Security audit

Apprentice

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local workflow-learning tool, but it records and persists user instructions and can execute learned shell scripts with broad local authority that is not clearly or accurately bounded.

Review carefully before installing. Do not teach it workflows that include secrets, customer data, private URLs, credentials, destructive commands, or sensitive operational procedures. Treat any learned workflow as local shell code: preview the generated files, inspect run.sh and SKILL.md, restrict workflow names, avoid passing secrets as variables, and remove raw logs if they contain sensitive content.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: synthesize.py:146
Finding: Persistent Agent Instruction Injection Through Generated Skill Files
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: run.py:84
Finding: Workflow Name Path Traversal Allows Execution of Arbitrary Local Shell Scripts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: run.py:115
Finding: Workflow Execution Exposes the Full Process Environment and Logs Sensitive Variables in Plaintext
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill description promises local observation, learning, and review-based synthesis, but the detected behavior reportedly does not implement those safeguards and instead centers on workflow execution via scripts. This mismatch is dangerous because users may trust the documented privacy and approval model while the real implementation performs materially different actions, enabling deceptive or unsafe execution.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The guidance explicitly encourages users to speak sensitive values such as API keys or environment-variable-related information during observation. Those secrets can be captured into logs or synthesized into reusable workflows, creating direct credential exposure and long-lived secret persistence that could later be replayed, shared, or exfiltrated.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.
md
The generated `SKILL.md` is a full, valid OpenClaw skill. This means:

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module docstring states there are no network calls, yet it launches arbitrary shell scripts that can freely invoke network tools or exfiltrate data. This deceptive assurance is especially dangerous in a skill that persists and replays learned workflows, because users may trust it with sensitive tasks under a false no-network assumption.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is presented as replaying learned workflows, but the implementation can run arbitrary shell scripts with inherited environment, which is a much broader and more dangerous capability than replaying observed steps. Because the product promise emphasizes no-code learning by demonstration, this gap increases the chance that users will unknowingly authorize powerful execution paths.
Content: No source excerpt is available for this finding.

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 95% confidence
Finding: Copying the full process environment into the workflow execution context exposes all ambient secrets and configuration to arbitrary workflow scripts. In a learned-workflow system, this sharply raises the impact of any malicious or compromised workflow because it can read credentials and then use them locally or exfiltrate them.
Content: Scanner excerpt · run.py (reported line 115)May include surrounding context.
python
return # Build environment for run.sh env = os.environ.copy() if variables: for k, v in variables.items(): env[k.upper()] = str(v)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Executing arbitrary bash scripts is an unjustified capability for a no-code workflow-learning skill unless clearly disclosed and tightly controlled. This creates a direct path from learned content to host command execution, enabling destructive actions, persistence, lateral movement, or data theft if a workflow is malicious or tampered with.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README advertises permanent observation and replay of the user's exact actions and decisions, but the surrounding messaging minimizes the operational risk of capturing and re-executing shell commands, file modifications, git operations, or environment-specific steps. In this context, the skill is specifically intended to convert demonstrations into durable automation, so missing strong warnings and execution safeguards materially increases the chance of harmful system-impacting behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The start-observation phrases include broad natural-language expressions such as "Learn this" and "I'll show you," which can plausibly appear in ordinary conversation. In a skill that records and later synthesizes user actions into executable workflows, accidental activation can silently begin capturing sensitive commands, file paths, or operational procedures the user did not intend to persist.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The stop triggers include common phrases like "Done" and "Got it?" that are likely to occur naturally during demonstrations or unrelated conversation. This can prematurely terminate observation, leading to incomplete or malformed learned workflows that may later execute unsafe partial sequences without the user's awareness.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Workflow execution phrases like "Run [workflow-name]" and "Replay [workflow-name]" are underspecified and can overlap with ordinary user requests. Because this skill is designed to execute previously learned workflows, ambiguous invocation raises the risk of unintended shell, file, or git actions being launched from normal conversation rather than explicit user intent.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises capabilities that imply file writing and shell execution but does not declare an explicit tool scope or permissions boundary. That increases the chance of overbroad agent access or silent privilege expansion, making it harder for users and the platform to reason about what the skill can actually do.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Broad trigger phrases such as common conversational expressions can cause the skill to activate unintentionally. In a skill that may record actions or later execute learned workflows, accidental activation can capture sensitive information or initiate behavior the user did not intend.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Ambiguous start/stop observation triggers make it easy for the skill to enter or exit recording mode based on normal speech. That creates a realistic risk of collecting unintended content or failing to stop logging when the user believes observation has ended.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly describes recording everything the user says and storing raw observation logs and learned workflows. Even if storage is local, retaining natural-language transcripts creates a meaningful privacy and data leakage risk because users may reveal secrets, personal data, internal procedures, or regulated information during demonstrations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger lists include everyday phrases like 'Done', 'That's it', or 'I'll show you', which are too generic for reliable control of a powerful skill. This increases the attack surface for accidental invocation and prompt-injection-style conversational collisions during unrelated interactions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The security manifest claims no environment-variable access, but the runner copies the full process environment and passes it to executed workflow scripts. That mismatch can hide exposure of secrets such as API keys, tokens, and credentials to untrusted workflow code and undermines trust in the declared security model.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest understates file access by omitting that the program reads and executes workflows//run.sh. In a workflow-learning skill, hidden execution of additional local files increases risk because operators may believe only metadata and observations are accessed while executable content is actually trusted.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 95% confidence
Finding: The code directly executes a per-workflow shell script via bash, which gives any learned workflow arbitrary code execution on the host. In this skill's context, workflows are user-taught and intended to become permanent/replayable behaviors, so executing run.sh is materially more dangerous than merely narrating or replaying recorded steps.
Content: Scanner excerpt · run.py (reported line 122)May include surrounding context.
python
print() try: result = subprocess.run( ["bash", str(run_script)], env=env, capture_output=False

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The runner executes learned scripts immediately without a confirmation prompt or clear safety warning, which increases the likelihood of accidental execution of dangerous or tampered workflows. In this context, where workflows become permanent and repeatable, the lack of an execution checkpoint makes misuse and surprise behavior more likely.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The generated skill content includes raw step text and examples derived directly from observations, creating durable storage of natural-language data that may contain confidential instructions or user-provided secrets. Because the apprentice skill's purpose is to learn and replay exact workflows forever, the context materially increases the chance that sensitive content will later be surfaced, searched, or executed unintentionally.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This synthesizer intentionally preserves and later replays the user's exact observed workflow text, which can embed secrets, internal URLs, tokens, customer data, or sensitive operational procedures into a permanent skill artifact. In this skill context, that is more dangerous because 'watch me once' workflows are specifically designed for long-term reuse, increasing retention and later disclosure risk across future sessions or users.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The docstring says this function generates a script that 'executes the workflow,' and the embedded SECURITY MANIFEST at L228 states environment variables are accessed. However, the generated script also uses interactive read to collect missing values, meaning its documented variable source is not limited to environment access. This is an active documentation/manifest mismatch inside the generated code rather than a mere omission.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code creates or overwrites SKILL.md and run.sh in the workflow directory, which is a file-write operation covered by the warning requirement for code files. Although the header manifest documents file outputs for developers, there is no confirmation prompt or user-facing disclosure at the point of write before persistent files are created.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.