ClawHub
Back to skill

Security audit

Openclaw Pii Anonymizer Latest

Security checks for vulnerabilities and agentic risk

Overview

This privacy skill is coherent but needs Review because it can send raw sensitive text to a configurable Ollama endpoint without destination or transport controls.

Install only if you control the Ollama endpoint. Keep OLLAMA_URL on localhost or a trusted encrypted endpoint, avoid feeding secrets until the JSON construction is fixed with a serializer such as jq, and be cautious about enabling cron or HEARTBEAT-style automatic processing of memory or workspace content.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
privacy-anonymize.sh:17
Finding

Unsafe JSON Construction Permits Ollama Request Manipulation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
privacy-anonymize.sh:3
Finding

Raw Sensitive Data Can Be Transmitted to an Unrestricted Plaintext Endpoint

Content
View full analysis
&2 exit 1 fi if ! curl -s --max-time 10 --fail "$OLLAMA_URL/v1/models" >/dev/null 2>&1; then echo "Error: Ollama unavailable at $OLLAMA_URL" >&2 exit 1 fi prompt_anonymize() { local input="$1" local response response=$(curl -s --max-time 30 --fail "$OLLAMA_URL/v1/chat/completions" \ -H "Content-Type: application/json" \ -d "{ \"model\": \"$MODEL\", \"messages\": [ {\"role\": \"system\", \"content\": \"Strict anonymize ONLY. Replace PII with [PERSON]/[EMAIL]/[PATH]/[IP]/[PHONE]/[SSN]/[URL]/[ORG]. Output RAW cleaned text ONLY. No explanations/sentences/additions/changes. Example: 'Seth at /home' → '[PERSON] at [PATH]'.\"}, {\"role\": \"user\", \"content\": \"$input\"} ], \"stream\": false, \"options\": {\"temperature\": 0.1} }") || { ``` ### Technical Analysis The script sends the original, unanonymized input to the address supplied through `OLLAMA_URL`. That environment variable is not restricted by scheme, hostname, network range, or an endpoint allowlist. The default endpoint is loopback, but the documentation also recommends a host address over unencrypted HTTP. If the environment is misconfigured or influenced by an attacker, the endpoint can be changed to an unauthorized remote service that implements the expected Ollama API paths. Because anonymization occurs at that endpoint, all sensitive content necessarily reaches it before any redaction takes place. When a non-loopback HTTP endpoint is used, data may also traverse a network without transport encryption. This can expose memory exce ...[truncated 1752 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · privacy-anonymize.sh (reported line 12)May include surrounding context.

sh
exit 1
fi

if ! curl -s --max-time 10 --fail "$OLLAMA_URL/v1/models" >/dev/null 2>&1; then
  echo "Error: Ollama unavailable at $OLLAMA_URL" >&2
  exit 1
fi

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends the full raw user input to an Ollama chat-completions endpoint before any local sanitization or explicit disclosure to the user. Even if the default URL is localhost, the endpoint is configurable via OLLAMA_URL and may point to a remote service, creating a real risk of transmitting sensitive PII off-host without clear consent or transport guarantees.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.