T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mqtt-client.js:239- Finding
TLS Certificate Verification Is Disabled by Default
- Content
View full analysis
- Remediation
View remediation
Security audit
Mqtt Client
Security checks for vulnerabilities and agentic risk
Overview
This MQTT automation skill is mostly coherent, but it needs review because it can handle credentials and persistent configuration in ways that may silently weaken or redirect secure connections.
Review before installing. Use only least-privilege MQTT accounts, avoid the `#` wildcard except on trusted scoped brokers, do not run it from untrusted project directories, secure `~/.openclaw/openclaw.json` permissions, and prefer a pinned dependency plus a fix for TLS certificate verification before using it with real credentials.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mqtt-client.js:135- Finding
Untrusted Working-Directory Configuration Can Redirect MQTT Credentials
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:18- Finding
Runtime Dependency Is Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mqtt-client.js:1248- Finding
Module Import Mutates User Configuration and May Create a Plaintext Credential File with Permissive Permissions
- Content
View full analysis
{}); } ``` The generated structure contains a field intended to store a password: ```javascript const template = { enabled: true, env: { MQTT_BROKER: 'localhost', MQTT_BROKER_PORT: '1883', MQTT_USERNAME: '', MQTT_PASSWORD: '', MQTT_CLIENT_ID: '', MQTT_PROTOCOL_VERSION: '4', MQTT_SUBSCRIBE_TOPIC: '#' } }; ``` ### Technical Analysis Importing the library automatically invokes `autoSetupConfig()`, which writes to `~/.openclaw/openclaw.json`. Importing a library is normally expected to initialize code, not modify persistent user configuration. The directory and file are created without explicit ...[truncated 1693 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (12)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md const { MqttClient } = require('./scripts/mqtt-client.js');
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md const { MqttClient } = require('./scripts/mqtt-client.js');
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
// Last message const last = client.getLastMessage('home/sensors/#');
// Clear history client.clearHistory();
text
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documented default subscription topic of
#subscribes to all topics on the broker, which can expose the client to far more data and trigger activity than intended. In an automation skill, this broad scope increases the chance of unintended message processing, trigger activation, privacy exposure, and operational side effects if the client is connected to a shared or production broker.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The README documents a broad default subscription topic and states that configuration is auto-written to
~/.openclaw/openclaw.json, but it does not clearly warn users about the resulting data access and local persistence implications. In this skill context, users may unknowingly grant the client visibility into all broker messages and persist sensitive connection details or behavior-affecting configuration without understanding the security impact.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill defaults
MQTT_SUBSCRIBE_TOPICto#, which subscribes to all broker topics, but the documentation does not clearly warn that this can expose sensitive messages, device states, credentials accidentally published to MQTT, or cross-tenant/internal automation data. In an MQTT integration skill, this context makes the omission more dangerous because broad topic capture is a primary data-ingestion path and can unintentionally create large-scale privacy and security exposure.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This MQTT client module includes side effects unrelated to its core purpose: importing the library can create or modify the user's OpenClaw configuration file. Hidden filesystem mutation during import violates least surprise and can be abused in automation contexts to persist configuration changes or alter later tool behavior without explicit operator consent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Automatically writing ~/.openclaw/openclaw.json from a generic client library is unsafe because consumers may import the module only to access MQTT functionality, not to change host configuration. This creates an unexpected persistence mechanism and can overwrite trust assumptions about local configuration state, especially in shared or agent-managed environments.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Writing a configuration file into the home directory without prior disclosure or confirmation introduces unauthorized persistent state changes. Even though the written values are template defaults, the act itself can interfere with existing workflows, create misleading trusted configuration, or be leveraged by higher-level automation that assumes user-approved config files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Executing auto-setup on import means merely requiring the module can trigger configuration file creation in the user's home directory without a clear warning. In agent or plugin ecosystems, such non-transparent side effects are dangerous because they can change persistent state during analysis, testing, or dependency loading.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The documentation says the auto-setup function 'creates or extends' the mqtt-client config and is 'automatically called when importing the module.' In practice, when an entry already exists but is missing fields, the function mutates the in-memory object yet only writes to disk if the config is new or forceSetup is true, so the documented 'extends' behavior does not reliably occur persistently.
- Content