.
  5. If that external module is malicious or compromised, it can enumerate the process environment and retrieve unrelated credentials.
  6. The acquired credentials can then be used through their corresponding external services, sub ...[truncated 578 chars]
Remediation
View remediation

Remediation Suggestions

  1. Use a Skill-specific configuration file containing only the credentials required for guideline publication.
  2. Do not load the complete workspace-wide .env into the process.
  3. Explicitly parse and validate an allowlist of required variables, such as:
    • NOTION_API_KEY
    • SECURITY_GUIDE_DATABASE_ID
    • SECURITY_NEWS_DATABASE_ID, only when the documented fallback is intentionally enabled
  4. Remove SECURITY_NEWS_GLM_API_KEY and other unrelated credentials from the environment used by this direct-publishing workflow.
  5. Run the process with a dedicated Notion integration whose permissions are restricted to the intended guideline database.
  6. Ensure the credential file is readable only by its owner and never print complete environment contents in logs or diagnostic output.
  7. If shared configuration cannot be avoided, isolate imported dependencies in a subprocess supplied with a minimal, explicitly constructed environment.

T08 · Insecure Dependencies

Warning
Location
scripts/publish_guidelines.py:19
Finding

Unpinned and absent external module controls security-sensitive operations

Content
View full analysis

Vulnerability Details

File Location: scripts/publish_guidelines.py, lines 19–24
Vulnerability Type: Unsafe external dependency resolution
Risk Level: Medium

python
# Security News Module 경로 추가
skill_path = Path(__file__).parent.parent / 'security-news-module'
sys.path.insert(0, str(skill_path))

from modules.crawlers.kisa import KISACrawler
from modules.crawlers.boho import BohoCrawler
from modules.publisher_service import PublisherService
from config import GUIDE_DATABASE_ID

Technical Analysis

The audited project does not contain the referenced security-news-module, but the script delegates all core security-sensitive behavior to it, including web crawling, PDF downloading, configuration resolution, and authenticated Notion publication.

The project does not specify a pinned version, integrity hash, trusted installation source, or validation procedure for this module. It also imports generic top-level names such as modules and config. If the expected directory is absent, Python continues searching other entries in sys.path, allowing an unintended package or local module with one of those names to satisfy the import.

Python executes module-level code during import. Consequently, dependency substitution can result in arbitrary Python execution before collection or publication begins. The substituted code would run under the invoking user's account and after the shared .env has been loaded.

This audit could not verify the crawler's URL handling, PDF validation, temporary-file handling, duplicate checks, or Notion upload behavior because the implementation responsible for those operations is missing from the supplied project.

Attack Path

  1. The expected security-news-module directory is absent, replaced, or installed from an untrusted source.
  2. An attacker places a malicious package named modules, a malicious config.py, or a modified security-news-module in a location ...[truncated 1265 chars]
Remediation
View remediation

Remediation Suggestions

  1. Include the required crawler and publisher implementation in the audited package, or declare it as a formally managed dependency.
  2. Pin the dependency to an exact version and verify it using cryptographic hashes or signed release artifacts.
  3. Document a trusted installation source and avoid installing dependencies from ambiguous package indexes or mutable branches.
  4. Replace generic top-level package names such as modules and config with a unique, fully qualified package namespace.
  5. Before changing sys.path, resolve the expected dependency directory and verify that:
    • It exists and is a directory.
    • Its resolved path is inside an approved installation root.
    • It contains the expected package files.
    • Its ownership and permissions prevent modification by untrusted users.
  6. Fail closed with a clear error if the expected dependency cannot be validated; do not allow imports to fall through to unrelated sys.path entries.
  7. Load only the minimum required credentials after dependency integrity has been verified.
  8. Add automated tests and package manifests covering crawler destinations, PDF validation, temporary-file permissions, duplicate handling, and authenticated Notion operations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 25)May include surrounding context.

⚙️ 환경 설정

bash
# .env 파일 생성
cat > .env << 'ENVEOF'
NOTION_API_KEY=your-notion-api-key
NOTION_DATABASE_ID=your-database-id

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

⚙️ 환경 설정

bash
# .env 파일 생성
cat > .env << 'ENVEOF'
NOTION_API_KEY=your-notion-api-key
NOTION_DATABASE_ID=your-database-id

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/examples.md (reported line 179)May include surrounding context.

⚙️ 환경 설정

bash
# .env 파일 생성
cat > .env << 'ENVEOF'
NOTION_API_KEY=your-notion-api-key
NOTION_DATABASE_ID=your-database-id

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/examples.md (reported line 180)May include surrounding context.

⚙️ 환경 설정

bash
# .env 파일 생성
cat > .env << 'ENVEOF'
NOTION_API_KEY=your-notion-api-key
NOTION_DATABASE_ID=your-database-id

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish_guidelines.py (reported line 15)May include surrounding context.

python
# 환경 변수 로드
from dotenv import load_dotenv
env_file = Path.home() / '.openclaw' / 'workspace' / '.env'
load_dotenv(env_file)

# Security News Module 경로 추가

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/publish_guidelines.py (reported line 122)May include surrounding context.

python
if not any([args.collect, args.publish, args.full]):
        parser.print_help()
        return
    
    guidelines = []

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

bash
# 매일 오전 9시 실행
crontab -e

# 추가
0 9 * * * cd ~/.openclaw/workspace/skills/kisa-guideline-hub && python3 scripts/publish_guidelines.py >> logs/cron.log 2>&1

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documents access to environment-stored secrets such as NOTION_API_KEY and database IDs, but it does not declare an explicit tool scope or permissions boundary. This increases the risk that an agent could access secrets or execute capability-dependent actions without clear user-visible authorization, especially since the skill also performs network publication to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill is designed to publish content to Notion and upload PDFs, which are external side effects that modify third-party data/services. Because the skill description does not prominently warn that invoking it can perform write actions, a user or calling agent may trigger unintended publication with trusted credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented hourly LaunchAgent execution enables recurring network access, content collection, and publication without an explicit safety warning or control gate. Persistent automated execution amplifies the impact of mistakes, source compromise, or misconfiguration because actions can continue unattended and repeatedly affect external systems.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

Referencing an already configured LaunchAgent indicates persistence: the workflow is intended to continue running every hour beyond the initiating session. In an agent skill context, persistence is security-relevant because it can cause ongoing autonomous behavior, recurring network access, and repeated writes using stored credentials without fresh user intent.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

bash
# Already configured in LaunchAgent
# com.openclaw.security-news.plist
# Runs every hour automatically

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The example directly instructs operators to run a command that performs remote publication to Notion, which changes external state, but it provides no warning that pages/files may be created or updated. In an agent-skill context, omission of side-effect warnings increases the chance of accidental execution, especially if the command is copied verbatim during routine use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow describes downloading PDFs locally and then uploading them to Notion without warning about local file handling, data transfer, storage location, or trust in remote content. This can lead users to move unreviewed files across systems and services, which is risky in a security-content ingestion pipeline.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The scheduled LaunchAgent/cron examples enable unattended daily network collection and remote publication, yet they omit warnings about repeated external modifications, continuous outbound requests, and the operational risks of automation. In practice this can cause silent recurring changes, duplicate content, or repeated uploads if configuration or deduplication fails.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/examples.md (reported line 216)May include surrounding context.

LaunchAgent Configuration

xml
<!-- ~/Library/LaunchAgents/com.openclaw.guidelines.plist -->
<key>ProgramArguments</key>
<array>
    <string>/usr/bin/python3</string>

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The natural-language instructions and labels are presented exclusively in Korean, which can amount to forcing a specific language without user opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The markdown describes automatic collection, PDF downloads, and automatic registration to a Notion database, which implies outbound network requests and transmission of collected metadata to a third-party service. There is no accompanying user warning about external connectivity, what data is sent, or privacy/system impact.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The schema examples and allowed category values are presented only in Korean, and the file does not state that the skill is Korea-specific or that users may choose another language/locale. This can conflict with organizational language/locale policy when a skill implicitly enforces one locale without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code file contains user-facing natural-language text and descriptions exclusively in Korean, including the module docstring and CLI help/output. Under the policy rule, forcing a specific language without user opt-in can be a locale-policy violation when no justification or alternative is provided.

Content

No source excerpt is available for this finding.