Master Agent Workflow Global

• Outcome: Review
• Latest audit: May 29, 2026 · 9:29 PM UTC
• Version: 2.0.0

Overview

The skill is mostly related to its workflow purpose, but it makes persistent shell/OpenClaw changes and imports or writes configuration files with weak path controls.

Install only after reviewing the installer and accepting persistent shell/OpenClaw changes. Avoid sourcing modified shell files blindly, import migration files only from trusted sources, do not use crafted or unreviewed config/template names, and treat exported backups/logs/reports as potentially sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (18)

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The activation script persistently modifies the user's shell startup file to set MAW_HOME and prepend a skill-controlled scripts directory to PATH without any prompt or explicit opt-in. This expands the skill's influence beyond its installation directory and can cause future commands to resolve to skill-provided executables, creating a lasting trust boundary change that is risky for an unknown skill.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script creates global command aliases in ~/bin by symlinking skill scripts into a directory commonly present in the user's executable search path. Even though the links point to local files, this still installs host-level executables outside the skill directory and can silently alter command availability or behavior for later shell sessions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: During activation, the script executes Node.js code that requires and instantiates a JavaScript hook handler from the skill directory. Requiring a module can run arbitrary top-level code immediately, so this is real code execution at install time from unreviewed skill content, which materially increases risk because activation should not need to execute complex handler logic just to verify installation.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The script advertises a restore feature and dispatches the `restore` command to `restore_backup`, but no such function is implemented. This creates a reliability and operational integrity issue: users may assume backups are recoverable during an incident, only to discover restore is unavailable when needed, which can worsen downtime or data loss.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation encourages exporting backups that may include runtime state and then transferring them between systems, including via network copy, without any warning about secrets, tokens, task contents, or other sensitive operational data that may be embedded in that state. This creates a realistic risk of accidental data exposure because users may treat the backup as routine configuration data and move or store it insecurely.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill states that periodic progress reports can be sent to external channels such as Feishu or Telegram, but it does not warn that these reports may contain task metadata, filenames, identifiers, or operational details. In a workflow/orchestration skill, such metadata can be sensitive and may leak business context or user data to third-party services or misconfigured recipients.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation describes behavior that can automatically register hooks, trigger on user text, read/write configuration, import/export data, generate logs, and clean up files, but it does not clearly warn users that installing or invoking the skill may modify local state or persist data. In an agent ecosystem, undocumented automatic actions increase the risk of unintended execution, privacy leakage through logs or exports, and user confusion about when the skill is acting on their system.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The export path is taken from user-controlled input (`options.output`) and passed directly to `fs.writeFileSync`, allowing writes to arbitrary filesystem locations accessible to the process. In a skill/agent context, this can overwrite unrelated files or place sensitive exported configuration data in unintended locations without confirmation or path restrictions.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The import routine reads attacker-controlled JSON and blindly writes configs by name and templates by `template.name`, with no sanitization, confirmation, or overwrite protections. Because `path.join(this.skillRoot, 'templates', `${template.name}.json`)` accepts unsanitized names, a crafted template name such as `../config/pwned` can escape the templates directory and overwrite other files under the skill root; normal imports also silently replace existing config/template files.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The installer appends aliases and an environment variable to the user's shell startup file without explicit consent or an opt-in flag. Persistently modifying shell initialization changes future command behavior and can be abused as a foothold for unwanted persistence; in this script the content is not overtly malicious, but silent profile modification is still dangerous installer behavior.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guide instructs users to fetch and immediately execute a remote install script via `curl ... | bash` without any integrity verification, pinning, or explicit safety warning. This creates a supply-chain and remote code execution risk: if the remote host, transport, or script content is compromised, arbitrary code will run on the user's machine during migration.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The examples encourage importing configuration and state backups, including from remote systems, without any warning about trust boundaries, sensitive contents, overwrite behavior, or integrity verification. In an agent skill context, imported state/config may alter execution behavior, expose secrets, or overwrite local settings, so omission of safety guidance can lead users into unsafe operations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The API batch-calling example describes fetching user information and updating a local database but does not warn that the workflow may transmit user-related data to external services and make persistent local changes. This is risky because users may run the example without considering data sensitivity, authorization, rate limits, or the possibility of unintended bulk modifications.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The data-cleaning example includes duplicate cleanup and record normalization/export tasks that can be destructive or irreversible, yet it provides no warning about backups, review, or rollback. In operational data-processing skills, such examples can normalize unsafe behavior and lead to accidental data loss or corruption when applied to production records.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script modifies the user's shell startup file without prior warning or consent, creating a persistent configuration change that affects future terminal sessions. In the context of a skill installer, silent profile edits are more dangerous because users may not realize their environment and command resolution behavior have been permanently changed.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The script creates directories and copies configuration/template files into the user's home directory without notifying the user beforehand. These actions are common for setup scripts and appear intended to support skill operation, but they are still unauthorized persistent filesystem changes and reduce transparency during installation.

External Script Fetching

High

• Category: Supply Chain

Content

./install.sh
else
    echo "下载并安装全局版本..."
    curl -L https://clawhub.com/skills/master-agent-workflow-global/install.sh | bash
fi

# 3. 迁移配置

• Confidence: 99% confidence
• Finding: curl -L https://clawhub.com/skills/master-agent-workflow-global/install.sh | bash

Chaining Abuse

High

• Category: Tool Misuse

Content

./install.sh
else
    echo "下载并安装全局版本..."
    curl -L https://clawhub.com/skills/master-agent-workflow-global/install.sh | bash
fi

# 3. 迁移配置

• Confidence: 98% confidence
• Finding: | bash

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: migration-guide.md:176