AutoCraft

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:27 AM UTC
• Version: 2.1.0

Overview

The skill is a coherent AI project platform, but it installs and runs mutable external code and exposes persistent local services with too little containment or user control.

Review install.sh and the external AutoCraft repository before installing. Prefer running it in a container or disposable development VM, pin the repository to a reviewed commit, bind services to 127.0.0.1 unless remote access is intentional, and stop the nohup processes after use. Treat task inputs as untrusted and do not let AutoCraft sub-agents override prior user or repository-scope constraints.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:25

Finding

Mutable External Repository Is Downloaded, Installed, and Executed

Content

View full analysis

/tmp/autocraft_backend.log 2>&1 & # Start frontend nohup npm run dev > /tmp/autocraft_frontend.log 2>&1 & ``` ### Technical Analysis The installer clones the current default branch of a separately maintained external repository without pinning an immutable commit, verifying a cryptographic checksum, or validating a release signature. It subsequently installs dependencies specified by that downloaded repository and executes its backend and frontend. This creates a time-of-check/time-of-use supply-chain boundary: the effective code executed during installation can differ from the code reviewed in this Skill package. Python package build hooks and npm lifecycle scripts may execute code during installation, while the downloaded backend and frontend are explicitly launched afterward. The GitHub-to-Gitee fallback increases the number of remote trust sources. A compromise of either repository, its maintainer account, a referenced dependency, or a package registry can alter the executed p ...[truncated 1226 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: references/ac-agent-guide/SKILL.md:75

Finding

Sub-Agent Instructions Explicitly Discard Prior Session Context

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: install.sh:64

Finding

Backend Service Is Bound to All Network Interfaces by Default

Content

View full analysis

/tmp/autocraft_backend.log 2>&1 & BACKEND_PID=$! ``` The manual installation instructions repeat the same binding: ```bash python3 -m uvicorn main:app --host 0.0.0.0 --port 9001 ``` ### Technical Analysis Binding Uvicorn to `0.0.0.0` exposes the backend on every available IPv4 network interface. This conflicts with the documentation's presentation of the service as a localhost application. The package does not establish authentication, TLS, firewall restrictions, or a trusted reverse proxy before exposing the port. The security properties of the externally downloaded backend cannot be established from this repository, so exposing it beyond loopback is not the minimum privilege necessary for local AutoCraft operation. ### Attack Path 1. A user runs the installer on a workstation, shared server, development VM, or cloud host. 2. Uvicorn begins listening on port 9001 across all network interfaces. 3. A local-network or internet peer reaches the host, depending on firewall and routing configuration. 4. The peer enumerates the API documentation or invokes exposed endpoints. 5. Any missing authentication, weak authorization, or backend vulnerability can then be exploited remotely. ### Impact Assessment The immediate impact is unauthorized network reachability to the AutoCraft backend. The final scope depends on the downloaded application's endpoint security and the host firewall. Potential consequences include disclosure or modification of project/task data, triggering agent executions, access to execution logs, denial of service, or exploitation of backend implementation flaws. This finding does not prove ...[truncated 127 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/ac-agent-guide/shared-rules.md:132

Finding

Unpinned npx Commands May Download and Execute Packages at Runtime

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (166)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 375)May include surrounding context.

md

**Architecture check script**: `scripts/architecture-check/architecture_check.py`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 383)May include surrounding context.

md

**Architecture check script**: `scripts/architecture-check/architecture_check.py`

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/ac-agent-guide/shared-rules.md (reported line 26)May include surrounding context.

bash

# 查询任务完整信息
curl -s http://localhost:9001/api/v2/tasks/{task_id}/status | python3 -m json.tool

# 只查看关键字段
curl -s http://localhost:9001/api/v2/tasks/{task_id}/status | python3 -c "

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/ac-agent-guide/shared-rules.md (reported line 29)May include surrounding context.

bash

# 查询任务完整信息
curl -s http://localhost:9001/api/v2/tasks/{task_id}/status | python3 -m json.tool

# 只查看关键字段
curl -s http://localhost:9001/api/v2/tasks/{task_id}/status | python3 -c "

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/design-specs/doc-specs/03-系统功能设计文档规范.md (reported line 468)May include surrounding context.

md

| F-002 | GET /api/questions | 查询题目列表 |
| F-003 | GET /api/questions/{id} | 查询题目详情 |
| F-004 | PUT /api/questions/{id} | 更新题目 |
| F-005 | DELETE /api/questions/{id} | 删除题目 |

### 6.3 系统功能 → 数据库表

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The example initialization script includes a clear_all_tables(conn) operation without a strong destructive-operation warning, safeguard, or environment verification. This is dangerous because such sample code is likely to be copied directly into automation, where a configuration mistake could wipe real or shared data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented initialization script defaults to backend-dev/tasks.db while claiming to initialize an L2 test database, and it explicitly deletes all rows from application tables before reseeding data. In a testing/automation skill, this is dangerous because users or agents may copy the example verbatim and run destructive operations against a development database, causing data loss and contaminating non-test environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The one-click install flow instructs users to run a shell script that downloads code, installs dependencies, and starts services, but it does not foreground that this will make network calls and modify the local machine. In a skill context, such under-disclosure is risky because users may execute the installer without understanding that it changes system state and pulls unreviewed remote content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The 'Your Role' section frames the actor as a project manager who should avoid direct operational actions, especially direct system manipulation. Later instructions explicitly direct the main agent to issue POST requests that mutate AutoCraft system state, which contradicts the earlier intent framing even if the mutation occurs via API rather than database.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

| Clarify requirements, choose solutions | Write specific code |
| Review and approve documents | Directly operate database |
| Break down and schedule tasks | Trust agent's "completed" |
| Verify deliverables | Skip verification steps |

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

bash

# 1. Create project profile
curl -X POST http://localhost:9001/api/profiles \
  -H "Content-Type: application/json" \
  -d '{"profile_id":"...", "profile_name":"...", ...}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The service-management section includes sudo systemctl commands without a clear warning that they require elevated privileges and will alter running system services. Encouraging privilege-requiring commands in a skill without prominent caution increases the chance of unsafe execution and unintended service disruption.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The documented use of sudo systemctl restart directs users toward privileged execution that can change system-wide service state. In a skill, presenting root-level operational commands without strong guardrails is dangerous because it normalizes elevated execution and may disrupt systems or be misused in less controlled environments.

Content

Scanner excerpt · SKILL.md (reported line 324)May include surrounding context.

Service Management:

bash

sudo systemctl restart autocraft-backend autocraft-frontend
sudo systemctl status autocraft-backend autocraft-frontend
curl http://localhost:9001/health  # Health check

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Even though systemctl status is less destructive than restart, invoking it with sudo still normalizes unnecessary privileged execution and may expose service metadata under elevated context. In combination with the surrounding admin workflow, it contributes to a pattern of under-scoped privilege use.

Content

Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.

Service Management:

bash

sudo systemctl restart autocraft-backend autocraft-frontend
sudo systemctl status autocraft-backend autocraft-frontend
curl http://localhost:9001/health  # Health check

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstrings, report labels, status messages, and user-facing print output are all written in Chinese, which imposes a specific language on users. There is no opt-in, fallback, or explanation that this skill is intended only for a Chinese-language environment or region-specific use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This Python example presents its title and descriptive text only in Chinese, and the rest of the user-facing output throughout the file follows the same pattern, with no opt-in or alternative locale indicated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script installs Python and Node dependencies and creates a virtual environment without any upfront warning, dry-run, or confirmation prompt. Because package installation executes code from dependency ecosystems and writes persistently to disk, running this non-interactively increases the chance a user will unknowingly make system changes or trigger unreviewed install scripts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Using nohup to launch the backend creates session-persistent execution outside the invoking shell. Combined with --host 0.0.0.0, this makes the service reachable on all network interfaces and can unintentionally leave an externally accessible process running after installation.

Content

Scanner excerpt · install.sh (reported line 68)May include surrounding context.

sh

echo "Starting backend service (port 9001)..."
cd backend
source venv/bin/activate
nohup python3 -m uvicorn main:app --host 0.0.0.0 --port 9001 > /tmp/autocraft_backend.log 2>&1 &
BACKEND_PID=$!
deactivate
cd ..

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script starts backend and frontend services in the background with nohup and no confirmation, causing processes to persist after the terminal session ends. This is risky because it exposes services on local/network ports and leaves long-running software active without ensuring the user intended to launch persistent services.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

Using nohup to launch the frontend makes the process survive the user session and continue consuming resources until manually terminated. Even if intended for convenience, this persistence without explicit consent can surprise users and increase attack surface if the dev server exposes debugging features or serves content on a reachable port.

Content

Scanner excerpt · install.sh (reported line 79)May include surrounding context.

sh

# Start frontend
echo "Starting frontend service (port 8080)..."
nohup npm run dev > /tmp/autocraft_frontend.log 2>&1 &
FRONTEND_PID=$!
echo -e "${GREEN}✓ Frontend service started (PID: $FRONTEND_PID)${NC}"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documentation is written entirely in Chinese and presents the operational guidance as mandatory, with no indication that users or operators can choose another language. This can violate language or locale policy when a skill imposes a specific language without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to write artifacts into the project directory and a fixed /tmp path, creating filesystem side effects without any requirement for user confirmation, sandbox checks, or path restrictions. In an agent setting, this can lead to unintended file creation or overwriting, especially if task inputs or deliverable paths are influenced by external instructions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions and examples are entirely in Chinese and do not indicate that the user can choose another language or locale. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly documented as a justified locale-specific skill.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/ac-agent-guide/executor-guide.md (reported line 38)May include surrounding context.

md

| 场景 | 读取skill | 路径 |
|------|----------|------|
| Vue3开发 | Vue | `~/.openclaw/workspace/skills/vue/SKILL.md` |
| Element Plus组件 | element-plus-vue3 | `~/.agents/skills/element-plus-vue3/SKILL.md` |

### BUILD-TEST（测试生成）

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/ac-agent-guide/executor-guide.md (reported line 39)May include surrounding context.

md

| 场景 | 读取skill | 路径 |
|------|----------|------|
| Vue3开发 | Vue | `~/.openclaw/workspace/skills/vue/SKILL.md` |
| Element Plus组件 | element-plus-vue3 | `~/.agents/skills/element-plus-vue3/SKILL.md` |

### BUILD-TEST（测试生成）