T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/publish_guidelines.py:14- Finding
Shared Workspace Environment File Exposes Unnecessary Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Kisa Guideline Hub
Security checks for vulnerabilities and agentic risk
Overview
The skill has a legitimate guideline-publishing purpose, but it loads shared credentials and executes unbundled code from a sibling skill while also documenting unattended publishing automation.
Review before installing. Use a dedicated least-privilege Notion token and a skill-specific env file, verify the external security-news-feed code before running, test against a non-production Notion database, and do not enable the LaunchAgent or cron job until logging, duplicate handling, and a rollback/disable path are clear.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
scripts/publish_guidelines.py:19- Finding
Unpinned External Python Modules Are Executed from Outside the Skill Package
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
Findings (16)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Solution:
bash # Check .env file grep SECURITY_GUIDE_DATABASE_ID ~/.openclaw/workspace/.env # Or use default
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Solution:
bash # Check .env file grep SECURITY_GUIDE_DATABASE_ID ~/.openclaw/workspace/.env # Or use default
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
Referencing and loading a shared .env file is a credential-access pattern because it can expose all secrets present in the global workspace to this script and any imported code it invokes. Given that the script also imports external code from another skill, the credential exposure risk is amplified beyond the minimum needed for Notion publishing.
- Content
python # 환경 변수 로드 from dotenv import load_dotenv env_file = Path.home() / '.openclaw' / 'workspace' / '.env' load_dotenv(env_file) # Security News Module 경로 추가 (security-news-feed의 modules 사용)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script rewrites sys.path and changes the working directory so it can import and execute code from a different skill directory. This breaks isolation between skills and allows unexpected code execution through shared modules, path hijacking, or tampered dependencies in the external skill, making the publisher trust code outside its own reviewed boundary.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python if not any([args.collect, args.publish, args.full]): parser.print_help() return guidelines = []
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documents environment-variable access and shell/Python execution but does not declare any explicit tool scope or permissions boundary. That makes the skill's effective capabilities opaque to users and reviewers, increasing the chance it can access sensitive secrets such as Notion API keys or perform networked actions without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill automates downloading PDFs from external sites and uploading them into Notion, but the description does not prominently warn users about this data flow or the risks of ingesting untrusted files. This can lead to silent transfer of externally sourced content into an internal workspace, with operational, compliance, and malware-handling implications.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 87% confidence
- Finding
The skill advertises an already configured LaunchAgent that runs every hour automatically, introducing persistence and repeated execution without an explicit runtime consent step in the skill itself. In context, this is more sensitive because the task performs network collection, file downloads, and uploads to Notion on a schedule, amplifying the impact of mistakes or compromised upstream content.
- Content
bash # Already configured in LaunchAgent # com.openclaw.security-news.plist # Runs every hour automatically
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation instructs users to run a publisher that performs remote writes to Notion, potentially including file uploads, without an explicit warning that it will modify external data. In an agent or automation context, this increases the risk of unintended data creation, duplication, or publication to the wrong workspace or database.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The recurring automation examples configure unattended scheduled jobs that will repeatedly perform remote publishing actions, but they do not warn users about ongoing external side effects. This is dangerous because a misconfigured job can continuously publish incorrect, duplicate, or unintended content and may be hard to notice once persistence is established.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
The LaunchAgent example establishes persistence for automated execution on a daily interval. In benign administration this can be legitimate, but in a skill context it is security-relevant because it creates unattended recurring behavior that could continue making remote changes or be repurposed if the referenced script or environment is compromised.
- Content
LaunchAgent Configuration
xml <!-- ~/Library/LaunchAgents/com.openclaw.guidelines.plist --> <key>ProgramArguments</key> <array> <string>/usr/bin/python3</string>
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script loads environment variables from a global workspace .env file outside the skill boundary, which broadens the trust scope and gives this skill access to credentials/configuration unrelated to guideline publishing. In an agent environment, that creates unnecessary secret exposure and makes compromise of this skill or its dependencies more likely to affect other skills and services.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The activation description includes Korean-only trigger phrases and the skill is framed around Korean security organizations, but the document does not explicitly state that this locale restriction is optional or user-selectable. This can be a language/locale policy concern when a skill effectively forces a specific language context without opt-in.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This documentation file belongs to the 'kisa-guideline-hub' skill, but the example command changes into 'security-news-module' and invokes '../guideline-publisher/scripts/publish_guidelines.py'. That is an active contradiction in the usage documentation because it tells users to run a different module/path than the skill being documented.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The cron and LaunchAgent examples schedule '/skills/guideline-publisher/scripts/publish_guidelines.py' and again use 'security-news-module' as the working directory, which conflicts with the current skill's manifest identity 'kisa-guideline-hub'. This is more than incomplete documentation: it instructs deployment of a different component than the skill claims to be.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This markdown uses Korean-only example content and category values as the apparent default schema representation, but it does not state that the skill is Korea-specific or that users may choose another language/locale. Under the policy rule, a locale constraint should be explicit and justified or offered as an opt-in choice.
- Content
Static analysis
No suspicious patterns detected.