T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/implementation.py:43- Finding
Unisolated Python Execution with Inherited Host Access
- Content
View full analysis
- Remediation
View remediation
Security audit
openclaw-plus
Security checks for vulnerabilities and agentic risk
Overview
This skill openly provides broad developer automation powers, but the combination of code execution, package installation, network calls, commits, file/process actions, sub-agents, and webhooks is under-scoped for normal installation.
Review this skill carefully before installing. Use it only in a disposable workspace, container, or virtual environment, and do not let it run untrusted code, install arbitrary packages, commit changes, delete files, start background work, or send API/webhook messages without reviewing the exact action and any secrets involved.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Error
- Location
scripts/implementation.py:89- Finding
Unsafe Global and Privileged Package Installation
- Content
View full analysis
--break-system-packages # System packages (Ubuntu/Debian) sudo apt-get install -y ``` ### Technical Analysis The method accepts a package specification and installs it from configured package repositories without enforcing an allowlist, version pinning, cryptographic hashes, trusted repository restrictions, or manual approval. Python package installation can execute package build logic and installation hooks. A malicious, compromised, dependency-confused, or typosquatted package can therefore execute code during installation. Requirements files expand this exposure because they may select multiple dependencies, alternate indexes, direct URLs, or unexpected versions. The `--break-system-packages` option deliberately bypasses protections intended to prevent pip from modifying a distribution-managed Python environment. This can corrupt or replace shared packages used by other applications. For system packages, the implementation invokes `sudo apt-get`. If passwordless or otherwise non-interactive sudo is available, packa ...[truncated 1468 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:380- Finding
Potential Sensitive-Data Disclosure Through Webhook Error Notifications
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (54)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description broadly claims a multi-capability dev skill covering Python execution, package management, git, HTTP requests, file operations, process management, sub-agents, and webhook notifications. The actual code substantially matches the core developer-oriented purpose for Python execution, package management, git inspection/commit, HTTP fetch/API calls, and some supporting file/process behavior via file writes and subprocess usage. However, several declared capabilities are absent as concrete implemented features: there is no sub-agent support, no webhook notification function, and no general-purpose file-operations or process-management interface beyond internal support for execution and package/git commands. Because the declared description presents these as available capabilities of the skill, the code does not fully and accurately represent that breadth. This is a partial mismatch rather than a totally different purpose.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill exposes arbitrary Python execution with only a generic log message and no explicit safety barrier, confirmation, or sandboxing. In this skill’s multi-capability context, executed code can combine filesystem, process, network, and package-management capabilities, making compromise substantially more dangerous than a narrow single-purpose tool.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The package installation feature modifies the runtime environment and explicitly uses
--break-system-packageswithout warning the caller about integrity and stability risks. In practice, installing an attacker-chosen or typo-squatted package can trigger arbitrary code execution during installation and corrupt the host environment used by the agent.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This API helper can send arbitrary JSON and bearer tokens to caller-specified endpoints without warning about data disclosure, token leakage, or SSRF-style access to internal services. In a powerful agent environment, this can be abused to exfiltrate secrets or interact with sensitive internal network resources under the agent’s identity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The guide encourages package installation and later notes pip may use --break-system-packages, but it does not warn that this can alter or destabilize the local Python environment. Because this skill is designed to orchestrate installation plus execution, users may unintentionally contaminate system interpreters or break existing dependencies.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The quick start normalizes creating files and committing changes without clearly warning that these actions modify the user's working tree and permanently affect repository history. In a multi-capability automation skill, users may follow examples casually and trigger unintended writes or commits, especially when chaining operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The network/API examples encourage fetching URLs and calling external services without warning that prompts, data, headers, or tokens may be transmitted to third parties. In this skill context, network access is a core capability and can easily be combined with local file access or API tokens, increasing the risk of accidental data disclosure.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Data Pipeline
python install_package("pandas requests") data = call_api("https://api.example.com/dataset") run_python("process_data.py") git_commit("feat: add cleaned dataset")
Static analysis
No suspicious patterns detected.