Security audit

Reproduce

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed helper for delegating work to child agents, with real data-sharing and tool-passing risks that are expected for its purpose.

Install only if you are comfortable letting spawned child agents receive sanitized task snapshots through your selected model provider. Do not include secrets in progress_so_far, pass file or network tools only when needed, and prefer a pinned LiteLLM dependency in controlled environments.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:35
Finding: Unpinned LiteLLM Installation Instruction Enables Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
" ``` 2. Publish a hash-locked requirements file and require hash verification: ```bash pip install --require-hashes -r requirements.txt ``` 3. Generate the lockfile from a trusted environment and include hashes for all transitive dependencies. 4. Review dependency updates before changing the pinned version rather than accepting future releases automatically. 5. Use a trusted package index or an internally controlled package mirror. 6. Run the Skill in a restricted environment with minimal filesystem access, restricted outbound networking, and only the provider credentials required for the selected model. ]]>

T08 · Insecure Dependencies

Warning

Location: manifest.json:15
Finding: Open-Ended LiteLLM Version Constraint Permits Unreviewed Future Releases
Content: View full analysis
=1.40.0" ] }, ``` ### Technical Analysis The manifest specifies only a minimum LiteLLM version and has no upper bound, exact pin, integrity hash, or lockfile. Consequently, any future version satisfying `>=1.40.0` may be installed, including major releases that have not been reviewed for compatibility or security. Because `scripts/spawn_openclaw.py` imports LiteLLM and invokes its synchronous and asynchronous completion APIs, the dependency runs within the Skill's Python process. A malicious or compromised eligible release would therefore enter a trusted path that processes model prompts, provider configuration, and credentials. This is a supply-chain exposure rather than evidence of malicious behavior in the currently available dependency. ### Attack Path 1. An attacker gains control of an eligible future LiteLLM release or compromises a package in its transitive dependency graph. 2. A malicious package version satisfying `litellm>=1.40.0` is published. 3. The Skill is installed or its dependencies are refreshed in an environment without a preexisting lock. 4. The resolver selects the attacker-controlled version because it satisfies the manifest constraint. 5. The dependency executes within the Skill process when installed, imported, or used for a completion request. 6. The attacker can perform actions allowed to the invoking process and attempt to collect or alter data handled by the spawner. ### Impact Assessment Successful exploitation may result in arbitrary code execution under the account running the Skill. Potentially exposed resources include provider API credentials inherited from the environment, task snapshots, model prompts and responses, files readable by the process, and reachable network services. The practic ...[truncated 63 chars]
Remediation: View remediation
" ] } ``` 2. Add a lockfile or hash-verified requirements file covering LiteLLM and every transitive dependency. 3. Perform controlled dependency updates with security review, compatibility testing, and provenance verification. 4. Configure automated vulnerability and dependency-integrity scanning in the release pipeline. 5. Prefer a trusted internal package mirror and restrict installation from arbitrary indexes. 6. Isolate execution using a dedicated low-privilege account or container and provide only the credentials and filesystem paths required for the current task. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.
md
If `SKILL.md` is not adjacent to `spawn_openclaw.py`, pass the path explicitly:

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents and encourages passing file-access tools to spawned child agents, but it declares no explicit tool scope or permissions boundary. That makes capability expansion easy to miss during review and increases the chance that spawned agents receive arbitrary filesystem read/write access without a policy guardrail.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The activation guidance is very broad and includes phrases like always use this skill when spawning is needed, plus generic trigger words such as spawn, delegate, parallelize, or split. In practice, this can cause the skill to be invoked in situations where delegation is unnecessary or unsafe, increasing the chance of accidental data exposure to child agents or external model providers.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest and body text describe the helper as multi-provider via LiteLLM, with provider selection driven by the model argument. However, the security notes and later guidance specifically state that progress_so_far is sent to the Anthropic API, which contradicts the broader documented behavior because non-Anthropic providers may be used instead.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The 'When to Spawn' section gives positive criteria and only one brief negative example for trivial one-step tasks. It does not clearly define additional non-activation cases, leaving ambiguity around borderline scenarios like ordinary multi-step work that is still manageable in the current agent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file documents the helper as supporting multiple providers through LiteLLM, but the error table describes API failures specifically as 'Anthropic API error'. That is an active documentation contradiction because equivalent failures would come from whichever provider is selected at runtime, not necessarily Anthropic.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The anti-pattern table warns that progress_so_far is sent to the Anthropic API, but elsewhere the skill clearly claims support for multiple providers via LiteLLM. This is a contradiction in the documentation of where data is sent, which matters for user understanding of data exposure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.