Master Agent Workflow Global

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:51 AM UTC
• Version: 2.0.0

Overview

The skill matches its workflow and migration purpose, but it needs review because its installer and chat-triggered migration features can persistently change local setup and overwrite files through poorly scoped paths.

Review before installing. Use only a trusted local installer, avoid the documented curl-to-bash migration path, inspect imported migration files, do not import shared configs from untrusted sources, and check shell startup files after install because the skill may add persistent aliases, MAW_HOME, and PATH changes.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: migration-guide.md:150

Finding

Unpinned Remote Installer Is Downloaded and Executed Directly

Content

View full analysis

Remediation

View remediation

master-agent-workflow-global-2.0.0.tar.gz' | sha256sum --check - ``` 5. Prefer a cryptographic signature from a documented release key over checksum-only verification. 6. Allow users to inspect the downloaded installer before running it. 7. Prefer the platform's verified package installation mechanism where available. 8. Avoid redirects or explicitly constrain them to approved hosts. 9. Document that installation must not be performed from an elevated shell unless strictly required. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: hooks/openclaw/handler.js:299

Finding

Path Traversal in Hook Configuration and Template Writes

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: `. 5. The script parses the attacker-controlled key or name. 6. Shell redirection opens `$CONFIG_DIR/$key.json` or `$TEMPLATE_DIR/$name.json`. 7. Traversal causes the path to resolve outside the intended directory. 8. Attacker-controlled JSON overwrites the selected file if the invoking user can write it. ### Impact Assessment The attacker can overwrite reachable writable JSON files with imported content. The practical scope includes: - OpenClaw configuration - Other Skill configuration files - User appl ...[truncated 462 chars]:154

Finding

Path Traversal in Shell-Based Migration Importer

Content

View full analysis

"$CONFIG_DIR/$key.json" config_count=$((config_count + 1)) echo -e " Imported configuration: $key" fi done # Import templates local template_count=0 echo "$import_data" | jq -r '.templates[] | @json' | while read -r template; do if [ -n "$template" ]; then local name=$(echo "$template" | jq -r '.name') if [ -n "$name" ]; then echo "$template" | jq '.' > "$TEMPLATE_DIR/$name.json" template_count=$((template_count + 1)) echo -e " Imported template: $name" fi fi done ``` ### Technical Analysis The script treats keys from `.configs` and values from `.templates[].name` as trusted filenames. These fields come directly from the imported JSON file and are not validated before shell redirection opens the destination. Double-quoting prevents shell word splitting and wildcard expansion, but it does not prevent filesystem path traversal. For example, a name containing repeated `../` segments can cause the redirection target to resolve outside `$CONFIG_DIR` or `$TEMPLATE_DIR`. The imported value is passed through `jq`, so this is not direct shell command injection. The confirmed vulnerability is uncontrolled file placement and overwrite. ### Attack Path 1. An attacker creates a syntactically valid migration file. 2. The file includes a configuration key or template name containing traversal segments. 3. The attacker distributes the file as a shared configuration, migration archive, or backup. 4. A user runs `scripts/mi ...[truncated 878 chars]

Remediation

View remediation

&2 return 1 fi ``` 3. Canonicalize both the base directory and destination and verify containment using a portable, well-tested mechanism. 4. Reject names containing `/`, `\`, `..`, control characters, or leading dots. 5. Validate the complete import document against a documented JSON schema before writing any files. 6. Stage all imported files in a securely created temporary directory and only move them into place after every entry passes validation. 7. Require explicit confirmation before overwriting existing files, unless a documented `--force` option is used. 8. Create rollback copies before replacement and apply restrictive permissions to imported files. ]]>

T06 · System Persistence

Warning

• Location: scripts/activator.sh:37

Finding

Persistent Shell Profile Modification and Skill-Controlled PATH Prepending

Content

View full analysis

/dev/null; then echo "" >> "$SHELL_RC" echo "# master-agent-workflow-global environment variables" >> "$SHELL_RC" echo "export MAW_HOME=\"$HOME/.openclaw/global-skills/master-agent-workflow\"" >> "$SHELL_RC" echo "export PATH=\"\$MAW_HOME/scripts:\$PATH\"" >> "$SHELL_RC" echo "Environment variables configured" fi ``` The installer separately makes persistent profile changes: ```bash SHELL_RC="$HOME/.bashrc" if [ -n "$ZSH_VERSION" ]; then SHELL_RC="$HOME/.zshrc" fi if ! grep -q "master-agent-workflow" "$SHELL_RC" 2>/dev/null; then echo "" >> "$SHELL_RC" echo "# master-agent-workflow-global shortcut commands" >> "$SHELL_RC" echo "alias maw='use master-agent-workflow-global'" >> "$SHELL_RC" echo "alias maw-list='list master-agent-workflow-global templates'" >> "$SHELL_RC" echo "export MAW_HOME='$INSTALL_DIR'" >> "$SHELL_RC" echo -e "${GREEN}Shell configuration updated${NC}" fi ``` ### Technical Analysis The activation script appends persistent commands to `.bashrc` or `.zshrc`. These commands execute in every future interactive shell and prepend the Skill-controlled scripts directory to `PATH`. Prepending a non-system directory means an executable placed in that directory takes precedence over identically named commands found later in `PATH`. The present package does not include an observed command-collision payload, but the configuration creates a durable hijacking opportunity if that directory is subsequently modified through package compromise, unsafe update behavior, or another ...[truncated 1815 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (40)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 384)May include surrounding context.

md

- `SKILL.md` - 本文件，主技能文档

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Import accepts a user-supplied file path, reads attacker-controlled JSON, and then performs multiple writes using unvalidated object keys and template names to construct filenames. This enables arbitrary file overwrite/path traversal via config names or template.name values (e.g. '../...'), making it especially risky in a chat-driven hook that bridges untrusted input to local filesystem writes.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

curl -L ... | bash is a classic unsafe pattern because it combines network retrieval with immediate shell execution. In this skill context, the document is a migration guide likely to be followed verbatim by users, which makes the pattern more dangerous since it normalizes direct remote code execution during installation.

Content

Scanner excerpt · migration-guide.md (reported line 153)May include surrounding context.

md

./install.sh
else
    echo "下载并安装全局版本..."
    curl -L https://clawhub.com/skills/master-agent-workflow-global/install.sh | bash
fi

# 3. 迁移配置

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The pipe into bash removes any opportunity for meaningful review and tightly chains untrusted network input into command execution. This chaining amplifies supply-chain and man-in-the-middle style risks because a single compromised fetch results in immediate execution with the user's privileges.

Content

Scanner excerpt · migration-guide.md (reported line 153)May include surrounding context.

md

./install.sh
else
    echo "下载并安装全局版本..."
    curl -L https://clawhub.com/skills/master-agent-workflow-global/install.sh | bash
fi

# 3. 迁移配置

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · migration-guide.md (reported line 176)May include surrounding context.

md

read -p "是否删除旧版本？(y/N): " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    rm -rf "$HOME/.openclaw/workspace/skills/master-agent-workflow"
    echo "旧版本已删除"
fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · publish-to-clawdhub.sh (reported line 96)May include surrounding context.

sh

# 移除不需要的文件
    echo -e "  清理不需要的文件..."
    rm -f "$BUILD_DIR"/*.bat 2>/dev/null || true
    rm -f "$BUILD_DIR"/*.tmp 2>/dev/null || true
    rm -f "$BUILD_DIR"/*.log 2>/dev/null || true

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · publish-to-clawdhub.sh (reported line 97)May include surrounding context.

sh

# 移除不需要的文件
    echo -e "  清理不需要的文件..."
    rm -f "$BUILD_DIR"/*.bat 2>/dev/null || true
    rm -f "$BUILD_DIR"/*.tmp 2>/dev/null || true
    rm -f "$BUILD_DIR"/*.log 2>/dev/null || true
    
    # 创建包

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · publish-to-clawdhub.sh (reported line 98)May include surrounding context.

sh

echo -e "  清理不需要的文件..."
    rm -f "$BUILD_DIR"/*.bat 2>/dev/null || true
    rm -f "$BUILD_DIR"/*.tmp 2>/dev/null || true
    rm -f "$BUILD_DIR"/*.log 2>/dev/null || true
    
    # 创建包
    echo -e "  创建压缩包..."

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file instructs users to execute ./install.sh, copy files into ~/.openclaw/global-skills/, and later run publish scripts, all of which can modify the local system or user configuration. The README does not include any warning or disclosure about these filesystem-changing actions or advise users to review the scripts before running them.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The '工具安全规范' section says system commands are prohibited and that only OpenClaw safe tools are used. Elsewhere, the same file instructs users to run shell commands such as install scripts, cp, scp, source, cron, cat, and other bash operations, which directly contradicts that blanket claim.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly documents exporting configuration, templates, and even runtime state into local backup files without warning that these artifacts may contain sensitive operational data. Users may create unprotected archives and then copy or retain them insecurely, exposing secrets, internal task data, or environment details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation promotes periodic progress reporting to external channels such as Feishu or Telegram but does not warn that task metadata, system status, filenames, or other sensitive context may be transmitted off-host. In operational environments, this can leak internal information to third-party services or misconfigured recipients.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

解决:

bash

# 检查权限
ls -la ~/.openclaw/

# 重新安装
./install.sh --force

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file contains all user-facing instructional content in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. That creates a natural-language policy concern under the language/locale rule because it effectively forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file uses Chinese throughout the skill template and does not indicate that the language is optional, configurable, or limited to a China-specific audience. That creates a natural-language locale policy concern because it effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document describes actions that persist data locally, including config save/import/export, automatic registration, and log generation, but it does not clearly warn users that invoking these commands can create, overwrite, or retain files on disk. In an agent skill context, hidden persistence increases the risk of unintended state changes, leaking sensitive configuration into logs or exports, and surprising users who may assume the skill is read-only.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The hook is designed to auto-trigger on broad keywords and the developer guidance explicitly encourages adding arbitrary trigger words without any constraints, scoping, or exclusion rules. In an agent environment this can cause accidental activation on unrelated user text, leading to unintended command execution paths, configuration changes, imports/exports, or other side effects without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

User-facing strings, help text, trigger phrases, and command guidance are written exclusively in Chinese, which effectively forces a specific language for interaction. There is no indication of user opt-in, alternate locale support, or documented justification for this locale restriction.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The docstring at L35-L37 says this method processes OpenClaw messages, and the module/header presents the file as a hook handler. In practice, the class also creates directories on startup (L22-L33) and supports saving, importing, and exporting configuration/templates via filesystem writes elsewhere in the class, which is a materially broader side effect than the documentation suggests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The export path is user-controlled and passed directly to fs.writeFileSync without validation, allowing arbitrary file writes relative to the process working directory or via absolute paths. In a message-triggered hook context, this is more dangerous because a chat/user command can cause persistent filesystem modification, potentially overwriting application files or user data if the process has sufficient permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script modifies the OpenClaw config.json in place to add the skill entry, but does so automatically and without an advance confirmation prompt. Silent changes to application configuration can enable unwanted functionality, reduce user control, and are especially risky in an installer context because users may not realize trust settings have been altered.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The installer appends aliases and environment variables to the user's shell startup file without explicit prior consent or a clear opt-in step. Persistent modification of ~/.bashrc or ~/.zshrc can change future shell behavior, surprise users, and create a foothold for later abuse if the installed skill or path is replaced.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script writes aliases containing Chinese phrases and presents usage instructions that require Chinese-language commands, which imposes a language choice on users. There is no opt-in, alternate locale, or explanation that this skill is intentionally limited to Chinese-speaking environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The migration script instructs users to download and immediately execute a remote shell script without any integrity verification, signature check, pinning, or explicit warning about the code-execution risk. If the remote host, transport path, or published script is compromised, this becomes arbitrary command execution in the user's environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file includes migration examples for exporting backups and importing configuration/state archives, including a variant that includes runtime state and an example using scp to transfer backup files. The examples do not include any warning that these files may contain sensitive configuration or state data, nor any caution about import side effects such as overwriting existing settings.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: migration-guide.md:176