Skill Auditor Pro

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:12 AM UTC
• Version: 2.1.1

Overview

This skill is a coherent security scanner, but it has a real review concern because it writes extracted suspicious code to a predictable shared temporary file and overstates its LLM analysis behavior.

Review this before installing. It should only be run as an unprivileged user, preferably in a single-user or disposable environment, and not against directories containing private source or secrets unless the temporary-file behavior is fixed. The predictable /tmp output should be replaced with a securely created private temp file or removed after use, and the LLM-analysis documentation should be corrected.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/audit.sh:181

Finding

Predictable Temporary Output File Allows Symlink-Based File Overwrite

Content

View full analysis

Vulnerability Details

File Location: scripts/audit.sh, lines 181–182
Vulnerability Type: Predictable temporary file and symlink-following file overwrite
Risk Level: Medium

Vulnerable Code:

bash

local output_file="/tmp/skill-audit-${skill_name}-suspicious.txt"
cp "$SUSPICIOUS_CODE" "$output_file"

Technical Analysis

The script constructs an output path in the shared /tmp directory using a predictable filename derived from skill_name. It then copies suspicious source content to that path without securely creating the destination, checking whether it is a symbolic link, or restricting its permissions.

Because cp follows a destination symbolic link, another local user may pre-create the predictable path as a symlink to a file writable by the account running the audit. When suspicious code is found, the copy operation overwrites the symlink target.

The generated output is not included in the script's cleanup trap, so scanned source lines may also remain in /tmp after execution. Depending on the process umask and existing destination, this can expose potentially sensitive source content to other local users.

Attack Path

1. The attacker predicts the output path from the audited directory or skill name, such as /tmp/skill-audit-example-suspicious.txt.
2. The attacker creates that path as a symbolic link to a target file writable by the audit user's account.
3. The attacker causes or waits for the user to audit a skill containing a pattern that is copied into SUSPICIOUS_CODE.
4. During LLM analysis, the script executes cp "$SUSPICIOUS_CODE" "$output_file".
5. cp follows the attacker-created symbolic link and overwrites the target with the collected source lines.

Exploitation requires local access sufficient to create entries in /tmp, knowledge or prediction of the skill name, and a target file writable by the account running the scanner.

Impact Assessment

A succes ...[truncated 652 chars]

Remediation

View remediation

Remediation Suggestions

• Create the output with mktemp rather than deriving a predictable path from the skill name:

  bash

  local output_file
  output_file=$(mktemp "${TMPDIR:-/tmp}/skill-audit-suspicious.XXXXXX") || return 1
  chmod 600 "$output_file"
  cp -- "$SUSPICIOUS_CODE" "$output_file"
  

• Prefer a private temporary directory created with mktemp -d, verify that creation succeeds, and store all audit artifacts inside it.
• Add every generated artifact to the exit cleanup routine unless the user explicitly requests retention.
• If retained output is required, create it atomically with restrictive permissions and refuse to use an existing path or symbolic link.
• Do not execute this scanner as root or another privileged account unless strictly necessary.
• Avoid incorporating attacker-controlled skill names into filesystem paths. If a display-oriented name must be retained, sanitize it and keep it separate from the securely generated filename.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

## Maintenance

**Update this skill when new threats are discovered:**

1. New malicious IP → Add to `MALICIOUS_IPS`
2. New malicious domain → Add to `MALICIOUS_DOMAINS`

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/audit.sh (reported line 108)May include surrounding context.

sh

done
        
        # LOW RISK: Sudo
        if echo "$line" | grep -qiE '^sudo |sudo apt|sudo pip|sudo npm'; then
            echo -e "   ${GREEN}[LINE $line_num]${NC} Requires sudo"
            echo "LOW" >> "$FINDINGS_FILE"
        fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

| 🟡 Medium | Access to `~/.openclaw/` | Config theft |
| 🟡 Medium | Reads `$API_KEY` etc. | Credential leakage |
| 🟡 Medium | Social engineering keywords | User deception |
| 🟢 Low | Requires sudo | Elevated privileges |

### L2: Deobfuscation

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

| 🟡 Medium | Access to `~/.openclaw/` | Config theft |
| 🟡 Medium | Reads `$API_KEY` etc. | Credential leakage |
| 🟡 Medium | Social engineering keywords | User deception |
| 🟢 Low | Requires sudo | Elevated privileges |

### L2: Deobfuscation

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/audit.sh (reported line 108)May include surrounding context.

sh

| 🟡 Medium | Access to `~/.openclaw/` | Config theft |
| 🟡 Medium | Reads `$API_KEY` etc. | Credential leakage |
| 🟡 Medium | Social engineering keywords | User deception |
| 🟢 Low | Requires sudo | Elevated privileges |

### L2: Deobfuscation

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/audit.sh (reported line 107)May include surrounding context.

sh

fi
        done
        
        # LOW RISK: Sudo
        if echo "$line" | grep -qiE '^sudo |sudo apt|sudo pip|sudo npm'; then
            echo -e "   ${GREEN}[LINE $line_num]${NC} Requires sudo"
            echo "LOW" >> "$FINDINGS_FILE"

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script advertises an "LLM Analysis" stage and the header/usage text describe an "LLM intent analysis," but this function never invokes an LLM or performs automated analysis. Instead, it copies suspicious code to /tmp and prints a Chinese prompt instructing a separate OpenClaw agent to analyze it manually, which materially contradicts the documented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Suspicious code extracted from scanned skills is copied to a predictable path in /tmp using the skill name, which can expose potentially sensitive or malicious sample content to other local users and creates a target for symlink/race attacks. Because /tmp is world-accessible on many systems, storing analysis artifacts there without restrictive permissions or disclosure increases the risk of unintended data disclosure or file clobbering.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script prints the instruction 分析这段可疑代码: cat $output_file, which hard-codes a Chinese-language prompt for the downstream agent interaction. This imposes a specific language choice on users without offering an alternative or documenting a locale-specific requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.