Sovereign project-setup-wizard

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:03 PM UTC
• Version: 1.0.0

Overview

This is a coherent project scaffolding skill, but it needs review because its file-writing scope is not well contained or safely validated.

Install only if you are comfortable with a scaffolder that writes a new project tree and may create an initial git commit by default. Use dry-run first, choose a trusted output directory, avoid untrusted project names or metadata, and review generated CI files before running them because they reference third-party actions and tools.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:654

Finding

Generated CI Workflows Execute Mutable Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

``` 2. Replace `dtolnay/rust-toolchain@master` with an immutable reviewed commit. 3. Replace `version: latest` and Go's `@latest` with explicit, tested versions. 4. Pin CircleCI orbs to exact versions and consider using organization policies to restrict permitted orbs. 5. Use automated dependency-update tooling to propose reviewed upgrades rather than silently tracking mutable references. 6. Apply least-privilege CI permissions explicitly, for example: ```yaml permissions: contents: read ``` 7. Separate jobs that need secrets from jobs that execute third-party actions. 8. Make Codecov integration optional, clearly disclose that coverage data is sent to Codecov, and pin the Codecov action to a reviewed commit SHA. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:59

Finding

Unvalidated Input Permits Path Traversal and Unsafe Generated Configuration Injection

Content

View full analysis

&2; exit 1 ;; esac done ``` The file-writing helper trusts the resulting path: ```bash create_file() { local filepath="$1" local content="$2" if [[ "$DRY_RUN" == "true" ]]; then echo " [FILE] $filepath" else local dir dir=$(dirname "$filepath") mkdir -p "$dir" echo "$content" > "$filepath" echo " Created: $filepath" fi FILES_CREATED=$((FILES_CREATED + 1)) } ``` Validation checks only that the project name is non-empty and that the language is supported: ```bash if [[ -z "$PROJECT_NAME" ]]; then echo "Error: Project name is required." >&2 exit 1 fi if [[ -z "$LANGUAGE" ]]; then echo "Error: ...[truncated 4451 chars]

Remediation

View remediation

&2 exit 1 fi ``` 2. Explicitly reject `/`, `\`, empty path components, `.` and `..` in project names. 3. Canonicalize both the selected output directory and destination path using `realpath` or an equivalent mechanism. 4. Verify that the canonical destination remains beneath the canonical output directory before creating any files. 5. Consider requiring `OUTPUT_DIR` to be within an Agent-approved workspace rather than accepting arbitrary filesystem paths. 6. Validate names separately for npm packages, Python modules, Go module paths, and Rust crates instead of applying one name to every ecosystem. 7. Generate JSON, TOML, and YAML through format-aware serializers rather than shell string interpolation. 8. Escape all user-controlled values according to their destination context, including source-language string literals and Markdown. 9. Validate author email and module-path components before using them in generated package metadata. 10. Add adversarial tests covering traversal strings, absolute paths, quotes, backslashes, multiline input, and format-specific delimiters. 11. Preserve the current least-privilege model: do not request elevated privileges, and ensure all writes remain confined to the approved project workspace. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.

md

- Node.js: node_modules, dist, .env, coverage, .nyc_output
- Python: __pycache__, .venv, dist, *.egg-info, .mypy_cache
- Go: binary outputs, vendor (optional), .env
- Rust: target/, Cargo.lock (for libraries), .env

All .gitignore files also include:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

md

- Node.js: node_modules, dist, .env, coverage, .nyc_output
- Python: __pycache__, .venv, dist, *.egg-info, .mypy_cache
- Go: binary outputs, vendor (optional), .env
- Rust: target/, Cargo.lock (for libraries), .env

All .gitignore files also include:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 542)May include surrounding context.

sh

- Node.js: node_modules, dist, .env, coverage, .nyc_output
- Python: __pycache__, .venv, dist, *.egg-info, .mypy_cache
- Go: binary outputs, vendor (optional), .env
- Rust: target/, Cargo.lock (for libraries), .env

All .gitignore files also include:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 624)May include surrounding context.

sh

- Node.js: node_modules, dist, .env, coverage, .nyc_output
- Python: __pycache__, .venv, dist, *.egg-info, .mypy_cache
- Go: binary outputs, vendor (optional), .env
- Rust: target/, Cargo.lock (for libraries), .env

All .gitignore files also include:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 1192)May include surrounding context.

sh

- Node.js: node_modules, dist, .env, coverage, .nyc_output
- Python: __pycache__, .venv, dist, *.egg-info, .mypy_cache
- Go: binary outputs, vendor (optional), .env
- Rust: target/, Cargo.lock (for libraries), .env

All .gitignore files also include:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 543)May include surrounding context.

sh

# Environment
.env
.env.local
.env.*.local

# Logs

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/setup.sh (reported line 1153)May include surrounding context.

sh

# Cache dependencies
RUN mkdir src && echo "fn main() {}" > src/main.rs
RUN cargo build --release
RUN rm src/main.rs

COPY . .
RUN touch src/main.rs && cargo build --release

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/setup.sh (reported line 1492)May include surrounding context.

sh

golangci-lint run

clean:
	rm -rf bin/ coverage.out
"

    # golangci-lint config

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

1. Copy the skill into your OpenClaw skills directory:

bash

mkdir -p ~/.openclaw/skills/
cp -r project-setup-wizard/ ~/.openclaw/skills/

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · scripts/setup.sh (reported line 1112)May include surrounding context.

sh

EXPOSE 8000

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \\
  CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')" || exit 1

CMD ["python", "-m", "src.$(to_python_module "$PROJECT_NAME").main"]
EOF

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are generic terms like 'setup project', 'create project', 'scaffold', and 'new project', which are likely to overlap with normal user requests and can cause the skill to activate unexpectedly. Because the skill entry point is a shell script and the tool can generate files, Docker, and CI/CD artifacts, unintended activation could lead to unwanted filesystem changes or execution of setup logic in situations where the user did not explicitly intend to run this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file describes a scaffolding tool that writes project files and, by default, initializes a git repository, but the usage section presents these actions as normal options without an explicit user warning about filesystem changes. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that affect user data or system state.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/setup.sh (reported line 217)May include surrounding context.

sh

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/setup.sh (reported line 1162)May include surrounding context.

sh

FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && \
    rm -rf /var/lib/apt/lists/* && \
    groupadd -r appgroup && useradd -r -g appgroup appuser

COPY --from=builder /app/target/release/${PROJECT_NAME} /usr/local/bin/app

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/setup.sh (reported line 1162)May include surrounding context.

sh

FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && \
    rm -rf /var/lib/apt/lists/* && \
    groupadd -r appgroup && useradd -r -g appgroup appuser

COPY --from=builder /app/target/release/${PROJECT_NAME} /usr/local/bin/app

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This shell script creates directories and writes many files into the target project path, which is a safety-relevant filesystem modification. Although individual file creations are printed, the script does not include a clear upfront warning or confirmation that running it will scaffold a new project tree and overwrite nothing only if the directory is absent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The script runs git init, stages all generated files, and creates an initial commit, which is a subprocess action that changes repository state. While a completion message is printed afterward and interactive mode asks about git initialization, the non-interactive path and header/help text do not clearly warn that a commit will be created by default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.