Security audit

Spec-kit Coding

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-aligned but installs mutable remote tools and agent skills into the OpenClaw workspace and can delete existing project agent configuration without a backup.

Review before installing. Only run setup after accepting that it will fetch executable tooling and third-party skills from GitHub into your OpenClaw workspace. Prefer check-only first, avoid --force unless needed, and do not initialize inside an existing project that has important .claude or CLAUDE.md content unless it is backed up.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: setup.sh:124
Finding: Mutable and Unverified Remote Dependencies Can Change After Review
Content: View full analysis
/dev/null; then uv tool install specify-cli --from git+https://github.com/github/spec-kit.git@latest --force ok "specify CLI installed via uv" elif command -v pipx &>/dev/null; then pipx install --force git+https://github.com/github/spec-kit.git@latest ok "specify CLI installed via pipx" ``` Additional remote Agent Skills are obtained from mutable branches: ```bash local SP_SKILLS=( "superpowers-requesting-code-review=https://raw.githubusercontent.com/obra/superpowers/main/skills/requesting-code-review/SKILL.md" "superpowers-systematic-debugging=https://raw.githubusercontent.com/obra/superpowers/main/skills/systematic-debugging/SKILL.md" ) local MP_SKILLS=( "mattpocock-diagnose=https://raw.githubusercontent.com/mattpocock/skills/main/skills/engineering/diagnose/SKILL.md" "mattpocock-improve-codebase-architecture=https://raw.githubusercontent.com/mattpocock/skills/main/skills/engineering/improve-codebase-architecture/SKILL.md" ) ``` Downloaded Skill files receive only superficial format validation: ```bash if curl -fsSL --retry 3 --retry-delay 2 "$url" -o "${dest_dir}/SKILL.md"; then # Validate: file must be non-empty and look like a Markdown skill file if [ ! -s "${dest_dir}/SKILL.md" ]; then fail "$name (downloaded file is empty — check URL: $url)" rm -f "${dest_dir}/SKILL.md" return 1 fi # Reject HTML error pages and non-markdown content local first_line first_line=$(head -1 "${dest_dir}/SKILL.md") if echo "$first_line" | grep -qiE '^<(!DOCTYPE|html|head)'; then fail "$name (downloaded HTML instead of Markdown — UR ...[truncated 3081 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:110
Finding: Project Initialization Unconditionally Deletes Existing Agent Configuration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (40)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The stated purpose is orchestration of an SDD workflow, but the behavior includes bootstrap/setup actions that install tools, fetch external skills, and write into ~/.openclaw workspace paths. This mismatch can mislead users and policy systems into granting trust to a skill that performs supply-chain-relevant and persistent system modifications.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 480)May include surrounding context.
md
## Key Features  - <Feature 1> - <Feature 2>

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · setup.sh (reported line 205)May include surrounding context.
sh
# Clean old skill directories before regeneration (--force: prevent stale files) for skill in "${missing[@]}"; do rm -rf "${EXTERNAL_DIR}/${skill}" done specify init --here --integration claude --force --ignore-agent-tools --script sh --no-git 2>/dev/null

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · setup.sh (reported line 413)May include surrounding context.
sh
# Validate: file must be non-empty and look like a Markdown skill file if [ ! -s "${dest_dir}/SKILL.md" ]; then fail "$name (downloaded file is empty — check URL: $url)" rm -f "${dest_dir}/SKILL.md" return 1 fi # Reject HTML error pages and non-markdown content

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · setup.sh (reported line 421)May include surrounding context.
sh
# Validate: file must be non-empty and look like a Markdown skill file if [ ! -s "${dest_dir}/SKILL.md" ]; then fail "$name (downloaded file is empty — check URL: $url)" rm -f "${dest_dir}/SKILL.md" return 1 fi # Reject HTML error pages and non-markdown content

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · setup.sh (reported line 426)May include surrounding context.
sh
# Validate: file must be non-empty and look like a Markdown skill file if [ ! -s "${dest_dir}/SKILL.md" ]; then fail "$name (downloaded file is empty — check URL: $url)" rm -f "${dest_dir}/SKILL.md" return 1 fi # Reject HTML error pages and non-markdown content

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · setup.sh (reported line 633)May include surrounding context.
sh
register_cleanup "$uipro_tmp" if git_clone_with_retry "$repo" "$uipro_tmp"; then rm -rf "$uipro_tmp/.git" rm -rf "$dest" mv "$uipro_tmp" "$dest" # Verify SKILL.md is reachable (repo structure may vary)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · setup.sh (reported line 721)May include surrounding context.
sh
return 0 fi for dir in "${_CLEANUP_DIRS[@]}"; do [ -d "$dir" ] && rm -rf "$dir" done }

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file is entirely written in Chinese and provides no indication that other languages are supported or that Chinese is required for a documented region-specific purpose. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes shell commands throughout the workflow, including setup and project initialization, but does not declare a restrictive tool scope such as allowed-tools or permissions. That leaves the execution surface implicit and broad, increasing the chance that an orchestrator or agent can run powerful shell operations without an explicit policy boundary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The description says to use the skill when "starting a new project" or "running through the full SDD pipeline," but does not define concrete trigger phrases or boundaries. "Starting a new project" is a common, broad activity and could overlap with many unrelated coding requests.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
- Never transmit sensitive information to the network. - Before any external action (API calls, sending data outside local machine), explain and ask for approval. - Do not install third-party libraries or modify system config without asking first. If a new dependency is needed, explain why and get approval. - Prefer reusing existing, proven, popular third-party solutions. Avoid reinventing the wheel. Keep tool usage simple and lean. Minimize dependency footprint.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
- Never transmit sensitive information to the network. - Before any external action (API calls, sending data outside local machine), explain and ask for approval. - Do not install third-party libraries or modify system config without asking first. If a new dependency is needed, explain why and get approval. - Prefer reusing existing, proven, popular third-party solutions. Avoid reinventing the wheel. Keep tool usage simple and lean. Minimize dependency footprint.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file defines routing based on generic terms like "add", "new", "change", and "modify" without clear exclusion conditions or negative examples. Those words are common in everyday requests, so the skill could be invoked or routed too broadly when the user's intent is not specifically to enter this workflow.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 81% confidence
Finding: The skill tells the agent to remember and persist operational state such as whether git has been enabled, then to keep acting on that state in future interactions. Persistent state across sessions can cause actions like repository initialization, commits, or file modifications to occur based on stale assumptions or without re-validation in the current context.
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
md
- During project init (Step 1), ASK whether to enable git. Record the answer. - If enabled: `git init`, `.gitignore`, initial commit. Then commit after each phase completion and each implementation batch. - If disabled: do not create or manage a git repository. - The user may enable git at any later point. Once enabled, keep it on. ### Context Isolation

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

Report back using the structured format below

text
| Placeholder | Implement | Code Review (Step 6.1) | Test (Step 6.2) | | -------------------------- | ----------------------------------------- ...[truncated 26 chars]

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.

Report back using the structured format below

text
| Placeholder | Implement | Code Review (Step 6.1) | Test (Step 6.2) | | -------------------------- | ----------------------------------------- ...[truncated 26 chars]

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.

Report back using the structured format below

text
| Placeholder | Implement | Code Review (Step 6.1) | Test (Step 6.2) | | -------------------------- | ----------------------------------------- ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

Report back using the structured format below

text
| Placeholder | Implement | Code Review (Step 6.1) | Test (Step 6.2) | | -------------------------- | ----------------------------------------- ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

Report back using the structured format below

text
| Placeholder | Implement | Code Review (Step 6.1) | Test (Step 6.2) | | -------------------------- | ----------------------------------------- ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

Report back using the structured format below

text
| Placeholder | Implement | Code Review (Step 6.1) | Test (Step 6.2) | | -------------------------- | ----------------------------------------- ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.
text
| Placeholder | Implement | Code Review (Step 6.1) | Test (Step 6.2) | | -------------------------- | ----------------------------------------------------------------------------------------- ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.
md
| Placeholder | Implement | Code Review (Step 6.1) | Test (Step 6.2) | | -------------------------- | ---------------------------------------------------------------------------------------------- ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.
md
| Placeholder | Implement | Code Review (Step 6.1) | Test (Step 6.2) | | -------------------------- | ---------------------------------------------------------------------------------------------- ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.
md
| Placeholder | Implement | Code Review (Step 6.1) | Test (Step 6.2) | | -------------------------- | ---------------------------------------------------------------------------------------------- ...[truncated 26 chars]