ClawHub
Back to skill

Security audit

Alerting & Notification System

Security checks for vulnerabilities and agentic risk

Overview

This alerting skill has a legitimate monitoring purpose, but it includes unsafe command execution, system-level persistence, and cross-skill file changes that need careful review before installation.

Do not run the init, integrate, cron, email, or monitor paths on a real system until the package removes shell-based command construction, replaces system cron with explicit user-scoped scheduling, removes automatic writes into other skills, adds endpoint allowlists and payload redaction, and documents exact privileged actions plus uninstall steps.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T06 · System Persistence

Error
Location
alert_integration.sh:223
Finding

Persistent System-Wide Cron Task Installation

Content
View full analysis
"$script_path" << 'EOF' #!/bin/bash # Cron job para monitoreo automático de APIs críticas ALERT_DIR="/workspace/skills/alerting-system" LOG_FILE="/var/log/openclaw_alerts/cron.log" echo "[$(date)] Iniciando monitoreo automático..." >> "$LOG_FILE" # Monitorear APIs Tiklick (ejemplos - ajustar URLs reales) APIS=( "https://api.tiklick.com/health" "https://admin.tiklick.com" "https://app.tiklick.com" ) for api in "${APIS[@]}"; do echo "Monitoreando: $api" >> "$LOG_FILE" cd "$ALERT_DIR" && node src/index.js monitor "$api" 200 >> "$LOG_FILE" 2>&1 sleep 2 done # Verificar sistema de alertas cd "$ALERT_DIR" && node src/index.js stats >> "$LOG_FILE" 2>&1 echo "[$(date)] Monitoreo completado" >> "$LOG_FILE" EOF chmod +x "$script_path" # Configurar cron job (cada 15 minutos) echo "*/15 * * * * rhandus $script_path" | sudo tee "$cron_file" > /dev/null } ``` ### Technical Analysis The `cron` operation writes a new executable script into the Skill directory and uses `sudo` to create `/etc/cron.d/openclaw-alerting`. The resulting task executes every 15 minutes as the hard-coded `rhandus` account and continues running after the initiating process or agent session ends. The installer does not request specific confirmation for system-wide persistence, validate the ownership and permissions of the scheduled script, or provide an uninstall mechanism. Because cron later executes a path outside a protected system directory, any party able to modify that script can alt ...[truncated 950 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
src/alert_manager.js:408
Finding

Shell Command Injection Through the Monitored URL

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
src/alert_manager.js:221
Finding

Shell Command Injection in Email Notification Delivery

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Error
Location
alert_integration.sh:116
Finding

Generated Cross-Skill Integrations Execute Untrusted Fields Through a Shell

Content
View full analysis
"$api_testing_dir/alert_integration.js" << 'EOF' ... EOF cat > "$security_dir/alert_integration.js" << 'EOF' ... EOF ``` ### Technical Analysis The installation script writes or replaces `alert_integration.js` ...[truncated 1491 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
src/index.js:151
Finding

Unrestricted HTTP Monitor Enables Server-Side Request Forgery

Content
View full analysis
[expected_status]'); return; } const expectedStatus = parseInt(args[1]) || 200; console.log(`📡 Monitoreando: ${url} (esperado: ${expectedStatus})`); const result = await manager.monitorHTTP(url, { expectedStatus, alertOnFailure: true, alertPriority: 'critical', serviceName: 'http-monitor' }); ``` The destination is passed to `curl` without destination restrictions: ```js const command = `curl -s -o /dev/null -w "%{http_code}" --max-time ${timeout} "${url}"`; const { stdout } = await execAsync(command, { shell: true }); ``` ### Technical Analysis The monitor accepts arbitrary destinations without validating the URL protocol, hostname, resolved IP address, or network range. It does not block loopback, link-local, private, reserved, or cloud metadata addresses. Consequently, a caller can make requests from the Skill's network context to services that may not be reachable from the attacker's own machine. Although the current `curl` invocation discards the response body, response status and timing can still be used to detect and probe internal services. ### Attack Path 1. An attacker supplies a loopback, private-network, link-local, or metadata-service URL to the `monitor` command. 2. The CLI forwards the destination without validation. 3. `curl` performs the request from the trusted runtime environment. 4. The returned status, errors, and timing reveal whether the destination is reachable and how it responds. 5. Repeated requests can enumerate internal hosts, ports, and HTTP services. ### Impact Assessment The vulnerability permits ...[truncated 371 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (38)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The described behavior includes undeclared outbound email, HTTP monitoring via curl, and child-process shell execution, all of which are stronger and riskier than a high-level alerting description suggests. Shell execution in particular can become a command-injection and data-exfiltration path if any monitored values or rule inputs are later interpolated into commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The described behavior includes undeclared outbound email, HTTP monitoring via curl, and child-process shell execution, all of which are stronger and riskier than a high-level alerting description suggests. Shell execution in particular can become a command-injection and data-exfiltration path if any monitored values or rule inputs are later interpolated into commands.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script creates an executable monitor and installs a system cron entry under /etc/cron.d, extending the skill into host-level scheduled execution. That creates persistence, repeated network activity, and a privileged execution path that goes beyond normal alert delivery behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Creating an executable script and installing a system cron job without a strong warning is a significant transparency failure because it establishes persistent scheduled execution. Users may not realize they are enabling recurring code execution and outbound monitoring on the host.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Piping data directly into sudo tee writes attacker-influenced or script-generated content into a privileged system location in one step, reducing opportunities for review or safety checks. This command-chain pattern is commonly abused to establish persistence and is especially dangerous here because it targets /etc/cron.d.

Content

Scanner excerpt · alert_integration.sh (reported line 277)May include surrounding context.

sh
chmod +x "$script_path"
    
    # Configurar cron job (cada 15 minutos)
    echo "*/15 * * * * rhandus $script_path" | sudo tee "$cron_file" > /dev/null
    
    log_success "Cron job configurado: cada 15 minutos"
    log_info "Script: $script_path"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises operational capabilities that inherently require shell, network, and environment access, but it declares no explicit tool scope or permissions. This creates a hidden-capability problem: a reviewer or runtime may underestimate what the skill can do, increasing the chance of unsafe execution with broader privileges than intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill promotes sending alerts through Telegram and email without warning that alert payloads may contain operational, log, or security data. In an alerting context, this can lead to unintended disclosure of sensitive system state, incident details, or personal data to third-party services or broad recipient lists.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This example instructs monitoring of an external API endpoint, which implies routine outbound network communication and possible transmission of operational metadata to or about a third-party service. In an alerting skill, that is contextually expected, but it still expands the attack surface and may leak internal monitoring behavior or service relationships.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

bash
# Monitorear API Tiklick
alert monitor https://api.tiklick.com/health --interval 60 --channel telegram

# Monitorear archivo de log
alert monitor /var/log/tiklick_app.log --pattern "ERROR\|CRITICAL" --channel email

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The auto-resolve example embeds a shell command using curl against an external endpoint. Combining shell execution with network access is more dangerous than passive monitoring because it introduces a pattern that can be extended to arbitrary command execution or unsafe command templating in operational workflows.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

alert resolve --service api-tiklick

Auto-resolver después de verificación

alert resolve --auto --check "curl -s https://api.tiklick.com/health"

text

## ⚙️ Configuración

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The integration example with API testing again normalizes external endpoint monitoring and automatic alert triggering tied to a third-party domain. This is expected for an alerting tool, but without explicit egress controls and disclosure it can still expose service topology and create unintended outbound activity.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

Con API Testing:

bash
# Si API falla, generar alerta
api test https://api.tiklick.com/health --on-failure "alert trigger api.down --priority critical"

Con Security Tools:

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This production-monitoring example schedules repeated checks against an external API, creating persistent outbound traffic and potential disclosure of operational patterns. In context this is part of the intended functionality, but it still warrants review because frequent automated access to hardcoded external endpoints can become a privacy, reliability, or policy issue.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

Caso 1: Monitoreo API Producción

bash
# Configurar monitoreo 24/7
alert monitor https://api.tiklick.com/health \
  --interval 30 \
  --timeout 10 \
  --expected-status 200 \

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

User-facing comments, logs, and help text are consistently presented in Spanish, with no indication that the skill is Spanish-only by design or that users may choose another language. This can violate language or locale policy where user-facing skills must not force a specific language without opt-in or clear justification.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · alert_integration.sh (reported line 41)May include surrounding context.

sh
# Node.js
    if ! command -v node &> /dev/null; then
        log_error "Node.js no encontrado. Instalar con: sudo apt install nodejs"
        exit 1
    fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · alert_integration.sh (reported line 47)May include surrounding context.

sh
# Node.js
    if ! command -v node &> /dev/null; then
        log_error "Node.js no encontrado. Instalar con: sudo apt install nodejs"
        exit 1
    fi

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · alert_integration.sh (reported line 45)May include surrounding context.

sh
exit 1
    fi
    
    # curl
    if ! command -v curl &> /dev/null; then
        log_warning "curl no encontrado. Instalar con: sudo apt install curl"
    fi

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Creating privileged log directories under /var/log and changing ownership are system administration actions outside the narrow scope of an alerting integration helper. Scope expansion is dangerous because it normalizes privileged filesystem changes and can be repurposed for persistence or tampering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script performs privileged directory creation and ownership changes without an upfront warning, confirmation, or dry-run mode. Silent privileged mutations increase the risk of users granting elevated access without understanding the consequences.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
98% confidence
Finding

The script invokes sudo to create a directory under /var/log, requiring elevated privileges and modifying host state. In the context of an alerting skill, this is broader than necessary and increases the risk of privilege misuse if the script or environment is compromised.

Content

Scanner excerpt · alert_integration.sh (reported line 53)May include surrounding context.

sh
# Directorio de logs
    if [ ! -d "$LOG_DIR" ]; then
        log_info "Creando directorio de logs: $LOG_DIR"
        sudo mkdir -p "$LOG_DIR"
        sudo chown rhandus:rhandus "$LOG_DIR"
    fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
98% confidence
Finding

Changing ownership with sudo alters host filesystem permissions and can unintentionally grant a user or process control over a privileged logging location. Misconfigured ownership on log directories can aid log tampering or facilitate later abuse.

Content

Scanner excerpt · alert_integration.sh (reported line 54)May include surrounding context.

sh
if [ ! -d "$LOG_DIR" ]; then
        log_info "Creando directorio de logs: $LOG_DIR"
        sudo mkdir -p "$LOG_DIR"
        sudo chown rhandus:rhandus "$LOG_DIR"
    fi
    
    log_success "Dependencias verificadas"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script writes new executable integration code directly into another skill's directory, creating cross-skill persistence and modifying unrelated components without integrity checks or explicit user consent. This expands the blast radius of the alerting skill and can be abused to inject unsafe behavior into the api-testing skill path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script silently writes an integration file into another skill directory, which is a material side effect not clearly disclosed to the user at decision time. Undisclosed cross-component modification undermines trust and makes later auditing and incident response harder.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This function generates and drops code into the security-tools skill, which is especially sensitive because that skill may process security findings and privileged workflows. Cross-skill code generation in a security-related directory increases the chance of privilege expansion, integrity loss, and hard-to-audit behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Writing undisclosed integration code into security-tools is particularly risky because users may not expect an alerting helper to alter security analysis behavior. This can create hidden coupling and a stealthy path for future command execution in a more trusted skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The cron monitor contains hardcoded external URLs and will periodically contact them, creating recurring outbound network activity and possible metadata leakage about the host's monitoring behavior. In an alerting skill this is somewhat contextually expected, but hardcoding third-party domains and enabling automated polling still increases risk.

Content

Scanner excerpt · alert_integration.sh (reported line 257)May include surrounding context.

sh
# Monitorear APIs Tiklick (ejemplos - ajustar URLs reales)
APIS=(
    "https://api.tiklick.com/health"
    "https://admin.tiklick.com"
    "https://app.tiklick.com"
)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
99% confidence
Finding

Using sudo tee to write a file into /etc/cron.d creates privileged persistent execution on the host. This is a high-risk action because any compromise of the script contents or target path results in recurring elevated-impact behavior outside the skill's normal lifecycle.

Content

Scanner excerpt · alert_integration.sh (reported line 277)May include surrounding context.

sh
chmod +x "$script_path"
    
    # Configurar cron job (cada 15 minutos)
    echo "*/15 * * * * rhandus $script_path" | sudo tee "$cron_file" > /dev/null
    
    log_success "Cron job configurado: cada 15 minutos"
    log_info "Script: $script_path"

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:139