Ubuntu WSL System Cleanup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:14 AM UTC
• Version: 1.0.0

Overview

This cleanup skill mostly matches its purpose, but it deletes root-level cache/temp data and includes a helper that can broadly print private configuration and workspace lines.

Review before installing. This skill is not malicious, but only use it when you are comfortable with a root-level cleanup script deleting cache/temp data, and avoid running the second-round scan with broad or sensitive search terms because matching private configuration or workspace lines may be printed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/safe-clean.sh:27

Finding

Recursive Temporary-Directory Deletion Can Remove Recently Modified Nested Content

Content

View full analysis

Vulnerability Details

File Location: scripts/safe-clean.sh, lines 27–28
Vulnerability Type: Unsafe recursive deletion based on parent modification time
Risk Level: Medium

bash

find /tmp -xdev -mindepth 1 -mtime +3 -print -exec rm -rf {} + 2>/dev/null || true
find /var/tmp -xdev -mindepth 1 -mtime +7 -print -exec rm -rf {} + 2>/dev/null || true

Technical Analysis

Each find command selects an entry according to that entry's modification time and passes the selected path to rm -rf. If the selected entry is a directory, the deletion is recursive and is not restricted by the ages of files contained inside it.

A top-level temporary directory can have an old modification timestamp while containing recently modified files. Updating the contents of an existing nested file does not necessarily update the modification time of every ancestor directory. Consequently, a directory that satisfies -mtime +3 or -mtime +7 may contain active, recent data that does not independently satisfy the retention threshold.

The use of -xdev prevents crossing filesystem boundaries but does not address this recursive age-checking problem. Suppressing errors with 2>/dev/null || true can also conceal partial deletion or operational failures.

Attack Path

1. An application creates a directory under /tmp or /var/tmp.
2. The directory becomes older than the configured threshold.
3. The application continues modifying an existing nested file without changing the top-level directory's modification time.
4. A user invokes the documented safe-cleanup workflow.
5. find selects the old top-level directory.
6. rm -rf recursively removes the directory, including its recently modified nested content.

Impact Assessment

The script is designed to run with root-level access and can therefore delete temporary content belonging to any local user or service. Potentially affected content includes active applicati ...[truncated 348 chars]

Remediation

View remediation

Remediation Suggestions

• Select stale files individually rather than recursively deleting a directory solely because the directory itself is old.
• Delete directories only after their eligible contents have been removed and the directories are confirmed empty.
• Exclude sockets, lock files, mount points, and known service runtime directories.
• Use a dry-run mode that prints candidates and reclaimed-size estimates before deletion.
• Require explicit confirmation before recursively deleting non-empty directories.
• Consider a safer pattern such as:

bash

find /tmp -xdev -type f -mtime +3 -print
find /tmp -xdev -type f -mtime +3 -delete
find /tmp -xdev -depth -type d -empty -mtime +3 -delete

Apply equivalent handling to /var/tmp with its intended retention period. Service-aware cleanup facilities such as systemd-tmpfiles should be preferred where available.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/second-round-clean.sh:19

Finding

Orphaned-Tool Scan Recursively Exposes Broad Configuration and Workspace Content

Content

View full analysis

Vulnerability Details

File Location: scripts/second-round-clean.sh, lines 19–20
Vulnerability Type: Excessive local data access and disclosure through scan output
Risk Level: Medium

bash

grep -Rni "$tool" /root/.bashrc /root/.zshrc /root/.profile /root/.config /root/.openclaw/workspace 2>/dev/null || true

Technical Analysis

The command recursively reads all files reachable under /root/.config and /root/.openclaw/workspace, in addition to shell initialization files. This scope is substantially broader than the tool-specific paths required to locate orphaned configuration references.

Because ordinary grep output includes each matching line, the command may print complete configuration values rather than only filenames. Depending on workspace contents, matching lines could contain credentials, access tokens, service endpoints, MCP configuration, Agent state, project source code, or unrelated private data.

No network transmission is implemented by the Skill. The exposure occurs through command output, which may nevertheless be captured in terminal history, orchestration logs, audit logs, or Agent conversation records. Running under the root account means the scan can read sensitive files unavailable to ordinary users.

Attack Path

1. A tool name or search value is supplied to second-round-clean.sh.
2. The supplied value matches text in one or more sensitive configuration or workspace files.
3. grep -Rni recursively reads those files using the script's existing root privileges.
4. Entire matching lines are written to standard output.
5. Sensitive values become visible to the caller or are retained by systems that capture script output.

A broad or commonly occurring search expression increases the number of unrelated files and lines exposed.

Impact Assessment

The script does not obtain new privileges, but it uses its existing root access across a scope broader than necessary f ...[truncated 361 chars]

Remediation

View remediation

Remediation Suggestions

• Restrict searches to explicit, tool-specific configuration directories and known filenames.
• Do not recursively scan the entire OpenClaw workspace by default.
• Print only matching filenames with grep -Rl rather than complete matching lines.
• Exclude credential stores, environment files, histories, private keys, Agent state, and secret-bearing configuration files.
• Require explicit user confirmation before expanding a search beyond known tool locations.
• Run the scan with the least-privileged account capable of completing the task.
• Redact likely credentials if line output is explicitly requested.
• Provide a narrow default invocation such as:

bash

grep -RliF -- "$tool" "/root/.config/$tool" 2>/dev/null || true

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/second-round-clean.sh:4

Finding

Unvalidated Tool Names Cause Word Splitting, Glob Expansion, and Grep Option Injection

Content

View full analysis

Vulnerability Details

File Location: scripts/second-round-clean.sh, lines 4–23
Vulnerability Type: Unsafe shell argument and search-pattern handling
Risk Level: Low

bash

TOOLS=(${@:-})
if [ ${#TOOLS[@]} -eq 0 ]; then
  echo "usage: second-round-clean.sh <tool-name> [tool-name...]" >&2
  exit 1
fi

echo
for tool in "${TOOLS[@]}"; do
  echo "[scan] tool=$tool"
  echo "-- cache/config/share matches --"
  find /root/.cache /root/.config /root/.local/share /root/.openclaw/workspace/_trash \
    -maxdepth 4 \( -iname "*${tool}*" \) -print 2>/dev/null || true
  echo
  echo "-- config references --"
  grep -Rni "$tool" /root/.bashrc /root/.zshrc /root/.profile /root/.config /root/.openclaw/workspace 2>/dev/null || true
  echo
  echo "-- local bin matches --"
  ls -l /root/.local/bin 2>/dev/null | grep -i "$tool" || true

Technical Analysis

TOOLS=(${@:-}) expands the supplied arguments without quoting. Bash therefore performs word splitting and pathname expansion while constructing the array. A single intended tool name can be split into multiple values, while wildcard characters may expand against files in the current working directory.

The later grep commands pass the value as the first argument without an option terminator. A tool value beginning with - may therefore be parsed as one or more grep options rather than as a search pattern. Tool names are also treated as regular expressions, allowing regex metacharacters to broaden the search unexpectedly.

The find -iname expression similarly incorporates wildcard-bearing user input into a glob pattern. These issues do not provide direct shell-command injection because "$tool" is quoted at the command-use sites, but they can alter scan behavior and expose unrelated results.

Attack Path

1. A caller supplies a wildcard, whitespace-containing, regular-expression, or option-like tool value.
2. The unquoted arr ...[truncated 981 chars]

Remediation

View remediation

Remediation Suggestions

• Preserve arguments exactly by constructing the array as follows:

bash

TOOLS=("$@")

• Use fixed-string, option-safe searches:

bash

grep -RniF -- "$tool" path...
grep -iF -- "$tool"

• Validate tool names against an expected character set and reject empty, leading-hyphen, path-like, or control-character-containing values.
• If wildcard matching is not required, escape glob metacharacters before constructing the find -iname pattern.
• Avoid parsing ls output; inspect directory entries directly with find.
• Combine input validation with the narrower search scope recommended for the recursive data-exposure finding.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description says this skill audits and safely cleans system junk, caches, logs, temp files, and unused local tool artifacts. The supplied script does not clean or remove any files at all; it only scans and prints matches for specified tool names. Its primary purpose is a second-round forensic/inventory search of root-owned local artifacts and configuration references, not system cleanup. While some searched locations overlap with cache/config areas mentioned in the description, the lack of any cleanup behavior and the requirement for explicit tool identifiers make the actual behavior materially different from the declared purpose.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/safe-clean.sh (reported line 16)May include surrounding context.

sh

echo
echo "[clean] apt cache"
apt-get clean || true
rm -rf /var/lib/apt/lists/* || true
mkdir -p /var/lib/apt/lists/partial

echo

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/safe-clean.sh (reported line 34)May include surrounding context.

sh

echo
echo "[clean] apt cache"
apt-get clean || true
rm -rf /var/lib/apt/lists/* || true
mkdir -p /var/lib/apt/lists/partial

echo

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/safe-clean.sh (reported line 38)May include surrounding context.

sh

echo
echo "[clean] apt cache"
apt-get clean || true
rm -rf /var/lib/apt/lists/* || true
mkdir -p /var/lib/apt/lists/partial

echo

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/safe-clean.sh (reported line 39)May include surrounding context.

sh

echo
echo "[clean] apt cache"
apt-get clean || true
rm -rf /var/lib/apt/lists/* || true
mkdir -p /var/lib/apt/lists/partial

echo

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/safe-clean.sh (reported line 16)May include surrounding context.

sh

echo
echo "[clean] apt cache"
apt-get clean || true
rm -rf /var/lib/apt/lists/* || true
mkdir -p /var/lib/apt/lists/partial

echo

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/safe-clean.sh (reported line 34)May include surrounding context.

sh

if command -v npm >/dev/null 2>&1; then
  npm cache clean --force || true
fi
rm -rf /root/.npm/_npx 2>/dev/null || true

echo
echo "[clean] common user caches"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/safe-clean.sh (reported line 34)May include surrounding context.

sh

if command -v npm >/dev/null 2>&1; then
  npm cache clean --force || true
fi
rm -rf /root/.npm/_npx 2>/dev/null || true

echo
echo "[clean] common user caches"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/safe-clean.sh (reported line 38)May include surrounding context.

sh

echo
echo "[clean] common user caches"
rm -rf /root/.cache/pip 2>/dev/null || true
rm -rf /root/.cache/thumbnails 2>/dev/null || true
find /root/.cache -maxdepth 1 -type d -name 'tmp*' -prune -exec rm -rf {} + 2>/dev/null || true

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/safe-clean.sh (reported line 38)May include surrounding context.

sh

echo
echo "[clean] common user caches"
rm -rf /root/.cache/pip 2>/dev/null || true
rm -rf /root/.cache/thumbnails 2>/dev/null || true
find /root/.cache -maxdepth 1 -type d -name 'tmp*' -prune -exec rm -rf {} + 2>/dev/null || true

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/safe-clean.sh (reported line 39)May include surrounding context.

sh

echo
echo "[clean] common user caches"
rm -rf /root/.cache/pip 2>/dev/null || true
rm -rf /root/.cache/thumbnails 2>/dev/null || true
find /root/.cache -maxdepth 1 -type d -name 'tmp*' -prune -exec rm -rf {} + 2>/dev/null || true

echo

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/safe-clean.sh (reported line 39)May include surrounding context.

sh

echo
echo "[clean] common user caches"
rm -rf /root/.cache/pip 2>/dev/null || true
rm -rf /root/.cache/thumbnails 2>/dev/null || true
find /root/.cache -maxdepth 1 -type d -name 'tmp*' -prune -exec rm -rf {} + 2>/dev/null || true

echo

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script recursively searches shell config files, all of /root/.config, and /root/.openclaw/workspace for tool-name references, which goes beyond identifying removable caches or local tool artifacts. In a cleanup skill, this broad inspection can expose unrelated configuration and workspace content, creating unnecessary access to potentially sensitive data without a clear cleanup need.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Using recursive grep on shell startup files, /root/.config, and workspace directories for arbitrary user-supplied tool names is not well aligned with the stated purpose of safe system cleanup. Even though this script only reads and prints matches, it can surface secrets, project details, or unrelated private data in terminal output, increasing information exposure risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.