ClawHub
Back to skill

Security audit

agent-init

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed OpenClaw workspace initializer, but it includes an unsafe optional installer that runs remote shell code without verification.

Review carefully before installing. Use the workspace-generation parts only with trusted input, confirm every generated file before writing, and avoid the --install path unless you replace the curl-to-sh uv installer with a pinned and verified installation method.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/check-env.sh:45
Finding

Unverified Remote Installer Is Downloaded and Executed Directly

Content
View full analysis
/dev/null; then echo "uv: installed successfully — $(uv --version 2>&1)" else echo "uv: installation failed — check PATH" exit 1 fi ``` `scripts/check-env.sh:77-82`: ```bash if command -v uv &>/dev/null; then echo "✅ uv is available. Use 'uv venv' and 'uv pip install' for Python." else echo "⚠️ uv is missing. Run: curl -LsSf https://astral.sh/uv/install.sh | sh" fi ``` `SKILL.md:87`: ```markdown - If uv missing: `curl -LsSf https://astral.sh/uv/install.sh | sh` ``` `references/openclaw-workspace.md:48`: ```markdown - If `uv` is missing, install: `curl -LsSf https://astral.sh/uv/install.sh | sh` ``` ### Technical Analysis The Skill retrieves a mutable shell script from an external URL and streams it directly into `sh`. No version is pinned, and the downloaded content is not authenticated using a cryptographic signature or verified against a known checksum. The command also prevents the user from reviewing the complete payload before execution. The executable path in `scripts/check-env.sh` is conditional on the `--install` argument, but `SKILL.md` explicitly directs the agent to invoke that mode when Python support is requested. The same unsafe command is also required in generated `TOOLS.md` content and repeated as a recommendation by the environment-checking script. HTTPS protects the connection in transit under normal conditions, but it ...[truncated 2184 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:100
Finding

Shell-Based Workspace Generation Permits Heredoc and Path Injection

Content
View full analysis
{workspacePath}/workspace/SOUL.md << 'ENDOFFILE' [content] ENDOFFILE ``` ```bash docker exec -i sh -c 'cat > /home/node/.openclaw/workspace/SOUL.md' << 'ENDOFFILE' [content] ENDOFFILE ``` ### Technical Analysis The documented write procedure inserts generated, interview-derived content into a shell heredoc terminated by a fixed delimiter, `ENDOFFILE`. Quoting the delimiter prevents shell expansion inside ordinary heredoc content, but it does not prevent delimiter collision. If generated content contains a line consisting exactly of `ENDOFFILE`, the shell treats that line as the end of the heredoc. Any subsequent generated lines become shell syntax rather than file content. This creates a command-injection boundary when untrusted or adversarial interview input is incorporated into the generated document. The external-instance example also interpolates `{workspacePath}` into an unquoted shell redirection target. If the substituted path contains shell metacharacters or whitespace and is not independently validated, parsing may differ from the intended single destination path. In the container example, `` is likewise interpolated as a shell argument without a documented format validation step. The mandatory “show before write” workflow reduces the likelihood of unnoticed exploitation, but it does not remove the underlying injection primitive. Users may approve generated content without recognizing that a standalone heredoc delimiter changes how the shell parses the resulting command. ### Attack Path 1. An attacker supplies interview content intended to be included in a generated workspace Markdown file. 2. The supplied content includes a standalone `ENDOFFILE` line ...[truncated 1357 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is presented as an interview-driven workspace initializer, but the documented behavior includes environment inspection, docker interaction, file writes, and optional remote installation via curl | sh. This mismatch is dangerous because users may consent to a seemingly benign setup workflow without realizing the skill can perform higher-risk system modification actions.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The | sh chaining pattern is a classic command-execution sink because it transforms downloaded data directly into shell commands without validation. This eliminates opportunities for inspection and magnifies the impact of any compromise of the remote source, DNS, TLS termination, or hosting infrastructure.

Content

Scanner excerpt · scripts/check-env.sh (reported line 45)May include surrounding context.

sh
if [ "$INSTALL" = "--install" ]; then
    echo ""
    echo "Installing uv..."
    curl -LsSf https://astral.sh/uv/install.sh | sh
    echo ""
    # Source the env to pick up uv
    export PATH="$HOME/.local/bin:$PATH"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill directs the agent to run shell commands, write files, use docker exec, and potentially install software, but it does not declare any explicit tool scope or allowed-tools constraints. This weakens least-privilege controls and can cause the skill to be invoked with broader execution capability than users may expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation criteria are broad enough to match routine setup, customization, or troubleshooting requests, which increases the chance of this skill being selected in situations where powerful shell and file-modification behavior is unnecessary. Over-broad triggering expands the attack surface and raises the likelihood of accidental execution of sensitive operations.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

ls -la {workspacePath}/workspace/*.md

Container

docker exec ls -la /home/node/.openclaw/workspace/*.md

text

## Reference Files

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script executes code fetched directly from a remote URL via a shell pipeline, which creates a supply-chain and remote-code-execution risk. If the upstream site, transport path, or install script is compromised, running this option will execute attacker-controlled commands on the host with the user's privileges.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

Using curl piped directly to sh executes remote code without prior verification, integrity checking, or review. In a skill that may run on host or container environments, this creates a clear supply-chain and arbitrary code execution risk if the remote script is compromised, tampered with, or unexpectedly changed.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

  • Create venv: uv venv .venv
  • Install: uv pip install <package>
  • Run: uv run python script.py
  • If uv missing: curl -LsSf https://astral.sh/uv/install.sh | sh
text

### Phase 4: Write Files

External Script Fetching

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The guidance recommends piping a remotely fetched script directly into a shell, which bypasses integrity verification and executes whatever the remote server returns at install time. In an agent-initialization skill, this is more dangerous because it may be copied into generated workspace instructions and later executed on host systems, expanding the blast radius beyond an isolated example.

Content

Scanner excerpt · references/openclaw-workspace.md (reported line 48)May include surrounding context.

  • Install package: uv pip install <package>
  • Run script: uv run python script.py
  • NEVER use pip install directly — always use uv
  • If uv is missing, install: curl -LsSf https://astral.sh/uv/install.sh | sh
text

## Agent Creation Rules

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

Fetching an external script and immediately executing it with sh is dangerous because it grants the remote content full execution on the local machine. In an agent-init skill, this is more dangerous because the skill is specifically used to bootstrap environments, making users more likely to run it on developer workstations or hosts that contain credentials and source code.

Content

Scanner excerpt · scripts/check-env.sh (reported line 45)May include surrounding context.

sh
if [ "$INSTALL" = "--install" ]; then
    echo ""
    echo "Installing uv..."
    curl -LsSf https://astral.sh/uv/install.sh | sh
    echo ""
    # Source the env to pick up uv
    export PATH="$HOME/.local/bin:$PATH"

External Script Fetching

Low
Category
Supply Chain
Confidence
87% confidence
Finding

This instance is in a recommendation string rather than executed code, so it does not directly run during script execution. However, it still encourages an unsafe installation practice that, if copied by a user, could lead to remote code execution from a compromised or malicious upstream script.

Content

Scanner excerpt · scripts/check-env.sh (reported line 81)May include surrounding context.

sh
if command -v uv &>/dev/null; then
  echo "✅ uv is available. Use 'uv venv' and 'uv pip install' for Python."
else
  echo "⚠️  uv is missing. Run: curl -LsSf https://astral.sh/uv/install.sh | sh"
fi

Static analysis

No suspicious patterns detected.