T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:30- Finding
Mandatory workflow overrides agent objectives and deployment decisions
- Content
View full analysis
- Remediation
View remediation
Security audit
Firm Security Audit
Security checks for vulnerabilities and agentic risk
Overview
This security-audit skill is mostly purpose-aligned, but it gives itself broad deployment/remediation authority and automatically sends critical audit results to Slack without clear user approval or redaction controls.
Install only if you want this skill to act as a strong deployment security gate. Before using it in a real project, require user confirmation for any remediation, service disablement, container restart, deployment block, or external Slack message, and send only redacted summaries of audit findings. Pin and review the mcp-openclaw-extensions dependency before granting it access to source, config, Compose, env, or Slack tooling.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
other
Error
- Location
SKILL.md:113- Finding
Critical audit results are automatically disclosed to an external Slack destination
- Content
View full analysis
", "channel": "#security-alerts" } } ``` ``` ### Technical Analysis The Skill automatically passes complete audit results to `firm_export_slack_digest` whenever a critical finding is reported. Security audit output can contain sensitive information such as internal paths, source excerpts, endpoint names, configuration values, infrastructure topology, vulnerability details, and remediation content. No control is specified for: - Obtaining user consent before transmission. - Confirming the Slack workspace or channel. - Redacting credentials, secrets, tokens, or internal paths. - Restricting the content to a minimal summary. - Verifying whether the recipient is authorized. - Handling false or attacker-crafted scan output. Because the `content` field receives the audit results as a whole, a compromised or manipulated audit tool could place arbitrary local information into the result and cause it to be exported. ### Attack Path 1. An audit tool scans local source, configuration, Compose, or environment-related inputs. 2. The tool returns a result marked `severity: CRITICAL`. 3. The result includes sensitive data naturally collected by the scan or content deliberately inserted by a compromised tool. 4. The Skill automatically copies the audit result into the Slack digest's `content` field. 5. `firm_export_slack_digest` sends the data to the configured Slack workspace and `#security-alerts` channel. 6. Anyone with access to that destination can obtain the disclosed infrastructure or vu ...[truncated 803 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:12- Finding
Security-sensitive dependency uses an unbounded version range without integrity verification
- Content
View full analysis
= 2.0.0 ``` ### Technical Analysis The Skill depends on `mcp-openclaw-extensions` using the open-ended constraint `>= 2.0.0`. No exact version, cryptographic digest, verified publisher identity, or immutable source reference is provided. The dependency supplies security-sensitive tools that are instructed to inspect source code and configuration and to export data to Slack. A future version selected after this Skill has been reviewed could therefore behave differently from the version originally assessed. An open-ended range is not proof that the dependency is currently malicious. It creates a supply-chain exposure in which a compromised publisher account, registry incident, or malicious future release could alter the effective behavior without modifying `SKILL.md`. ### Attack Path 1. An attacker compromises the dependency publisher, registry entry, or release process. 2. The attacker publishes a new version greater than or equal to `2.0.0`. 3. Dependency resolution selects the newer version because the declaration has no upper bound or integrity pin. 4. The agent invokes dependency-provided tools such as the security scanners or Slack exporter. 5. The modified tool reads sensitive project or configuration data available within its execution context. 6. It can return manipulated findings, recommend unsafe remediation, or disclose data through its network-capable functionality. ### Impact Assessment The dependency receives the effective privileges granted to its tools. Based on the Skill's documented use, the accessible scope may include: - OpenClaw source directories. - OpenClaw configuration files. - Docker Compose and environment-file paths. - Gateway and Tailscale ...[truncated 312 chars]- Remediation
View remediation
= 2.0.0`. 2. Record and enforce a cryptographic package digest or signed provenance attestation. 3. Identify the exact trusted registry namespace and verify publisher ownership. 4. Use a lockfile or equivalent immutable dependency manifest. 5. Review each update before changing the pinned version. 6. Restrict dependency tools with least-privilege filesystem and network policies. 7. Deny network access to scanning tools unless it is essential to their documented operation. 8. Separate scanning from notification so that tools reading sensitive files cannot also transmit data externally. 9. Maintain an allowlist of permitted tool names, arguments, input paths, and output schemas. 10. Monitor the dependency for publisher changes, removed releases, unexpected ownership transfers, and security advisories. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
"tool": "openclaw_session_config_check", "args": { "compose_file_path": "/path/to/docker-compose.yml", "env_file_path": "/path/to/.env" } }
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs automatic export of CRITICAL audit results to Slack without any guardrails on data minimization, redaction, or approval. Audit outputs can contain sensitive configuration details, internal paths, endpoint information, or even secrets from findings, so unconditional sharing to a third-party messaging platform can create an avoidable data leakage channel.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The natural-language instructions and operational guidance are presented exclusively in French, and the file does not indicate that this language constraint is optional or limited to a specific French-speaking environment. Per the policy, forcing a specific language without user opt-in is a locale/language policy issue.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest and body describe a narrowly scoped security-audit skill for detecting and remediating specific OpenClaw gaps. The final support section soliciting Dogecoin support is not an implementation detail of that audit workflow and falls outside the declared purpose.
- Content
Static analysis
No suspicious patterns detected.