T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:13- Finding
Unnecessary Mail-Sending OAuth Permission
- Content
View full analysis
- Remediation
View remediation
Security audit
Yandex 360 CLI (Disk, Calendar, Mail)
Security checks for vulnerabilities and agentic risk
Overview
This Yandex CLI is mostly coherent, but it asks users to grant mail-sending permission it does not actually use and creates a local secret file without enforcing private permissions.
Review before installing. Use the narrowest possible Yandex OAuth scopes, preferably omit mail:smtp unless real mail sending is added, and ensure ~/.openclaw/yax.env is chmod 600. Avoid passing calendar event text from untrusted sources until ICS escaping and validation are fixed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.sh:3- Finding
OAuth Client Secret File Created Without Restrictive Permissions
- Content
View full analysis
"$ENV_FILE" << 'EOF' YAX_CLIENT_ID= YAX_CLIENT_SECRET= EOF ``` ### Technical Analysis The setup script creates `~/.openclaw/yax.env` using ordinary shell redirection without first setting a restrictive `umask` or explicitly changing the resulting file permissions. The file mode therefore depends on the caller's environment. With a common `022` umask, the file may be created with mode `0644`, making it readable by other local users. The setup documentation instructs the user to place `YAX_CLIENT_SECRET` in this file, so the file is expected to contain authentication-sensitive data. The token file does not have this specific defect because `src/yax.cjs` writes it with mode `0600`. ### Attack Path 1. A user runs `scripts/setup.sh` with a permissive umask such as `022`. 2. The script creates `~/.openclaw/yax.env` with permissions such as `0644`. 3. The user enters a valid `YAX_CLIENT_SECRET` into the file as instructed. 4. Another account on the same multi-user system reads the file. 5. The attacker obtains the OAuth client identifier and secret and may use them in attacks against the associated OAuth application, subject to Yandex's authorization controls. ### Impact Assessment The vulnerability may disclose the Yandex OAuth client secret to other local users. This does not by itself disclose the user's access token, but it compromises an OAuth application credential and may facilitate application impersonation or abuse of OAuth flows. Exposure is principally relevant on shared or multi-user systems. ]]>- Remediation
View remediation
"$ENV_FILE" << 'EOF' YAX_CLIENT_ID= YAX_CLIENT_SECRET= EOF chmod 600 "$ENV_FILE" echo "Created $ENV_FILE — fill in your Yandex OAuth app credentials" else chmod 600 "$ENV_FILE" echo "Env file exists at $ENV_FILE" fi ``` Additionally: - Verify and repair permissions when the file already exists. - Warn the user if the configuration file is owned by another account. - Avoid placing long-lived secrets in files when a platform-provided secret store is available. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
src/yax.cjs:389- Finding
CalDAV Event Injection Through Unescaped iCalendar Fields
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/yax.cjs auth # OAuth flow (opens browser URL, paste code)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/yax.cjs auth # OAuth flow (opens browser URL, paste code)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/yax.cjs auth # OAuth flow (opens browser URL, paste code)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/yax.cjs auth # OAuth flow (opens browser URL, paste code)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/yax.cjs auth # OAuth flow (opens browser URL, paste code)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/yax.cjs auth # OAuth flow (opens browser URL, paste code)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/yax.cjs auth # OAuth flow (opens browser URL, paste code)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/yax.cjs auth # OAuth flow (opens browser URL, paste code)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/yax.cjs auth # OAuth flow (opens browser URL, paste code)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill metadata declares required environment variables containing OAuth credentials, but it does not define an explicit tool scope such as permissions or allowed-tools. This creates an unnecessary trust gap: a skill that handles secrets can access sensitive environment data without clearly constraining or disclosing that capability, increasing the risk of secret exposure or misuse by the agent runtime.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Features - **Disk**: info, list, mkdir, upload, download - **Calendar**: list calendars, create events (via CalDAV) - **Mail**: ⚠️ Limited — Yandex has no public HTTP API for mail (IMAP/SMTP only, ports often blocked in cloud) ## Prerequisites
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The warning states that unknown timezones default to Europe/Moscow, and the calendar creation function also defaults its timezone parameter to Europe/Moscow. This imposes a specific locale behavior without user opt-in, which matches the language/locale policy violation criteria for all file types.
- Content
Static analysis
No suspicious patterns detected.