T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sync-project-skills.js:127- Finding
Command Injection Through Project-Controlled Skill Names and Versions
- Content
View full analysis
- Remediation
View remediation
Security audit
skill-isolator
Security checks for vulnerabilities and agentic risk
Overview
This skill is a project skill manager, but a project-controlled config can make its sync script run unintended shell commands during installation.
Install only after reviewing and fixing the sync script. Do not run it in untrusted repositories or against shared/downloaded `.openclaw-skills.json` files until skill names and versions are strictly validated and the installer uses argument-array execution instead of a shell string. Treat auto-sync, `--force`, and mutable remote config examples as unsafe defaults that need explicit review and approval.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
references/faq.md:174- Finding
Unsafe Supply-Chain Guidance Bypasses Suspicious-Package Warnings and Trusts Mutable Remote Configuration
- Content
View full analysis
--force ``` The tutorial downloads a mutable configuration from a branch and immediately uses it for synchronization: ```bash curl -O https://raw.githubusercontent.com/team-name/shared-skills/main/frontend-standard.json cp frontend-standard.json .openclaw-skills.json node /path/to/sync-project-skills.js ``` It also proposes automating the same behavior: ```bash if [ "$PROJECT_TYPE" = "frontend" ]; then curl -O https://raw.githubusercontent.com/team-name/shared-skills/main/frontend-standard.json cp frontend-standard.json .openclaw-skills.json elif [ "$PROJECT_TYPE" = "backend" ]; then curl -O https://raw.githubusercontent.com/team-name/shared-skills/main/backend-standard.json cp backend-standard.json .openclaw-skills.json else echo "Usage: $0 " exit 1 fi node /path/to/sync-project-skills.js ``` ### Technical Analysis The `--force` recommendation explicitly bypasses a security warning without requiring investigation, provenance verification, or review of the flagged skill. The shared-configuration workflow downloads files from the mutable `main` branch. The effective content can change after the documentation or project has been reviewed. The workflow performs no signature, checksum, immutable commit, or content verification before copying the file to `.openclaw-skills.json` and invoking synchronization. Because the synchronization process installs skills named by this configuration, compromise of the source repository or maintainer account can alter the installed components. In addition, a malicious configuration can supply the command-injection values descr ...[truncated 1643 chars]- Remediation
View remediation
///frontend-standard.json ``` 4. Publish and verify a cryptographic checksum or signature for every shared configuration. 5. Download to a temporary file, validate it, show the proposed changes, and require explicit approval before replacing `.openclaw-skills.json`. 6. Apply strict schema and value validation before synchronization, including the allow-list protections required for the command-injection finding. 7. Pin skill versions in team configurations and verify registry package provenance or signatures. 8. Add organizational controls such as an approved-skill allow list and a trusted internal mirror. 9. Document rollback and incident-response procedures for compromised shared configurations or registry packages. ]]>
Vulnerability Patterns
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (46)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The documentation materially overstates what the skill does and how safely it does it, including claims about automatic loading, source support, priority handling, version locking, and isolation that are not actually implemented. This can mislead users into trusting security and isolation properties they do not have, increasing the chance of unsafe installation, cross-project contamination, or unreviewed remote skill use.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/validate-config.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/validate-config.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/validate-config.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/validate-config.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/validate-config.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/validate-config.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/validate-config.js
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
编辑 .openclaw-skills.json，删除对应技能
方法 2：手动删除
rm -rf ~/.openclaw/skills/
text ### Q13: 支持哪些技能来源？
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
编辑 .openclaw-skills.json，删除对应技能
方法 2：手动删除
rm -rf ~/.openclaw/skills/
text ### Q13: 支持哪些技能来源？
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
编辑 .openclaw-skills.json，删除对应技能
方法 2：手动删除
rm -rf ~/.openclaw/skills/
text ### Q13: 支持哪些技能来源？
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md node scripts/sync-project-skills.js --force # 方法 2：删除缓存文件 rm ~/.openclaw/cache/skills.json # 方法 3：修改配置 TTL {
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md node scripts/sync-project-skills.js --force # 方法 2：删除缓存文件 rm ~/.openclaw/cache/skills.json # 方法 3：修改配置 TTL {
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash git add .openclaw-skills.json git commit -m "Add skill configuration for frontend development" git push完成！ ✅ 现有项目现在有了技能配置。
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash git add .openclaw-skills.json git commit -m "Add skill configuration for frontend development" git push完成! ✅ 现有项目现在有了技能配置。
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README advertises automatic installation and syncing of skills when entering a project, which is a system-changing action triggered by project context rather than an explicit user command. In a tool that supports multiple sources including git and URL, this increases supply-chain and surprise-execution risk because users may enter an untrusted repository and unintentionally pull or install skills without a clear warning or consent step.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill describes behavior that can inspect environment context and drive filesystem/network-affecting operations, but it does not declare any explicit tool scope such as allowed tools or permissions. That omission weakens user understanding and policy enforcement, making it easier for the skill to operate with broader-than-expected capabilities in environments that rely on metadata for safety decisions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill body switches to Chinese for the primary instructions and explanations, while the file does not offer alternative language options or indicate that the skill is intentionally region- or locale-specific. This can violate a language/locale policy requiring user choice or explicit justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill promotes automatic detection and installation of missing skills but does not clearly warn that this causes local file changes and may fetch content from configured sources. Users may trigger downloads and installation side effects without informed consent, which is risky when skills are executable instructions from potentially untrusted origins.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation explicitly supports URL-based skill downloads without warning about remote content trust, tampering, or supply-chain risks. Fetching and installing skills from arbitrary URLs can introduce malicious or modified skill content into the local environment if integrity and provenance are not verified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file uses a single fixed language throughout and does not state that Chinese is optional or intended for a specific locale. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is reportable.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The example enables automatic synchronization both when entering a project and when a skill is missing, which can cause remote or local skill resolution to occur without an explicit user approval step. In the context of a skill loader that supports registry, filesystem, git, and URL-like sources, broad auto-sync triggers increase the chance of unintentionally fetching or activating untrusted code when a project is opened or when dependency names are manipulated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The FAQ advises users to bypass a suspicious-skill warning with
--forceand gives no caution about the trust implications. In the context of a skill manager that installs project-scoped skills, this normalizes overriding security checks and can directly lead to installing malicious skills from untrusted sources.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The uninstall instructions include
rm -rf ~/.openclaw/skills/<skill-name>, and the cache troubleshooting section includesrm ~/.openclaw/cache/skills.json, but the document provides no caution that these commands delete local data and may be irreversible. For markdown guidance, destructive operations that affect user data or system state should be accompanied by an explicit warning.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The table states
gitandurlsources are 'planned' (计划中), indicating they are not implemented. However, the later advanced usage section provides a concrete project configuration usingtype: "git"as if it were supported, which directly contradicts the earlier documentation about implementation status.- Content