Security audit

Ceo Notify Agents

Security checks for vulnerabilities and agentic risk

Overview

This notification skill is purpose-aligned, but it uses unsafe shell execution and persistent shared memory in ways that can be abused.

Review before installing. This skill should be rewritten to use a constrained file or memory API, validate agent names, pass message content as data instead of shell source, label stored notifications as untrusted, and provide retention or deletion controls. Avoid using it for sensitive messages or in a privileged environment until those issues are fixed.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:20
Finding: Shell Command Injection Through Untrusted Template Parameters
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:27
Finding: Directory Traversal Through Unvalidated Agent Names
Content: View full analysis
> "$NOTIFICATION_DIR/${agent}.log" done ``` ### Technical Analysis Each attacker-controlled target name is used as a filename component without validation or canonicalization. Trimming the value with `xargs` does not remove path separators or traversal sequences. A target containing components such as `../../destination` causes the constructed path to escape `NOTIFICATION_DIR`. The fixed `.log` suffix limits the final filename to one ending in `.log`, but the attacker can still append controlled notification content to writable log-suffixed files outside the intended directory. The append redirection also follows symbolic links. If an attacker can create or influence entries in the notification directory, a symlink could redirect writes to another writable location. ### Attack Path 1. An attacker supplies a target-agent value containing one or more `../` path components. 2. The value is split and assigned to `agent` without an allowlist check. 3. The script concatenates the untrusted value with `NOTIFICATION_DIR`. 4. Filesystem path resolution processes the traversal components and escapes the intended directory. 5. Bash opens the resulting `.log` path in append mode. 6. Attacker-controlled message content is appended to the selected writable file. ### Impact Assessment An attacker can modify writable `.log` files outside the shared notification directory. This can corrupt logs, alter application state stored in log-formatted files, or poison data consumed by other agents and services. The exact scope depends on the filesystem permissions of the Skill runner and the presence of usable traversal targets or symbolic links. ]]>
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:30
Finding: Persistent Agent Memory Poisoning Through Untrusted Notifications
Content: View full analysis
> "$NOTIFICATION_DIR/${agent}.log" done echo "$TIMESTAMP: 通知 $TARGETS - $MESSAGE" >> "$NOTIFICATION_DIR/all.log" /Users/anran/.npm-global/bin/openclaw memory index --agent main ``` ### Technical Analysis The Skill writes attacker-controlled message text directly into persistent shared-memory files and then invokes memory indexing for the `main` agent. No sender authentication, recipient authorization, provenance metadata, review step, or trust-boundary marker is applied before indexing. Because natural-language memory can affect subsequent agent behavior, a message containing instructions may be retrieved in later sessions and interpreted as authoritative guidance rather than untrusted data. The directory-traversal issue further increases the possible scope by allowing writes to other accessible `.log` locations. ### Attack Path 1. An attacker invokes the notification Skill with a message containing deceptive or malicious instructions. 2. The Skill appends the message to a recipient-specific log and the global notification log. 3. The Skill invokes `openclaw memory index --agent main`. 4. The untrusted content becomes part of persistent indexed state. 5. During a later conversation, an agent retrieves the stored notification. 6. If the agent does not maintain a strict data-versus-instruction boundary, it may follow the planted instructions or use attacker-controlled claims when making decisions. ### Impact Assessment The attacker can persist content across conversations and potentially influence future behavior of the `main` agent or intended recipients. Possible consequences include instruction manipulation, disclosure of information during later interactions, unauthorized tool use, and repeated propagation of attacker-controlled content. Actual ...[truncated 106 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill writes user-supplied notification content into shared log files and triggers indexing, but the description does not disclose that messages are persisted in shared memory visible to other agents. This creates a transparency and privacy problem: users may believe they are sending an ephemeral notice when they are actually storing data durably and making it discoverable through indexing.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill uses a general shell execution tool to implement a simple file-write workflow, which unnecessarily expands the attack surface. Because untrusted template variables are inserted into a shell script and the skill can create files and run commands on the host, misuse or future modifications could lead to command abuse or broader filesystem effects beyond the stated notification purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill performs an additional indexing command that is not clearly required by the user-visible purpose of sending notifications. Extra command execution increases privilege use and side effects, and could expose or process unrelated shared-memory data unexpectedly if the indexing command has broader scope than assumed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The natural-language interface is defined entirely in Chinese, with no indication that other languages are supported or that the locale constraint is intentional and justified. This can violate language/locale policy when a skill imposes a specific language without user opt-in.
Content: No source excerpt is available for this finding.