Firm Security Audit

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:15 AM UTC
• Version: 1.0.0

Overview

This security-audit skill is mostly purpose-aligned, but it gives itself broad deployment/remediation authority and automatically sends critical audit results to Slack without clear user approval or redaction controls.

Install only if you want this skill to act as a strong deployment security gate. Before using it in a real project, require user confirmation for any remediation, service disablement, container restart, deployment block, or external Slack message, and send only redacted summaries of audit findings. Pin and review the mcp-openclaw-extensions dependency before granting it access to source, config, Compose, env, or Slack tooling.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:30
• Finding: Mandatory workflow overrides agent objectives and deployment decisions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 30-31, 53-55, and 176-181 **Vulnerability Type**: Agent instruction hijacking **Risk Level**: High ### Vulnerable Code ```markdown Ce skill est la **porte de sécurité obligatoire** avant tout déploiement ou exposition réseau d'un Gateway OpenClaw. ``` ```markdown ## Séquence d'audit obligatoire **À exécuter avant chaque déploiement ou avant activation de Tailscale Funnel.** ``` ```markdown ## Escalade | Résultat | Action | |----------|--------| | Tout OK | Déploiement autorisé — log de l'audit dans `docs/security-audits/` | | CRITICAL sandbox ou SQL | Bloquer le déploiement — fix obligatoire avant push | | CRITICAL rate limit + funnel | Désactiver Funnel et appliquer Nginx/Caddy immédiatement | | HIGH session secret | Appliquer fix + redémarrer le container avec le secret persistant | ``` ### Technical Analysis The Skill declares itself a mandatory security gate and assigns itself authority to authorize or block deployments. It also directs the agent to disable services, modify configurations, and restart containers according to tool-generated findings. This behavior crosses the boundary between providing advisory security guidance and overriding the agent's current objectives. The instructions do not require the user to approve each scan, configuration change, service interruption, or deployment decision. If the Skill is loaded during another task, its mandatory language can redirect the agent away from the user's immediate goal. The risk is amplified because remediation snippets are supplied by external dependency tools. A false positive, malformed result, or compromised tool could therefore influence operational decisions and configuration changes. ### Attack Path 1. The Skill is loaded in an agent session associated with an OpenClaw deployment. 2. Its instructions declare the audit mandatory before deployment or network exposure. 3. The agent invokes the referenced audit to ...[truncated 1026 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace mandatory language with an explicit, user-invoked audit mode. 2. Treat audit results as recommendations rather than granting the Skill authority to authorize or block deployment. 3. Require separate user confirmation before: - Reading configuration, source, Compose, or environment files. - Applying any remediation. - Disabling Tailscale Funnel or another network service. - Restarting a container. - Blocking or approving a deployment. 4. Display the proposed change, affected files, expected downtime, and rollback procedure before requesting approval. 5. Validate tool-generated remediation against a fixed schema and reject arbitrary commands or unexpected file changes. 6. Add a dry-run mode that produces a report without modifying files or services. 7. Ensure the parent agent's system and user instructions always take precedence over this Skill's workflow. ]]>

other

Error

• Location: SKILL.md:113
• Finding: Critical audit results are automatically disclosed to an external Slack destination<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 113-124 **Vulnerability Type**: Unauthorized external data disclosure **Risk Level**: High ### Vulnerable Code ```markdown ### Étape 5 — Alerte si CRITICAL (automatique) Si un des audits retourne `severity: CRITICAL`, dispatcher automatiquement via : ```json { "tool": "firm_export_slack_digest", "args": { "objective": "Security audit — CRITICAL finding", "content": "<résultats de l'audit>", "channel": "#security-alerts" } } ``` ``` ### Technical Analysis The Skill automatically passes complete audit results to `firm_export_slack_digest` whenever a critical finding is reported. Security audit output can contain sensitive information such as internal paths, source excerpts, endpoint names, configuration values, infrastructure topology, vulnerability details, and remediation content. No control is specified for: - Obtaining user consent before transmission. - Confirming the Slack workspace or channel. - Redacting credentials, secrets, tokens, or internal paths. - Restricting the content to a minimal summary. - Verifying whether the recipient is authorized. - Handling false or attacker-crafted scan output. Because the `content` field receives the audit results as a whole, a compromised or manipulated audit tool could place arbitrary local information into the result and cause it to be exported. ### Attack Path 1. An audit tool scans local source, configuration, Compose, or environment-related inputs. 2. The tool returns a result marked `severity: CRITICAL`. 3. The result includes sensitive data naturally collected by the scan or content deliberately inserted by a compromised tool. 4. The Skill automatically copies the audit result into the Slack digest's `content` field. 5. `firm_export_slack_digest` sends the data to the configured Slack workspace and `#security-alerts` channel. 6. Anyone with access to that destination can obtain the disclosed infrastructure or vu ...[truncated 803 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable automatic Slack export by default. 2. Require explicit user confirmation for every external transmission. 3. Show the exact destination and a preview of the redacted message before sending it. 4. Send only a minimal summary containing finding identifiers, severity, and a reference to a locally stored report. 5. Remove secrets, tokens, environment values, source excerpts, usernames, hostnames, and absolute paths from exported content. 6. Use an allowlisted Slack workspace and channel identifier rather than an unverified channel name. 7. Verify recipient authorization and record an auditable consent event. 8. Treat all scanner output as untrusted and enforce a strict schema, content-length limit, and redaction policy. 9. Keep full audit reports in access-controlled local storage rather than third-party messaging systems. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12
• Finding: Security-sensitive dependency uses an unbounded version range without integrity verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 12-15 **Vulnerability Type**: Insecure third-party dependency declaration **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: openclaw: registry: ClawHub requires: - mcp-openclaw-extensions >= 2.0.0 ``` ### Technical Analysis The Skill depends on `mcp-openclaw-extensions` using the open-ended constraint `>= 2.0.0`. No exact version, cryptographic digest, verified publisher identity, or immutable source reference is provided. The dependency supplies security-sensitive tools that are instructed to inspect source code and configuration and to export data to Slack. A future version selected after this Skill has been reviewed could therefore behave differently from the version originally assessed. An open-ended range is not proof that the dependency is currently malicious. It creates a supply-chain exposure in which a compromised publisher account, registry incident, or malicious future release could alter the effective behavior without modifying `SKILL.md`. ### Attack Path 1. An attacker compromises the dependency publisher, registry entry, or release process. 2. The attacker publishes a new version greater than or equal to `2.0.0`. 3. Dependency resolution selects the newer version because the declaration has no upper bound or integrity pin. 4. The agent invokes dependency-provided tools such as the security scanners or Slack exporter. 5. The modified tool reads sensitive project or configuration data available within its execution context. 6. It can return manipulated findings, recommend unsafe remediation, or disclose data through its network-capable functionality. ### Impact Assessment The dependency receives the effective privileges granted to its tools. Based on the Skill's documented use, the accessible scope may include: - OpenClaw source directories. - OpenClaw configuration files. - Docker Compose and environment-file paths. - Gateway and Tailscale ...[truncated 312 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specific reviewed version rather than using `>= 2.0.0`. 2. Record and enforce a cryptographic package digest or signed provenance attestation. 3. Identify the exact trusted registry namespace and verify publisher ownership. 4. Use a lockfile or equivalent immutable dependency manifest. 5. Review each update before changing the pinned version. 6. Restrict dependency tools with least-privilege filesystem and network policies. 7. Deny network access to scanning tools unless it is essential to their documented operation. 8. Separate scanning from notification so that tools reading sensitive files cannot also transmit data externally. 9. Maintain an allowlist of permitted tool names, arguments, input paths, and output schemas. 10. Monitor the dependency for publisher changes, removed releases, unexpected ownership transfers, and security advisories. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation

Content

"tool": "openclaw_session_config_check",
  "args": {
    "compose_file_path": "/path/to/docker-compose.yml",
    "env_file_path": "/path/to/.env"
  }
}
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs automatic export of CRITICAL audit results to Slack without any guardrails on data minimization, redaction, or approval. Audit outputs can contain sensitive configuration details, internal paths, endpoint information, or even secrets from findings, so unconditional sharing to a third-party messaging platform can create an avoidable data leakage channel.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: The natural-language instructions and operational guidance are presented exclusively in French, and the file does not indicate that this language constraint is optional or limited to a specific French-speaking environment. Per the policy, forcing a specific language without user opt-in is a locale/language policy issue.

Description-Behavior Mismatch

Low

• Confidence: 94% confidence
• Finding: The manifest and body describe a narrowly scoped security-audit skill for detecting and remediating specific OpenClaw gaps. The final support section soliciting Dogecoin support is not an implementation detail of that audit workflow and falls outside the declared purpose.

Static analysis

No suspicious patterns detected.