ClawHub
Back to skill

Security audit

SIGNL4 Alerting

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for SIGNL4 alerts, but its command templates handle user-provided alert text and the team secret in ways that need review before use.

Review this before installing. Use it only with a trusted SIGNL4 team secret, keep SIGNL4_WEBHOOK_BASE fixed to the official endpoint unless you deliberately use a trusted proxy, and avoid running the provided curl templates with unsanitized user text. A safer version should build JSON with a serializer such as jq and validate the webhook host before attaching the secret.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:48
Finding

Shell Command Injection Through Unescaped Alert Fields

Content
View full analysis
", "Message": "", "X-S4-ExternalID": "", "X-S4-Status": "new", "X-S4-Service": "", "X-S4-AlertingScenario": "", "X-S4-Location": "", "X-S4-SourceSystem": "OpenClaw" }' ``` ### Technical Analysis The skill instructs the agent to insert user-controlled alert fields directly into a single-quoted shell argument. It does not require JSON serialization, shell escaping, or passing values separately from executable shell syntax. A single quote in any substituted value can terminate the `-d` argument. Subsequent shell metacharacters can then introduce a new command. This affects the title, message, external ID, service, alerting scenario, and location fields. For example, if direct textual substitution is used, a field shaped like the following can escape the quoted JSON and introduce a separate command: ```text '; id > /tmp/signl4-proof; # ``` Ordinary input containing quotes, backslashes, or line breaks can also produce malformed JSON even when it is not intentionally malicious. ### Attack Path 1. An attacker supplies a crafted title, message, external ID, or optional alert field. 2. The agent substitutes that value into the documented `curl` command. 3. The attacker-supplied single quote terminates the shell's quoted JSON argument. 4. Shell separators introduce an additional command, while a comment marker suppresses the remaining template. 5. The agent invokes the generated command through a shell. 6. The injected command executes with the same o ...[truncated 697 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:48
Finding

SIGNL4 Team Secret Can Be Disclosed to an Arbitrary Configurable Host

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

Send the alert:

sh
curl -sS -X POST "$WEBHOOK_URL" \
  -H "Content-Type: application/json" \
  -d '{
    "Title": "<TITLE>",

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The markdown explains that the skill sends and resolves SIGNL4 alerts using an inbound webhook, but it does not warn users that alert contents, external IDs, and optional metadata such as location will be sent to a third-party service. For a skill that affects privacy and external system state, a brief disclosure in the README is expected under the warning criteria for markdown files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The configuration section tells users to export SIGNL4_TEAM_SECRET, which is clearly a credential, but does not include any caution about handling it securely or avoiding exposure in shells, logs, or shared environments. This qualifies as a missing user warning in markdown because the documented behavior involves sensitive authentication material.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.