T09 · Insecure Skill Coding Practices
Error
- Location
scripts/patch-config.sh:4- Finding
Arbitrary Python Code Execution Through Unsafely Interpolated Configuration Path
- Content
View full analysis
- Remediation
View remediation
Security audit
GigaChat (Sber AI) Proxy
Security checks for vulnerabilities and agentic risk
Overview
This skill is a legitimate GigaChat integration, but it uses sensitive credentials with insecure TLS defaults and unsafe local scripts that users should review before installing.
Install only if you are comfortable reviewing and hardening the scripts first. Pin and verify gpt2giga, require proper CA/TLS verification instead of the insecure fallback, avoid running as root, inspect the config patch before applying it, and confirm nothing important is using port 8443 before starting the proxy.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/start-proxy.sh:45- Finding
TLS Certificate Verification Is Disabled When a Fixed CA File Is Absent
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 fi export GIGACHAT_VERIFY_SSL_CERTS=true export SSL_CERT_FILE="$SBER_CA" ``` If the dependency provides a dedicated CA-bundle option, use that option rather than disabling verification globally. ]]>
T08 · Insecure Dependencies
Warning
- Location
scripts/setup.sh:3- Finding
Unpinned Third-Party Proxy Package Is Installed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/start-proxy.sh:24- Finding
Startup Script Can Terminate Unrelated Processes Through Unvalidated PID and Port Cleanup
- Content
View full analysis
/dev/null || true rm -f "$PID_FILE" fi # Cross-platform port cleanup if command -v fuser >/dev/null 2>&1; then fuser -k $PORT/tcp 2>/dev/null || true elif command -v lsof >/dev/null 2>&1; then pid=$(lsof -ti :$PORT 2>/dev/null) [ -n "$pid" ] && kill -9 $pid 2>/dev/null || true fi ``` ### Technical Analysis The script trusts the contents of `$HOME/.openclaw/gigachat.pid` without validating that the PID identifies a `gpt2giga` process started by this Skill. PID files can become stale because operating systems reuse process IDs. If the directory or file is writable by another local party, its contents may also be deliberately replaced. The port-cleanup logic is broader: `fuser -k 8443/tcp` terminates any process using TCP port 8443, while the `lsof` branch sends `SIGKILL` to every returned PID without checking executable identity, ownership, or command-line arguments. This permits the startup operation to disrupt an unrelated service and bypasses graceful shutdown. ### Attack Path Two exploitation or failure paths are possible: 1. **PID-file path** - A stale or manipulated PID file contains the PID of an unrelated process. - The user runs `start-proxy.sh`. - The script sends a termination signal to that unrelated process. 2. **Port-ownership path** - An unrelated legitimate application listens on TCP port 8443. - The user runs `start-proxy.sh`. - The script invokes `fuser -k` or obtains the PID with `lsof`. - The unrelated application is terminated, with the `lsof` branch using `SIGKILL`. The script can only signal processes that the invoking user is otherwise permitted to terminate; it does not independently gra ...[truncated 459 chars]- Remediation
View remediation
/exe` or an equivalent platform-specific process property against the expected `gpt2giga` executable. 4. Store the PID file in a user-owned directory with restrictive permissions. 5. Treat an occupied port as an error unless the listener is conclusively identified as this Skill's existing proxy. 6. Request graceful termination first and wait for a bounded timeout. 7. Use `SIGKILL` only as an explicit last resort after revalidating the process identity. 8. Remove the PID file only after confirming that the expected process has stopped. A safe startup should report an occupied port and exit rather than terminating an unidentified listener: ```bash if lsof -ti TCP:8443 -sTCP:LISTEN >/dev/null 2>&1; then echo "Error: port 8443 is already occupied; refusing to terminate an unidentified process." >&2 exit 1 fi ``` ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (14)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md` — This file
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 91% confidence
- Finding
The skill contains mixed-script text, including Cyrillic and likely confusable characters in agent identity content. Mixed-script/confusable Unicode can be used to hide misleading text, create deceptive identities, or evade reviews and pattern-based security checks, especially when the skill also writes persistent agent files.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 97% confidence
- Finding
The skill documents shell execution and file modification behavior but does not declare any explicit tool scope or permissions. This weakens the trust boundary for users and platforms because the skill can start processes, patch configuration, and create files without transparent permission declarations.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 1. **GigaChat API Access**: - Register at https://developers.sber.ru/ - Create a GigaChat API application - Note your Client ID and Client Secret - Choose scope: `GIGACHAT_API_PERS` (free tier) or `GIGACHAT_API_CORP` (paid)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
3. Test
bash curl -s -X POST http://localhost:8443/v1/chat/completions \ -H "Content-Type: application/json" \ -d '{ "model": "GigaChat-Max",
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
The persistent agent files at this location also contain suspicious mixed-script/confusable text (for example, visually deceptive Cyrillic/Latin substitutions). Combining persistence with deceptive Unicode increases the risk of hidden instructions, misleading identities, or review evasion that survives across sessions.
- Content
}
text Create agent workspace: ```bash mkdir -p /root/.openclaw/agents/ruslan/workspace
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
The persistent agent files at this location also contain suspicious mixed-script/confusable text (for example, visually deceptive Cyrillic/Latin substitutions). Combining persistence with deceptive Unicode increases the risk of hidden instructions, misleading identities, or review evasion that survives across sessions.
- Content
}
text Create agent workspace: ```bash mkdir -p /root/.openclaw/agents/ruslan/workspace
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The SOUL.md example instructs the agent to always speak Russian and adopt a specific regional context. This is a natural-language locale policy constraint presented without any user choice or opt-in, which can violate language/locale policy requirements.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - **Free Tier Quotas:** Limited tokens per model - **SSL Verification:** Disabled by default due to Sber's custom CA; install Sber root CA to `/etc/ssl/certs/sber-ca.crt` to enable - **Credentials:** Passed via environment variables only (never on the command line); protect `~/.openclaw/gigachat-new.env` with `chmod 600` ## References
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest says the skill integrates GigaChat with OpenClaw via a gpt2giga proxy, which implies provider configuration is part of setup, but this file goes beyond passive integration logic by directly patching the user's local OpenClaw config. That persistent file modification is a meaningful behavior not stated in the description.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script explicitly disables TLS certificate verification when the expected Sber CA file is missing, causing the proxy to trust unauthenticated HTTPS endpoints. This enables man-in-the-middle interception or modification of OAuth/token exchanges and API traffic, which can expose credentials, tokens, prompts, and responses. In the context of a proxy that handles authentication material, this is more dangerous than a generic connectivity workaround.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code file reads and sources an environment file, then exports
GIGACHAT_CREDENTIALS, which indicates access to sensitive credentials. While the script has basic status messages, it does not disclose to the user that sensitive credentials are being loaded from disk, and there is no inline warning comment or confirmation around that operation.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh export GIGACHAT_CREDENTIALS export GIGACHAT_SCOPE="${GIGACHAT_SCOPE:-GIGACHAT_API_PERS}" nohup gpt2giga \ --proxy.host 127.0.0.1 \ --proxy.port 8443 \ --proxy.pass-model true \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The script launches
gpt2gigaas a background process bound to127.0.0.1:8443, redirects output to a log file, and writes a PID file. Although it prints a startup message afterward, there is no prior disclosure in comments or user-facing messaging that the script will start a long-running local proxy and create persistent files under the user's home directory.- Content
Static analysis
No suspicious patterns detected.