T09 · Insecure Skill Coding Practices
Error
- Location
oref_native.py:30- Finding
Unsafe hardcoded external messaging and Home Assistant destinations
- Content
View full analysis
- Remediation
View remediation
Security audit
Red Alert (Israel)
Security checks for vulnerabilities and agentic risk
Overview
This emergency-alert skill is plausibly useful, but it asks for broad, persistent system access and credentials while contradicting its own OpenClaw-only claims.
Review carefully before installing. Use only in a test environment first, set all destinations explicitly, avoid entering broad Home Assistant tokens, inspect and remove any crontab entry after testing, and do not run the installer as root unless you have reviewed the Docker image and persistence behavior.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T06 · System Persistence
Warning
- Location
install.sh:28- Finding
Unconditional installation of reboot persistence
- Content
View full analysis
> $LOG_FILE 2>&1 &" (crontab -l 2>/dev/null | grep -v oref_native; echo "$CRON_CMD") | crontab - echo "✅ Added to crontab (auto-start on reboot)" ``` ### Technical Analysis The installer creates two persistent components without a separate opt-in decision: 1. The Docker proxy receives the `unless-stopped` restart policy. 2. The Python monitor is added to the current user's crontab with `@reboot`. Continuous operation is reasonably related to a real-time emergency alert monitor, and the persistence is disclosed in `README.md` and `SKILL.md`. It is therefore not covert persistence. However, installation is unconditional, uses two separate persistence mechanisms, and provides no uninstall procedure. This exceeds the minimum behavior needed for a one-time invocation and can surprise users who only intend to test the skill. The installer also immediately starts the monitor using `nohup`, so a failed or incomplete cleanup can leave both a current process and reboot persistence. ### Attack Path 1. The user runs `bash install.sh`. 2. Docker creates the proxy with an automatic restart policy. 3. The script starts `oref_native.py` in the background. 4. The installer rewrites the user's crontab and adds an `@reboot` command. 5. After a reboot, the Docker proxy and monitor resume without further user interaction. 6. The monitor continues ...[truncated 753 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
install.sh:45- Finding
Arbitrary command execution through unsafe environment-file sourcing
- Content
View full analysis
"$ENV_FILE" << EOF OREF_API_URL=http://localhost:49000/current OREF_POLL_INTERVAL=5 OREF_COOLDOWN=60 MONITORED_AREAS=$AREAS WHATSAPP_GROUP_JID=$WA_GROUP CX3_API=http://localhost:3000/api/outbound-call CX3_EXTENSION=$CX3_EXT CX3_ENABLED=$CX3_ENABLED HASS_SERVER=$HA_URL HASS_TOKEN=$HA_TOKEN HA_TTS_SPEAKER=media_player.home_assistant_voice_09a069_media_player EOF ``` ```bash source "$ENV_FILE" export $(cat "$ENV_FILE" | grep -v "^#" | xargs) ``` ### Technical Analysis Interactive values are written into `.env` without shell escaping or field validation. The installer later treats that data file as executable shell syntax by using `source`. An input containing command substitution, shell separators, redirections, or additional assignments is stored in `.env`. On the next `source "$ENV_FILE"` operation, the shell parses and executes that content. For example, a value containing `$(id)` or `$(arbitrary-command)` is evaluated when the file is sourced. The subsequent `export $(cat ... | xargs)` operation is also unsafe. It performs word splitting, destroys spaces in values such as monitored-area names, and treats generated words as shell arguments. Although `source` is the primary arbitrary-execution sink, the export pipeline further weakens configuration integrity. Exploitation requires control of an installer p ...[truncated 1292 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
install.sh:93- Finding
Home Assistant token and other configuration secrets copied into crontab
- Content
View full analysis
"$ENV_FILE" << EOF OREF_API_URL=http://localhost:49000/current OREF_POLL_INTERVAL=5 OREF_COOLDOWN=60 MONITORED_AREAS=$AREAS WHATSAPP_GROUP_JID=$WA_GROUP CX3_API=http://localhost:3000/api/outbound-call CX3_EXTENSION=$CX3_EXT CX3_ENABLED=$CX3_ENABLED HASS_SERVER=$HA_URL HASS_TOKEN=$HA_TOKEN HA_TTS_SPEAKER=media_player.home_assistant_voice_09a069_media_player EOF ``` ```bash ENV_EXPORTS=$(cat "$ENV_FILE" | grep -v "^#" | tr '\n' ' ') CRON_CMD="@reboot $ENV_EXPORTS python3 $SCRIPT_DIR/oref_native.py >> $LOG_FILE 2>&1 &" (crontab -l 2>/dev/null | grep -v oref_native; echo "$CRON_CMD") | crontab - ``` ### Technical Analysis The installer reads every non-comment line from `.env`, joins the contents into one string, and embeds the result directly into the cron command. Consequently, `HASS_TOKEN` and any other sensitive configuration are stored in plaintext within the crontab. When the cron job runs, these values may also appear as part of the shell command line, depending on the cron and process implementation. Command lines are commonly exposed through process-inspection and diagnostic tools. The `.env` file itself is also created without an explicit restrictive `umask` or `chmod`. Embedding credentials in executable command text unnecessarily increases the number of locations from which secrets can be recovered and complicates token rotation. ### Attack Path 1. The user enters a Home Assistant token during installation. 2. The installer writes the token to `.env`. 3. `ENV_EXPORTS` incorporates the full token. 4. `CRON_CMD` places the token directly into the persistent crontab entry. 5. A user or process able to inspect the crontab, process metadata, backups, diagnostics, or copied deployment output obtains the token. 6. The recover ...[truncated 631 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
install.sh:18- Finding
Unpinned Python packages and mutable Docker image are executed during installation
- Content
View full analysis
/dev/null || { echo "❌ python3 required"; exit 1; } command -v openclaw >/dev/null || { echo "❌ openclaw required"; exit 1; } pip3 install requests gtts 2>/dev/null | tail -1 echo "✅ Dependencies OK" # ── 2. הגדרת oref-alerts Docker proxy ──────────── echo "" echo "🐳 Starting oref-alerts API proxy..." if ! docker ps | grep -q oref-alerts; then docker run -d \ --name oref-alerts \ --restart unless-stopped \ -p 49000:9001 \ -e TZ="Asia/Jerusalem" \ dmatik/oref-alerts:latest ``` ### Technical Analysis The installer downloads Python dependencies without pinned versions or integrity hashes and starts a Docker image through the mutable `latest` tag. The effective third-party code can therefore change after this repository has been reviewed. Package installation may execute package build or installation logic with the privileges of the installer. Pulling `latest` similarly delegates future execution to whichever image the registry serves under that tag. A compromised upstream account, registry, release process, or dependency version could introduce arbitrary behavior. The included Python script imports `requests` but does not import `gtts`, making `gtts` an unnecessary dependency and avoidable expansion of the supply-chain attack surface. Error output from `pip3` is also suppressed, reducing diagnostic visibility. ### Attack Path 1. An upstream package account, Docker repository, registry, or release pipeline is compromised, or a future release becomes malicious. 2. A user runs `install.sh` after the upstream artifact has changed. 3. `pip3` downloads and installs the current unpinned package releases. 4. Docker obtains the image currently associated with ...[truncated 842 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (34)
Tainted flow: 'CX3_API' from os.getenv (line 35, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python def cx3_call(text: str): """חייג לשלוחה 3CX עם הודעת התרעה""" try: r = requests.post(CX3_API, json={"to": CX3_EXTENSION, "message": text, "language": "he"}, timeout=10) if r.status_code == 200:
Tainted flow: 'HA_URL' from os.getenv (line 30, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
HA_URL is fully configurable and the code sends the Home Assistant bearer token in the Authorization header to whatever endpoint that variable specifies. If an attacker can influence the environment or deployment config, they can redirect this request to an attacker-controlled server and exfiltrate the long-lived token, enabling unauthorized control of the Home Assistant instance.
- Content
python def ha_tts(text: str): """הכרז קולית דרך רמקול Home Assistant""" try: r = requests.post( f"{HA_URL}/api/services/tts/google_translate_say", headers={"Authorization": f"Bearer {HA_TOKEN}", "Content-Type": "application/json"}, json={"entity_id": HA_TTS_SPEAKER, "message": text, "language": "iw"},
Tainted flow: 'OREF_API' from os.getenv (line 24, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python def check_alert(): global last_alert_id, alert_sent_at, all_clear_sent try: data = requests.get(OREF_API, timeout=5).json() except Exception as e: log.warning(f"⚠️ API: {e}") return
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md bash install.sh # Test API curl -s http://localhost:49000/current | python3 -m json.tool # Test 3CX call manually curl -X POST http://localhost:3000/api/outbound-call \
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This second mismatch finding reinforces that the skill claims to be OpenClaw-only while static analysis indicates Home Assistant-backed TTS, additional call-routing capability, and daemonized monitoring behavior. Misrepresentation of runtime behavior increases the chance of unsafe deployment, especially where external systems, credentials, and always-on execution are involved.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This second mismatch finding reinforces that the skill claims to be OpenClaw-only while static analysis indicates Home Assistant-backed TTS, additional call-routing capability, and daemonized monitoring behavior. Misrepresentation of runtime behavior increases the chance of unsafe deployment, especially where external systems, credentials, and always-on execution are involved.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh set -e SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" ENV_FILE="$SCRIPT_DIR/.env" LOG_FILE="/var/log/oref_native.log" echo "🚨 ORef Alerts - OpenClaw Native Installer"
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill metadata says 'No Docker monitor,' yet the installer starts and manages a Docker container. This mismatch is a trust and transparency problem: users may approve the skill under false assumptions, while the installer introduces additional runtime code, network exposure, and supply-chain risk not disclosed in the manifest.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The manifest claims 'No Home Assistant,' but the installer prompts for a Home Assistant URL and token and stores them for later use. This undisclosed expansion of scope is dangerous because it solicits sensitive credentials and creates an integration path to another trusted system the user may not expect this skill to access.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation states that OpenClaw TTS is used, but the implementation actually performs TTS through Home Assistant with a bearer token. Misleading documentation about which component handles voice announcements can cause unsafe deployment decisions, hidden secret provisioning, and underestimation of external trust dependencies.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata and module comments claim there is no Home Assistant dependency, yet the code uses Home Assistant for TTS and transmits a bearer token to that service. This discrepancy is security-relevant because operators may deploy the skill under false assumptions about network exposure, secret usage, and required trust boundaries.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The top-level description presents the skill as fully OpenClaw-native with no Home Assistant involvement. Elsewhere in the same file, the architecture and configuration explicitly include optional Home Assistant TTS and a Docker-based ORef proxy, so the stated scope is materially broader than the description suggests.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This is an active contradiction within the documentation, not merely an omission. The introductory claim conflicts with the architecture and configuration sections that explicitly describe Home Assistant TTS and 3CX call integrations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README describes automatic WhatsApp group messaging and outbound phone calls for alerts without an explicit caution that test or live configuration may contact real recipients. In an alerting skill, this increases the risk of accidental disruptive notifications, nuisance calls, or panic if a user follows setup steps without understanding the external effects.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
The manual test command triggers an outbound call through a local 3CX API endpoint, which can contact a real extension with spoken content. In this skill's context, that creates a real-world notification channel that can be abused or triggered accidentally, causing disruption, harassment, or unintended alerting even though the endpoint shown is localhost.
- Content
curl -s http://localhost:49000/current | python3 -m json.tool
Test 3CX call manually
curl -X POST http://localhost:3000/api/outbound-call
-H "Content-Type: application/json"
-d '{"to":"12610","message":"בדיקת מערכת התרעות","language":"he"}'text
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill advertises operational behavior that clearly requires powerful capabilities (environment access, network access, and shell/process execution) but does not declare any tool scope or permission boundaries. In an agent ecosystem, missing scope declarations weaken reviewability and least-privilege enforcement, making it easier for a skill to run with broader privileges than users expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill routes alerts to a WhatsApp group and speaks them aloud, but the description does not prominently warn users about these disclosure channels. That omission can cause unintended exposure of sensitive location or emergency-status information to group members or anyone within hearing range.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
The setup instructions recommend background execution with nohup and persistence at boot via crontab @reboot, establishing a continuously running process outside normal interactive control. Persistence is security-relevant because it survives reboots, can evade casual visibility, and expands the blast radius if the monitored script is modified or compromised later.
- Content
bash # Install cron (every 5 seconds via loop) nohup python3 /root/.openclaw/workspace/skills/oref-native/oref_native.py \ >> /var/log/oref_native.log 2>&1 & # Or add to crontab (restart on boot)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The header explicitly says 'no Home Assistant needed' while the script later collects and stores Home Assistant credentials. Contradictory messaging reduces informed consent and can socially engineer users into entering secrets under the belief that the integration is unnecessary or dormant.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The installer pulls and runs dmatik/oref-alerts:latest without pinning a specific version or image digest, which makes the deployed code mutable over time and vulnerable to upstream supply-chain compromise. In an installer context, this is especially risky because the container is started automatically and exposed on a host port, so a malicious or compromised future image would execute immediately on the user's system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The installer collects a Home Assistant token and writes it to a plaintext .env file in the skill directory without warning, permission hardening, or secure secret handling. If local users, backups, logs, or other processes can read that file, the token could be stolen and used to control or query the user's Home Assistant environment.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh source "$ENV_FILE" export $(cat "$ENV_FILE" | grep -v "^#" | xargs) nohup python3 "$SCRIPT_DIR/oref_native.py" >> "$LOG_FILE" 2>&1 & PID=$! sleep 2
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installer silently modifies the user's crontab to achieve persistence on reboot without an explicit confirmation step. Persistence is sensitive behavior because it creates long-term execution of the skill, increases blast radius if the script is later modified, and may violate user expectations for a one-time installer.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
Adding an @reboot cron entry establishes persistent execution across reboots. In the context of an installer, persistence is not automatically malicious, but it is security-relevant because it ensures future code execution without further user action and can be abused if the script or its environment is tampered with later.
- Content
sh # ── 5. crontab ──────────────────────────────────── ENV_EXPORTS=$(cat "$ENV_FILE" | grep -v "^#" | tr '\n' ' ') CRON_CMD="@reboot $ENV_EXPORTS python3 $SCRIPT_DIR/oref_native.py >> $LOG_FILE 2>&1 &" (crontab -l 2>/dev/null | grep -v oref_native; echo "$CRON_CMD") | crontab - echo "✅ Added to crontab (auto-start on reboot)" echo ""
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The stated purpose is an OpenClaw-native Home Front Command alert skill focused on WhatsApp and TTS. Introducing a separate 3CX outbound-calling integration expands behavior beyond the manifest description, which emphasizes removing auxiliary components rather than adding telephony integrations.
- Content
Static analysis
No suspicious patterns detected.