T09 · Insecure Skill Coding Practices
Error
- Location
scripts/create_agent.sh:222- Finding
Command Injection Through Unsafe GNU sed Replacement
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Factory
Security checks for vulnerabilities and agentic risk
Overview
This agent-creation skill is mostly purpose-aligned, but it performs persistent OpenClaw configuration changes and contains real input-handling flaws that could let crafted agent names or IDs corrupt files or execute commands.
Install only after review or patching. Expect it to create persistent agent workspaces and modify the global OpenClaw config. Do not let untrusted users or prompts choose agent IDs or names until the sed templating, post-sanitization ID validation, predictable temp file, and hardcoded USER.md identity are fixed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/create_agent.sh:35- Finding
Post-Sanitization Empty Agent ID Escapes the Intended Agent Workspace
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/create_agent.sh:234- Finding
Predictable Temporary Configuration File Enables Symlink and Race Attacks
- Content
View full analysis
"$TEMP_FILE" && mv "$TEMP_FILE" "$CONFIG_FILE" ``` ### Technical Analysis The temporary configuration pathname is derived solely from the process ID and is placed in the globally shared `/tmp` directory. The script does not create the file exclusively, verify its type or ownership, set restrictive permissions, or protect the operation against symbolic links. A local attacker who can predict or observe the process ID may pre-create `/tmp/openclaw_agent_.json` as a symbolic link. Shell redirection follows that link before `jq` starts, potentially truncating and writing to another file accessible to the Skill's execution user. There is also a time-of-check/time-of-use opportunity around writing and moving the pathname. The script does not install a cleanup trap, and the temporary file may inherit permissions affected by the caller's `umask`. ### Attack Path 1. A local attacker predicts or observes the PID of a forthcoming or running `create_agent.sh` process. 2. The attacker creates the corresponding `/tmp/openclaw_agent_.json` pathname as a symbolic link to a targ ...[truncated 923 chars]- Remediation
View remediation
"$TEMP_FILE" jq empty "$TEMP_FILE" mv -- "$TEMP_FILE" "$CONFIG_FILE" trap - EXIT ``` ]]>
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill advertises agent creation and switching, but the documentation also reveals privileged side effects: automatic creation of many files and modification of the global OpenClaw configuration. That mismatch is dangerous because users may invoke a seemingly simple management skill without understanding it performs persistent filesystem writes and changes shared runtime state, which can enable persistence, misconfiguration, or unintended agent capabilities.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill's natural-language description and usage instructions are presented in Turkish throughout the file, which effectively forces a specific language for users. The file does not offer an alternative language, user opt-in, or a documented reason for a Turkish-only locale constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The create-agent flow states that files are automatically created, but it does not clearly warn that this is a persistent write operation affecting agent state and configuration. In a skill that provisions new agents, hidden persistence is security-relevant because it can surprise operators, complicate auditing, and create attack surface through generated files and config entries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The documentation highlights Google Sheets access and cron job creation as available to all generated agents but does not warn that these are write-capable integrations and persistence mechanisms. In this context, granting every new agent spreadsheet modification and scheduled task capability increases the blast radius if an agent is misused or prompted maliciously.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This shell script performs safety-relevant file creation throughout the agent workspace and later modifies the shared configuration file, but it does so immediately once required arguments are present. Although there are progress messages, there is no user confirmation step warning that persistent filesystem and config changes will be made.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script hardcodes a specific person's name into every generated USER.md, causing unnecessary propagation of personal data to all new agent workspaces. This creates privacy risk, can misattribute ownership or identity across agents, and may expose personal information to other users, tools, backups, or logs without consent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes this skill as creating agents and switching between agents. In addition to creating agent files and updating config, the script prepares a dedicated cron directory, generates cron documentation, and creates a sample scheduled task file with instructions to copy it into the global cron area, introducing task-scheduling capability not justified by the stated purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
User-facing comments, usage text, prompts, and generated markdown content are written exclusively in Turkish, which imposes a language choice by default. The file does not indicate that the skill is intentionally restricted to Turkish-speaking users or provide any opt-in language selection.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The script writes guidance into SOUL.md that includes 'Dışarıya veri gönderme' as a boundary, which reads as a prohibition on sending data outward. But later it generates TOOLS.md stating the agent is accessed via Telegram and WhatsApp, and HEARTBEAT.md comments mention heartbeat API calls, creating contradictory embedded intent documentation about external communication.
- Content
Static analysis
No suspicious patterns detected.