T09 · Insecure Skill Coding Practices
- Location
SKILL.md:25- Finding
Execution of Unverifiable Scripts from a Hard-Coded External Directory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 25-36
Vulnerability Type: Insecure external script execution
Risk Level: MediumVulnerable Code
bash cd /Volumes/data/openclaw/evolution-engine # Full pipeline (scout → evaluate → integrate → verify → benchmark → announce) pnpm pipeline # Individual operations pnpm scout pnpm evaluate pnpm integrate pnpm verify pnpm announceTechnical Analysis
The quick-start instructions change into the hard-coded, machine-specific directory
/Volumes/data/openclaw/evolution-engineand execute package-manager scripts defined by the Node.js project at that location. That directory is outside the audited Skill package.The supplied artifact contains only
SKILL.md; it does not include the external project'spackage.json, implementation, dependency lockfile, or integrity metadata. Consequently, the behavior ofpipeline,scout,evaluate,integrate,verify, andannouncecannot be verified from the audited package. Whoever controls the external directory can control the commands executed under these script names. Package installation or execution may also trigger lifecycle scripts if the external project uses them.This is an insecure Skill design because the documented entry point is neither self-contained nor bound to a reviewed source revision. It creates a trust-boundary violation between the reviewed documentation and the code that users or agents are instructed to execute.
Attack Path
- An attacker, compromised installer, or another local process creates or modifies the project at
/Volumes/data/openclaw/evolution-engine. - The attacker defines a malicious
pipeline,scout,evaluate,integrate,verify, orannouncescript in that project'spackage.json, or compromises code or dependencies loaded by one of those scripts. - A user or AI agent follows the instructions in
SKILL.mdand changes into the exte ...[truncated 1181 chars]
- An attacker, compromised installer, or another local process creates or modifies the project at
- Remediation
View remediation
Remediation Suggestions
- Bundle the executable implementation,
package.json, and dependency lockfile within the Skill package so the documented commands correspond to auditable code. - Replace the hard-coded absolute directory with a path resolved relative to the Skill's own root directory.
- Pin third-party dependencies and the upstream source to reviewed, immutable versions or commit hashes.
- Verify downloaded or installed artifacts using cryptographic hashes or signed provenance before execution.
- Document the exact behavior and security requirements of every invoked package script.
- Separate discovery, cloning, integration, verification, and publication into independently reviewable operations.
- Require explicit user confirmation before repository cloning, dependency installation, credential access, network publication, or social-media posting.
- Run external evaluation and integration tasks with least privilege in an isolated container or sandbox, using restricted filesystem and network access.
- Avoid exposing credentials globally to the process. Provide narrowly scoped, short-lived tokens only to the specific operation that requires them.
- Fail safely when the expected project manifest, lockfile, source revision, or integrity metadata does not match the reviewed version.
- Bundle the executable implementation,