ClawHub
Back to skill

Security audit

amath skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Socthink math-learning integration, but it handles passwords and bearer tokens in exposed ways and includes unsafe installer guidance that users should review before installing.

Review this skill before installing on a shared or sensitive machine. Avoid putting real passwords or bearer tokens in command lines or transcripts, prefer isolated test accounts, clear the in-process session after use, keep any .env token out of source control, and do not run the curl-to-bash OpenClaw installer unless you independently trust and verify that installer path.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
OPENCLAW_SETUP.md:29
Finding

Unverified Remote Installer Downloaded and Executed Through Bash

Content
View full analysis
Remediation
View remediation
/install.sh ``` 2. Publish and verify a cryptographic checksum or, preferably, a signed release artifact: ```bash echo ' openclaw-install.sh' | sha256sum --check - ``` 3. Instruct users to inspect the downloaded script before execution: ```bash less openclaw-install.sh bash openclaw-install.sh ``` 4. Pin the installer to a reviewed version or immutable release rather than a mutable `install.sh` endpoint. 5. Document the files, services, and permissions the installer is expected to create. 6. Explicitly advise users not to run the installer as root unless a documented operation requires elevation. 7. Prefer an authenticated package repository or signed package distribution mechanism where available. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
amath_skill/server.py:35
Finding

Passwords and Bearer Tokens Exposed Through Process Arguments and Tool Output

Content
View full analysis
/run_amath_cli.sh login ``` ```text Note: login returns a bearer token in JSON. For authenticated quiz flows, extract `access_token` and pass it with `--token`. ``` ```bash /run_amath_cli.sh quiz-start standard --topic-id --token ``` ```bash /run_amath_cli.sh quiz-answer A --token ``` ```bash /run_amath_cli.sh quiz-submit --token ``` The CLI defines the password and tokens as ordinary command-line arguments: ```python login = sub.add_parser("login") login.add_argument("username") login.add_argument("password") ``` ```python quiz_start.add_argument("--token") quiz_answer.add_argument("--token") quiz_submit.add_argument("--token") ``` It sends the password to the remote authentication endpoint and returns the API response to standard output: ```python if args.command == "login": return await client.request("POST", "/auth/login", json_body={"username": args.username, "password": args.password}) ``` The MCP implementation also returns the complete bearer token in its tool result: ```python @mcp.tool() async def auth_login(username: str, password: str, persist: bool = True) -> dict[str, Any]: """Log in with username/email/phone and password, then optionally persist the bearer token.""" try: data = await client.request( "POST", ...[truncated 3310 chars]
Remediation
View remediation
` workflows. If explicit token input must remain available, mark it as an emergency or advanced interface and use a protected secret input channel rather than argv. 6. Ensure tool-call arguments and results are redacted before entering logs, telemetry, traces, or Agent conversation history. 7. Avoid revealing any token fragment. In particular, `get_token_preview()` currently returns the complete token when its length is 12 characters or fewer; session state should report only a Boolean such as `has_token`. 8. Store tokens only in memory by default, clear them on logout and process termination, and document expiration and revocation behavior. 9. Add automated tests that verify passwords and complete tokens never appear in command strings, standard output, MCP responses, exception messages, or logs. ]]>

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Dependencies Are Installed Without Exact Version or Integrity Pinning

Content
View full analysis
=1.6.0 httpx>=0.27.0 pydantic>=2.0 pydantic-settings>=2.0 python-dotenv>=1.0.0 ``` The setup guide installs these open-ended requirements directly: ```bash cd /path/to/amath_skill ../.venv/bin/pip install -r requirements.txt ``` ### Technical Analysis Every dependency uses a lower-bound constraint and permits pip to install future versions that were not available or reviewed when this Skill was audited. The project does not provide exact version pins, package hashes, or a lock file. This does not prove that any listed package is currently malicious. The weakness is that future installation results are not reproducible and depend on the state of the package index and dependency resolver at installation time. A compromised upstream release or transitive dependency could therefore enter the environment without a corresponding change to this repository. Because Python packages may execute code during installation and are imported into the Skill at runtime, compromise of a resolved package can lead to local code execution under the Skill process's privileges. ### Attack Path 1. An upstream dependency account, release pipeline, or permitted future package version is compromised. 2. A malicious version satisfying one of the `>=` constraints is published to the configured package index. 3. A user follows the setup instructions at a later date. 4. Pip resolves and installs the malicious or otherwise unsafe version because no exact version or trusted hash is required. 5. Malicious code executes during installation or when the Skill imports the affected package. 6. The package gains access to files, environment variables, network connectivity, and credentials available to the installing user or running Skill process. ### Impact Asse ...[truncated 594 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (45)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The instruction curl -fsSL https://openclaw.ai/install.sh | bash executes remote script content directly in a shell without an opportunity for inspection or integrity verification. If the remote host, CDN, TLS chain, or distribution path is compromised, users could execute arbitrary code immediately on their machines.

Content

Scanner excerpt · OPENCLAW_SETUP.md (reported line 30)May include surrounding context.

官方最短路径：

bash
curl -fsSL https://openclaw.ai/install.sh | bash
openclaw onboard --install-daemon
openclaw gateway status
openclaw dashboard

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Piping downloaded content directly into bash creates a dangerous execution chain that removes review boundaries between network input and code execution. In the context of setup instructions for a skill, this increases the likelihood that users will blindly execute whatever the remote endpoint serves at that moment.

Content

Scanner excerpt · OPENCLAW_SETUP.md (reported line 30)May include surrounding context.

官方最短路径：

bash
curl -fsSL https://openclaw.ai/install.sh | bash
openclaw onboard --install-daemon
openclaw gateway status
openclaw dashboard

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · OPENCLAW_SETUP.md (reported line 56)May include surrounding context.

bash
cd /path/to/amath_skill
cp .env.example .env

默认值已经指向：

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 316)May include surrounding context.

bash
cd /path/to/amath_skill
cp .env.example .env

默认值已经指向：

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose describes end-user educational functionality of the Socthink math skill, but the provided code chunk does not implement any of those behaviors. Instead, it performs local installation and deployment of the skill by manipulating directories and copying files. This is a materially different primary purpose from the declared learning/tutoring behavior, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared purpose describes an end-user educational tutoring skill. The actual code chunk does not implement curriculum browsing, problem lookup, tutoring, or quiz flows. Instead, it performs repository hygiene and release-readiness checks for publishing a package, including required-file validation and scanning for sensitive data or local-machine artifacts. This is a materially different primary purpose and introduces undeclared capabilities related to repository inspection and publish-time security checks.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description says the skill helps users interact with the Socthink 奥数 learning system through educational features like curriculum browsing, tutoring, and quizzes. However, the actual code does none of that. It is purely an operational release script for publishing a skill package. It checks for the clawhub CLI, retries with a custom Node-based uploader, reads a local config file to obtain an auth token, walks the directory to gather text files, requires a SKILL.md/skills.md file, and uploads the package to a remote registry endpoint. These are materially different capabilities and resources from the declared educational purpose, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · amath_skill/config.py (reported line 9)May include surrounding context.

python
class Settings(BaseSettings):
    model_config = SettingsConfigDict(
        env_file=".env",
        env_prefix="AMATH_",
        extra="ignore",
    )

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · preflight_check.sh (reported line 29)May include surrounding context.

sh
:
fi

if find . -maxdepth 2 -type f \( -name '.env' -o -name '*.env' \) -print0 | xargs -0 grep -nE '^[[:space:]]*AMATH_ACCESS_TOKEN=[^[:space:]#]+' >/dev/null 2>&1; then
  echo "Detected a populated AMATH_ACCESS_TOKEN in an env file. Remove it before publishing." >&2
  exit 1
fi

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document instructs users to place an access token into a local .env file but does not warn that the token is sensitive, should not be committed, and should be protected with filesystem and secret-handling controls. This increases the chance of accidental credential exposure through source control, backups, logs, or shared environments.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · OPENCLAW_SETUP.md (reported line 96)May include surrounding context.

如果想手动复制，也可以：

bash
mkdir -p ~/.openclaw/skills
cp -R /path/to/amath_skill/openclaw_skills/amath-socthink ~/.openclaw/skills/

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README demonstrates passing an access token directly on the command line for quiz invocation without warning about shell history, process-list exposure, or safer alternatives. In agent and shared development environments, this can lead to accidental credential disclosure to other local users, logs, screenshots, or automation telemetry.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README states that authentication tokens are retained in the running skill process but does not warn users about session sensitivity, token lifetime, multi-user host risks, or how to clear state safely. This increases the chance of unauthorized reuse of a live session, especially in persistent agent runtimes or shared environments.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
77% confidence
Finding

The skill invokes a local helper script and describes network-backed product interactions, but it does not declare any explicit tool scope such as allowed-tools or permissions. That makes the skill's effective capabilities less transparent to reviewers and users, increasing the risk of overbroad access to environment data or network resources through the helper script.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The CLI accepts a username and password as positional arguments and sends them in a POST request to the authentication endpoint. This is a safety-relevant network transmission of credentials, but the file provides no confirmation prompt, warning message, or explanatory comment/docstring to disclose that sensitive data will be sent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The configuration sets default_system_name to 奥数探险课, which imposes a specific language/locale by default. There is no nearby indication that users can choose an alternate language or that this locale restriction is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill exposes authentication features and stores bearer tokens in process state even though its declared purpose centers on curriculum discovery and tutoring. This expands the trust boundary and creates unnecessary credential-handling risk: other tools or users sharing the same skill process may be able to act with the persisted session, and users may not realize the skill retains authentication state beyond a single call.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The login tool can automatically persist a bearer token when persist=True and settings.auto_persist_token is enabled, but this file provides no user-facing warning at the point of authentication. Silent session persistence is dangerous because bearer tokens grant direct account access, and keeping them in process memory increases the chance of cross-session misuse, unintended reuse, or exposure through adjacent tooling and debugging surfaces.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script unconditionally runs rm -rf "$TARGET_DIR" on a path derived from user input ($1) before copying the skill. While the variables are quoted and the target includes a fixed skill-name suffix, this still causes silent destructive deletion of any existing directory at that location, which can lead to data loss if a user supplies an unexpected target root or reruns the installer over customized content.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · CLAWHUB_PUBLISH_CHECKLIST.md (reported line 36)May include surrounding context.

md
- `openclaw_skills/amath-socthink`

Main file:
- `openclaw_skills/amath-socthink/SKILL.md`

Suggested install targets:
- `~/.openclaw/skills/amath-socthink`

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · OPENCLAW_SETUP.md (reported line 80)May include surrounding context.

md
- `openclaw_skills/amath-socthink`

Main file:
- `openclaw_skills/amath-socthink/SKILL.md`

Suggested install targets:
- `~/.openclaw/skills/amath-socthink`

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · OPENCLAW_SETUP.md (reported line 147)May include surrounding context.

md
- `openclaw_skills/amath-socthink`

Main file:
- `openclaw_skills/amath-socthink/SKILL.md`

Suggested install targets:
- `~/.openclaw/skills/amath-socthink`

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 302)May include surrounding context.

md
- `openclaw_skills/amath-socthink`

Main file:
- `openclaw_skills/amath-socthink/SKILL.md`

Suggested install targets:
- `~/.openclaw/skills/amath-socthink`

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 339)May include surrounding context.

md
- `openclaw_skills/amath-socthink`

Main file:
- `openclaw_skills/amath-socthink/SKILL.md`

Suggested install targets:
- `~/.openclaw/skills/amath-socthink`

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · openclaw_skills/README.md (reported line 13)May include surrounding context.

md
- `openclaw_skills/amath-socthink`

Main file:
- `openclaw_skills/amath-socthink/SKILL.md`

Suggested install targets:
- `~/.openclaw/skills/amath-socthink`