T09 · Insecure Skill Coding Practices
Error
- Location
scripts/selfie.js:69- Finding
Shell Command Injection Through Configurable Scene Prompts
- Content
View full analysis
- Remediation
View remediation
Security audit
Cat Selfie
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly does what it says, but its configurable prompts can be executed through a shell, creating a real local command-injection risk.
Review this skill before installing. Do not use custom scene prompts from untrusted sources unless the shell invocation is fixed to use argument-array execution such as execFileSync or spawnSync. If you enable heartbeat sending, add explicit confirmation or rate limits and make sure the shared images directory cannot cause unintended images to be sent.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/selfie.js:81- Finding
Untrusted Image Selection From a Shared Output Directory
- Content
View full analysis
f.endsWith('.png') || f.endsWith('.jpg')) .map(f => ({ name: f, path: path.join(OUTPUT_DIR, f), mtime: fs.statSync(path.join(OUTPUT_DIR, f)).mtime })) .sort((a, b) => b.mtime - a.mtime); if (files.length === 0) { return { success: false, message: '❌ 图片生成失败，未找到生成的文件' }; } const latestImage = files[0]; console.log(`✅ 自拍生成成功！`); console.log(`📁 保存位置：${latestImage.path}`); ``` ### Technical Analysis The Skill does not obtain or verify the exact output path produced by the current image-generation process. After the subprocess exits, it scans a shared directory and assumes that the file with the newest modification timestamp is the result of the current request. That assumption is unsafe when another process or concurrent Skill invocation can write to `~/.openclaw/workspace/images`. A different PNG or JPG can become the newest entry between generation and directory scanning. The code performs no request correlation, filename validation, creation-time boundary check, ownership verification, or content verification. Because the documented workflow recommends sending the returned image through a messaging tool, selecting an unrelated image can cross a trust boundary and cause unintended content to be transmitted. ### Attack Path 1. The attacker or another concurrent process has write access to the shared images directory. 2. A legitimate user starts selfie generation. 3. During or immediately after image generation, the other process creates or updates a PNG or JPG in that directory. 4. The injected or unrelated file receives the newest modification timestamp. 5. The Skill sorts all matching files by modifica ...[truncated 842 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill description, instructions, examples, and output documentation are entirely in Chinese, which imposes a specific language on users. The file does not offer an alternative language, opt-in, or explain that the skill is intentionally region- or language-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation instructs integrating the skill into a heartbeat mechanism that automatically generates images and then sends them via a messaging tool, but it does not clearly warn users that this triggers external network calls to a third-party image API and may transmit generated content onward. In an agent/automation context, silent external API use and auto-sending behavior can surprise operators, create privacy/compliance issues, and enable unintended data egress or cost-incurring actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This JSON manifest contains multiple user-facing natural-language fields such as scene names, prompts, and a note, all exclusively in Chinese. Under the policy, forcing a specific language without offering choice or documenting a justified locale constraint is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file's user-facing description and operational messaging are written entirely in Chinese, indicating a fixed language choice with no sign of user selection or opt-in. The stated policy for this audit flags language or locale constraints when the skill forces a specific language without offering choice.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script builds a shell command string and executes it with execSync, passing prompt text derived from a JSON config into the command line. Because shell metacharacters inside the prompt can break out of the quoted argument, a modified or malicious scenes.json entry could trigger arbitrary command execution under the current user account.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language instructions and usage guidance are entirely in Chinese, which can impose a fixed language/locale on users without opt-in. The file does not mention that the skill is intended only for Chinese-speaking users or provide an alternative language option.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language description is entirely in Chinese and presents the skill as Chinese-only, with no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. This can violate organizational language/locale policy when skills are expected to avoid forcing a specific language without opt-in.
- Content