Skill Security Scanner

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:03 PM UTC
• Version: 1.0.1

Overview

This is a local skill scanner with no evident data theft or hidden persistence, but its safety ratings are much stronger than its actual checks support.

Review this skill before relying on it. It appears to be a local, user-triggered scanner rather than malware, but its results should be treated as a lightweight lint signal only, not a reliable security verdict for installing untrusted skills.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scan-skill.sh:16

Finding

Security scan excludes executable and auxiliary files

Content

View full analysis

/dev/null; then if ! grep -qE "api\.(github|openclaw)" "$SKILL_FILE" 2>/dev/null; then ISSUES+=("[MEDIUM] Makes network calls to external domains") fi fi # Check metadata for env vars requesting secrets if grep -qE "env:.*(KEY|TOKEN|SECRET|PASSWORD)" "$SKILL_FILE" 2>/dev/null; then ``` ### Technical Analysis The scanner assigns `SKILL_FILE` exclusively to `/SKILL.md`, and every implemented security check reads only that file. It does not inspect shell scripts, Python files, JavaScript files, binaries, configuration files, or other executable resources within the target Skill. This is a fail-open design for a security scanner. A Skill can keep its documentation benign while placing credential access, remote communication, destructive commands, obfuscated payloads, or persistence logic in `scripts/` or another auxiliary directory. The scanner will not observe those behaviors. The project documentation claims detection of network exfiltration, credential harvesting, destructive operations, and obfuscation, but those guarantees cannot apply to code outside `SKILL.md`. ### Attack Path 1. An attacker creates a Skill with valid metadata and ordinary documentation in `SKILL.md`. 2. The attacker places malicious behavior in an auxiliary file such as `scripts/run.sh`. 3. The Skill inst ...[truncated 884 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scan-skill.sh:32

Finding

Global allowlist check suppresses unrelated malicious network calls

Content

View full analysis

/dev/null; then if ! grep -qE "api\.(github|openclaw)" "$SKILL_FILE" 2>/dev/null; then ISSUES+=("[MEDIUM] Makes network calls to external domains") fi fi ``` ### Technical Analysis The first search detects whether any candidate network call exists. The second search then checks the entire `SKILL.md` for either `api.github` or `api.openclaw`. These two searches are not correlated. If an allowlisted string appears anywhere in the file, the scanner suppresses the warning for every detected network call, including calls to unrelated attacker-controlled domains. The expression also performs substring matching rather than parsed hostname validation. Consequently, strings such as an attacker-controlled hostname containing an allowlisted fragment may satisfy the check even when the destination is not operated by GitHub or OpenClaw. The detector is additionally limited to a small set of command names appearing at the beginning of a line, allowing other clients, wrappers, variable-based URLs, or differently structured commands to evade detection. ### Attack Path 1. An attacker adds a network request that transmits data to an attacker-controlled endpoint. 2. The attacker places `api.github` or `api.openclaw` elsewhere in `SKILL.md`, such as in descriptive text, a comment, or an unrelated legitimate URL. 3. The first `grep` detects that a network call exists. 4. The second `grep` finds the unrelated allowlisted string anywhere in the document. 5. Because the inner condition becomes false, no network issue is added. 6. Documentation-related score bonuses can then cause the Skill to receive a favorable result. 7. If the user later invokes t ...[truncated 645 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scan-skill.sh:51

Finding

Manipulable trust score can produce unsupported safe-use recommendations

Content

View full analysis

/dev/null; then GREEN_FLAGS+=("Has proper metadata") fi # Check for documentation if grep -qE "^## " "$SKILL_FILE" 2>/dev/null; then GREEN_FLAGS+=("Well documented") fi # Calculate trust score SCORE=70 # Base score ``` ```bash # Check for official skills if [[ "$SKILL_PATH" == *"openclaw/skills"* ]] || [[ "$SKILL_PATH" == *"/openclaw/skills/"* ]]; then SCORE=$((SCORE + 20)) GREEN_FLAGS+=("Official OpenClaw skill") fi ``` ```bash # Recommendation echo "💡 Recommendation:" if [ $SCORE -ge 80 ]; then echo " Safe to use - well documented, standard permissions" elif [ $SCORE -ge 60 ]; then echo " Review before use, monitor usage" elif [ $SCORE -ge 40 ]; then echo " Use with caution in sandbox" else echo " Review carefully - multiple risk factors" fi ``` ### Technical Analysis The default score is 70. Merely containing a matching metadata string and a level-two Markdown heading creates two green flags, adding ten points and reaching the threshold for the explicit `Safe to use` recommendation. Neither property demonstrates that executable behavior is safe. Both are fully controlled by the author of the scanned Skill. The scanner also infers official OpenClaw provenance solely from a substring in the local path. A local directory name is not authenticated provenance and can be selected or influenced by an attacker. Matching the path adds 20 points and presents the Skill as official. The confidence implied by the score is further unsupported because several detection capabilities advertised by the project—such as credential harvesting, destructive operations, and obfuscated command detection—are not implemented in the script. A high score ...[truncated 1400 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 162)May include surrounding context.

clawhub install skill-security-scanner

Update

clawhub update skill-security-scanner

text

### Option 2: Manual

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

2. Credential harvesting

   bash

   # Example: reading credentials
   # cat ~/.aws/credentials
   # grep "password" /etc/shadow
   

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

bash

   # Example: reading credentials
   # cat ~/.aws/credentials
   # grep "password" /etc/shadow

3. Persistence mechanisms

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

3. Persistence mechanisms

   bash

   # Example: auto-start, cron, systemd
   # sudo crontab -l
   # systemctl enable
   

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

3. Persistence mechanisms

   bash

   # Example: auto-start, cron, systemd
   # sudo crontab -l
   # systemctl enable
   

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

bash

   # Example: auto-start, cron, systemd
   # sudo crontab -l
   # systemctl enable

4. Obfuscated code

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script markets itself as a security scanner but derives trust primarily from weak heuristics such as documentation presence, metadata formatting, and especially repository path matching for 'official' skills. This can create a false sense of safety and allow a malicious or unsafe skill to receive an inflated score despite dangerous behavior not being detected by the simplistic checks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This shell script inspects the target skill's SKILL.md contents and specifically checks for patterns like KEY, TOKEN, SECRET, and PASSWORD. While the behavior is central to scanning, the script does not disclose to the user that it will parse file contents for potentially sensitive metadata beyond the generic 'Scanning' message.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.