skill-to-http

• Outcome: Review
• Latest audit: Jul 29, 2026 · 3:52 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed HTTP gateway for local agent skills, but its defaults create a broad remote execution surface that users should review carefully before installing.

Install only in an isolated or trusted environment. Before starting it, change exposure to an explicit allowlist, bind to 127.0.0.1 unless remote access is required, enable HTTPS for cross-host use, keep a strong API key, disable public docs, avoid exposing side-effecting skills, and do not enable the LLM fallback unless you are comfortable sending skill prompts and task data to that provider.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run_fix(cmd: str) -> tuple[bool, str]:
    """执行修复命令，返回 (成功, 输出)。"""
    try:
        result = subprocess.run(
            cmd, shell=True, capture_output=True, text=True, timeout=120
        )
        out = (result.stdout + result.stderr).strip()

• Confidence: 97% confidence
• Finding: The auto-fix path executes shell commands via subprocess.run(..., shell=True) using command strings assembled elsewhere in the program. Even if current fix_cmd values are internally generated, this pattern is dangerous because any future path that allows config-derived or attacker-influenced content into fix_cmd can become command injection, and the fix mode already performs privileged state changes on files and services.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 2. 生成自签证书（一步到位）
    try:
        subprocess.run(
            [
                "openssl", "req", "-x509", "-new", "-nodes",
                "-key", str(KEY_PATH),

• Confidence: 86% confidence
• Finding: Although the subprocess call itself is not shell-injectable, untrusted user-controlled values are written into the generated OpenSSL config file without escaping. A crafted CN or SAN containing newlines or OpenSSL config syntax could corrupt the config and potentially introduce unintended certificate attributes or extensions, causing issuance of a certificate different from what the operator expects.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.debug(f"Session cleanup failed (non-critical): {e}")

    try:
        proc = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

• Confidence: 87% confidence
• Finding: This code launches the OpenClaw CLI to execute a synthesized prompt that includes skill content, task text, parameters, and hard-coded instructions to proceed without confirmation. In the context of an HTTP skill-exposure service, this is dangerous because remote callers can trigger autonomous tool-capable agent execution, expanding the system from simple API exposure into delegated command/tool execution on the host.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# --print：非交互模式输出结果后退出
    # --bare：跳过所有插件和 hooks，减少启动时间（测实比不加 --bare 快 ~1s）
    try:
        proc = subprocess.run(
            ["claude", "--print", "--bare"],
            input=prompt,
            capture_output=True,

• Confidence: 88% confidence
• Finding: This invokes the Claude CLI in non-interactive mode with a prompt built from remote task input and skill instructions, enabling autonomous execution via a shell/tool-capable external agent. Given this skill's purpose of exposing skills over HTTP, the effect is that an external requester may induce powerful local actions through the agent runtime, which is a meaningful security boundary expansion.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 通过 stdin 传入 prompt，避免命令行参数 ARG_MAX 限制
    # --approval-mode full-auto 必须设置，否则 codex 在非 TTY 环境下会等待用户确认
    try:
        proc = subprocess.run(
            ["codex", "--approval-mode", "full-auto"],
            input=prompt,
            capture_output=True,

• Confidence: 90% confidence
• Finding: This executes Codex CLI with --approval-mode full-auto, explicitly removing interactive approval before the external agent processes untrusted prompt content. In an HTTP-exposed runner, that creates a clear path for remote, autonomous tool use and potentially host-affecting actions without a human in the loop.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill explicitly exposes locally installed skills over HTTP(S) and documents access to file, shell, network, and credential-adjacent capabilities, but it declares no permissions boundary. That mismatch is dangerous because operators or downstream systems may treat it as low-privilege metadata-only functionality when it is actually a remote execution surface over powerful local capabilities. The context makes this more dangerous, not less, because the skill is specifically designed to widen access to other installed skills, including wildcard exposure and default HTTP operation.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The example configuration exposes all installed skills by default via "expose_skills": ["*"], and the surrounding comments explicitly recommend this broad exposure. In a system that can wrap arbitrary installed skills as remotely callable HTTP endpoints, this materially increases the chance that dangerous or side-effecting skills become reachable over the network, especially when operators copy the example config into production.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The comments simultaneously label full-open exposure as "recommended" and acknowledge that side-effecting skills should be denied, which creates ambiguous and unsafe operator guidance. This contradiction can cause administrators to adopt the insecure wildcard setting without fully understanding that many installed skills may not be appropriate for remote execution.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The management console exposes high-impact environment-modifying endpoints such as doctor auto-fix and speed-mode enable/disable, extending far beyond simple skill serving. In this skill's context, the console listens on `0.0.0.0` by default and falls back to Origin-based checks when no API key is set, so administrative actions may be reachable over the network with weaker-than-expected protection.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The console loads executable JavaScript for Alpine.js from a third-party CDN at runtime. If the CDN is compromised, blocked, or swapped in transit, the management UI for a skill-exposure service could execute attacker-controlled code in the browser, potentially stealing locally stored API keys or issuing privileged management actions.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The cleanup logic compares `created_at` as text against an ISO-8601 UTC cutoff (`YYYY-MM-DDTHH:MM:SSZ`), but new rows may be inserted with SQLite's `datetime('now')`, which yields a different format (`YYYY-MM-DD HH:MM:SS`). Lexicographic comparison across mixed timestamp formats can cause retention to misclassify rows, leading to records being retained longer than intended or deleted incorrectly. In this skill, job history can contain user messages, results, and error details, so failed cleanup increases exposure of potentially sensitive data.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The wizard defaults to exposing all installed skills (`expose_skills = ["*"]`) and only optionally applying a deny list. In the context of a tool that turns local agent skills into remotely callable APIs, this creates an unnecessarily broad attack surface and can expose destructive or sensitive skills that the operator did not explicitly intend to publish.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The wizard recommends binding to `0.0.0.0` and later defaults to plain HTTP, making the service reachable from the network without transport encryption. In this skill context, that increases the danger because the API can trigger local skills remotely, so API keys and request contents may be exposed to interception or misuse on untrusted networks.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The global execution rules explicitly instruct all executors to act immediately, avoid confirmation, make assumptions, and in OpenClaw spawn subagents. That materially weakens normal safety controls and makes the HTTP-exposed service more dangerous because every remotely triggered skill run is biased toward autonomous action rather than constrained execution.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: This section wires general-purpose external agent CLIs (Claude and Codex) into the skill runner, including non-interactive execution and full-auto approval. For a component advertised as exposing skills over HTTP, this is a significant capability escalation because remote API use can indirectly access broad local tool/shell behaviors unrelated to narrow REST wrapping.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The configuration comment promotes an overly broad exposure policy without stating strict prerequisites or risk boundaries. Because this file is an example config likely to be copied by operators, the wording can directly lead to overexposure of skill endpoints and unintended remote access to sensitive capabilities.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: `/api/doctor/fix` triggers automatic repairs that can modify files and system state from a remotely reachable management API. In this console's context, exposing such a write-capable repair action over HTTP on `0.0.0.0`, especially when API key configuration is optional, creates a meaningful risk of unauthorized environment tampering or service disruption.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The API key is stored in localStorage, which is readable by any JavaScript executing in the page origin. In a web management console for exposing agent skills over HTTP, any XSS bug, compromised third-party script, or malicious browser extension can trivially extract the key and gain persistent API access to start/stop services, manage skills, and inspect jobs.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The --fix mode executes all fixable actions automatically, including package installs, service starts, directory creation, config rewrites, and certificate generation, without any confirmation prompt or per-action approval. In an agent skill that may be invoked remotely or by higher-level automation, this increases the chance of unintended system modification and makes any bad fix definition immediately operational.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: In non-interactive mode, the script automatically generates an API key and writes a configuration file with network-exposed defaults and secret-bearing values without any confirmation step. In deployment pipelines or container startup contexts, this can silently create an externally reachable service configuration that operators did not review.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The wizard invites users to enter an LLM API key but does not clearly warn that the value may be written to the local config file, which can lead to accidental plaintext secret storage. In a server-exposing skill, stored credentials may later be copied into backups, images, or shared volumes, expanding exposure beyond the local machine.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code sends SKILL.md contents to a configured external LLM endpoint for schema extraction without any explicit consent, warning, or data-classification guard. SKILL.md files may contain proprietary logic, internal prompts, secrets, or sensitive operational details, so this creates an unintended data exfiltration path, especially in a skill-hosting product that may process many third-party skills automatically.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The LLM fallback sends skill content, task data, and parameters to a configured external API endpoint, potentially exposing sensitive prompts or user data off-host. The absence of an in-file disclosure or explicit consent check increases the risk of unintended data exfiltration, especially because this is a backend HTTP service likely handling third-party requests.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: Webhook callbacks transmit job results and errors to externally supplied URLs, which can leak sensitive outputs generated by skills. Although there is partial SSRF mitigation and optional HMAC signing, the design still permits exfiltration of execution results to arbitrary non-loopback destinations, including private networks.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script binds the management console to 0.0.0.0 by default, exposing it on all network interfaces without requiring an explicit opt-in or presenting a strong warning. In the context of a skill that exposes agent capabilities over HTTP and includes a management console, this materially increases the chance of unintended remote access, especially if authentication or TLS is absent, weak, or misconfigured.

Static analysis

No suspicious patterns detected.