Preqstation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:48 PM UTC
• Version: 0.1.6

Overview

This skill is purpose-aligned for delegating coding work, but it tells agents to run powerful local coding CLIs with safety controls disabled and unsafe shell command construction.

Install only if you trust the mapped repositories, local CLI agents, and task inputs, and understand that this skill can create branches/worktrees, modify code, run background processes, and bypass normal approval or sandbox controls. Prefer revising it to require explicit invocation, keep sandboxes enabled by default, and pass prompts/paths as safely escaped arguments or files before using it broadly.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:82

Finding

Shell Command Injection Through Unescaped User-Controlled Prompt Content

Content

View full analysis

Project Key: User Objective: Execution Requirements: 1) Work only inside . 2) Complete the requested work. 3) After completion, return a short completion summary. ``` ```bash bash pty:true workdir: command:"claude --dangerously-skip-permissions ''" ``` ```bash bash pty:true workdir: command:"codex exec --dangerously-bypass-approvals-and-sandbox ''" ``` ```bash bash pty:true workdir: command:"GEMINI_SANDBOX=false gemini -p ''" ``` ### Technical Analysis The skill instructs OpenClaw to use the original user request as the execution objective and interpolate it into ``. That rendered prompt is then placed inside a single-quoted shell argument. No escaping, argument-array construction, or validation is prescribed before the user-controlled objective reaches the shell command. A single quote in the objective can terminate the intended prompt argument. Subsequent shell metacharacters can then introduce an additional command. The prompt template does not mitigate this issue: wrapping untrusted content in a larger template does not make it safe for shell interpolation. ### Attack Path 1. An attacker submits a PREQSTATION request containing a single quote followed by shell syntax. 2. The skill copies the complete request into the `objective` field. 3. The objective is inserted into ``. 4. The rendered prompt is embedded into the documented command as `''`. 5. The attacker-provided quote terminates the prompt argument. 6. The shell interprets the remaining injected text as syntax or an additional command. 7. The injected command execut ...[truncated 980 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:58

Finding

Coding Agents Are Required to Run With Permission and Sandbox Protections Disabled

Content

View full analysis

command:"claude --dangerously-skip-permissions ''" ``` ```bash bash pty:true workdir: command:"codex exec --dangerously-bypass-approvals-and-sandbox ''" ``` ```bash bash pty:true workdir: command:"GEMINI_SANDBOX=false gemini -p ''" ``` ### Technical Analysis Every supported engine execution mode explicitly disables or bypasses a major safety mechanism: - Claude is launched with permission checks skipped. - Codex is launched with approvals and sandboxing bypassed. - Gemini is launched with its sandbox disabled. The skill relies on a Git worktree and an explicit working directory as safety gates. A working directory is not a security boundary. An unsandboxed process can generally use absolute or relative paths to access other locations available to the host account, inspect environment variables, invoke local programs, communicate over the network, and interact with other processes. Coding agents also process potentially hostile repository content. Instructions embedded in source files, issue descriptions, generated artifacts, or dependency scripts can influence an agent even when the original user is trusted. Disabling a ...[truncated 1724 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:132

Finding

Unquoted Dynamic Paths and Git Parameters Permit Shell or Argument Injection

Content

View full analysis

worktree add -b codex/ HEAD git -C worktree add codex/ ``` ```bash git -C worktree add -b codex/ /tmp/openclaw-worktrees/ HEAD bash pty:true workdir:/tmp/openclaw-worktrees/ command:"codex exec --dangerously-bypass-approvals-and-sandbox ''" ``` ```bash git worktree add -b codex/ /tmp/-review bash pty:true workdir:/tmp/-review command:"codex review --base " REVIEW_DIR=$(mktemp -d) git clone "$REVIEW_DIR" cd "$REVIEW_DIR" && gh pr checkout bash pty:true workdir:"$REVIEW_DIR" command:"codex review --base origin/main" ``` ```bash git worktree add -b codex/ /tmp/ main bash pty:true workdir:/tmp/ background:true command:"codex exec --dangerously-bypass-approvals-and-sandbox 'Fix issue #101. Commit after validation.'" bash pty:true workdir:/tmp/ background:true command:"codex exec --dangerously-bypass-approvals-and-sandbox 'Fix issue #102. Commit after validation.'" ``` ### Technical Analysis The documented commands interpolate dynamic values without consistently quoting them. Relevant values include: - `` - `` - `` - `` - `` - `` Some of these values originate directly from user input, while others come from the mutable `MEMORY.md` project mapping. Unquoted shell values can undergo word splitting, glob expansion, and shell metacharacter interpretation. Values beginning with a hyphen can also be interpreted as command options unless the command syntax explicitly terminates option processing. Although the proj ...[truncated 1895 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README instructs the agent to invoke this skill based on broad natural-language cues such as any request about PREQSTATION work, mapped projects, or messages containing keywords like 'preq' or 'preqstation'. Because this skill can launch coding CLIs and create worktrees, ambiguous activation increases the chance of unintended delegation into a code-executing workflow without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README describes creating git worktrees, launching external CLI tools with PTY access, and managing background processes, but it does not prominently warn about repository modification, long-running execution, or process-control side effects. In a skill whose purpose is to run coding agents in local workspaces, missing safety warnings and guardrails can lead to accidental filesystem changes or unattended execution in the wrong project.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file defines activation triggers, so vague-trigger review applies. The trigger preq is a short, ambiguous token that is not sufficiently constrained and could appear in ordinary abbreviations or project-specific shorthand, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

2. Respect the engine the user requested. If unspecified, default to `claude`.
3. Do not kill sessions only because they are slow; poll/log first.
4. Never launch coding agents in `~/clawd/` or `~/.openclaw/`.
5. Treat resolved project path as a primary checkout source only; create a git worktree before launching any coding agent.
6. Never run coding-agent commands in the primary checkout path.
7. PR review must run in a temp clone or git worktree, never in a live primary checkout.
8. Keep execution scoped to resolved worktree `<cwd>` only.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This skill explicitly disables Gemini's sandbox with GEMINI_SANDBOX=false and elsewhere endorses dangerously-* execution flags, enabling an LLM-driven coding agent to run with reduced containment. In the context of a skill that interprets natural-language requests and launches local CLIs against developer workspaces, this materially increases the risk of arbitrary file modification, secret access, destructive commands, or lateral impact from prompt injection and mis-scoped tasks.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

Gemini CLI

bash

bash pty:true workdir:<cwd> command:"GEMINI_SANDBOX=false gemini -p '<rendered_prompt>'"

Bash execution interface (required)