Workspace Audit

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:59 AM UTC
• Version: 1.1.0

Overview

The skill is a coherent local workspace auditor, but review is warranted because one script executes its config file as shell code.

Install only if you are comfortable running local audit scripts over your OpenClaw workspace and optional 1Password metadata. Before scheduling it or running it in a sensitive environment, replace or review audit-structure.sh's config loading so audit.conf is parsed as data rather than sourced as shell code, and keep AUDIT_CONFIG unset unless you control the target file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/audit-structure.sh:10

Finding

Arbitrary Shell Command Execution Through Unsafe Configuration Loading

Content

View full analysis

Vulnerability Details

File Location: scripts/audit-structure.sh, lines 10–14
Vulnerability Type: Unrestricted execution of a configuration file as Bash code
Risk Level: High

Vulnerable Code

bash

CONF="${AUDIT_CONFIG:-$SKILL_DIR/audit.conf}"

# Load custom limits if config exists
if [ -f "$CONF" ]; then
  # shellcheck source=/dev/null
  source "$CONF"
fi

Technical Analysis

The script documents audit.conf as a data-only configuration file containing numeric size limits. However, Bash's source command does not parse the file as data; it executes every statement in the file in the current shell process.

Consequently, any command placed in the selected configuration file runs with the privileges and environment of the user or Agent invoking the audit. The risk is increased because the AUDIT_CONFIG environment variable can select an arbitrary readable file. The script performs no path restriction, ownership or permission validation, key allowlisting, value validation, or rejection of executable shell syntax.

This issue is classified as T09: Insecure Skill Coding Practices because an unsafe configuration-loading mechanism creates a direct command-execution vulnerability. There is no evidence that the project itself supplies a malicious configuration file.

Attack Path

1. An attacker gains the ability to create or modify the default audit.conf in the Skill directory, or influence the AUDIT_CONFIG environment variable used when the audit runs.
2. The attacker places arbitrary shell commands in the selected file, for example:

   bash

   AGENTS_LIMIT=1000
   attacker_controlled_command
   

3. A user or Agent runs scripts/audit-structure.sh, directly or through scripts/audit-all.sh.
4. The script confirms only that the selected path is a regular file.
5. source "$CONF" executes the attacker's commands in the audit process.
6. The commands inherit the invo ...[truncated 922 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove source "$CONF" and treat the configuration strictly as data.
2. Accept only an explicit allowlist of supported keys:
   • AGENTS_LIMIT
   • SOUL_LIMIT
   • USER_LIMIT
   • IDENTITY_LIMIT
   • TOOLS_LIMIT
   • HEARTBEAT_LIMIT
   • MEMORY_LIMIT
3. Validate every value against a strict decimal-integer expression such as ^[0-9]+$, then enforce reasonable minimum and maximum bounds.
4. Reject unknown keys, duplicate assignments, command substitutions, shell expansions, redirections, and other shell syntax.
5. Prefer a non-executable format such as JSON parsed with Python's standard library, which is already a declared runtime requirement.
6. If AUDIT_CONFIG must remain configurable, resolve it to a canonical path and restrict it to an approved directory. Validate that it is a regular file, is not a symbolic link, and has trusted ownership and permissions.
7. Run the audit under a least-privileged account without unnecessary secrets in its environment.

A safe parser should read each permitted assignment as text and assign validated values without eval, source, or equivalent dynamic execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description presents a broad workspace drift auditor covering several categories, but the supplied code only implements one specific check: 1Password vault item/reference mismatch auditing using TOOLS.md and the 1Password CLI. This is a materially narrower primary purpose than declared. The 'Zero deps' statement is also inaccurate because the script requires the external op CLI, plus authentication to 1Password. While 1Password vault mismatch checking is part of the declared scope, the code chunk does not represent the broader described functionality and includes a contradictory dependency requirement.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad workspace drift audit covering stale paths, duplicate content, oversized files, secret leaks, and 1Password vault mismatches. The supplied code chunk performs a much narrower audit: it inspects a hardcoded list of workspace markdown files, detects duplicate section headers, and flags credential- or personality-related lines outside expected files. There is no logic for stale path validation, file size analysis, or comparing against 1Password vault state. The duplicate-content check is limited to section headers rather than general content duplication. Also, while 'zero deps' may be marketing language, the script explicitly requires python3 in addition to bash, so the implementation does not fully align with that claim. Overall, the actual behavior is materially narrower than the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code does implement parts of the description, especially oversized-file checks and limited secret-leak scanning. However, several prominently declared capabilities are absent: there is nothing checking stale paths, duplicate content, or 1Password vault mismatches. Instead, the script primarily audits workspace structure, required files, skill metadata, memory hygiene, and basic git configuration. That makes the declared description materially broader and partially inaccurate relative to the actual behavior.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit-structure.sh (reported line 153)May include surrounding context.

sh

# Check .gitignore for secrets
  if [ -f "$WS/.gitignore" ]; then
    for pattern in "*.key" "*.pem" ".env" "secrets*"; do
      if grep -qF "$pattern" "$WS/.gitignore"; then
        :
      else

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence

Finding

The skill advertises executable scripts and documents use of environment variables, including authentication material such as OP_SERVICE_ACCOUNT_TOKEN, but the manifest does not declare any explicit tool scope or permissions boundary. In agent ecosystems that rely on manifest-declared capabilities, this can cause overbroad execution or hidden access to environment-backed secrets without clear operator consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

Yes. Create an `audit.conf` file in the skill directory with variables like `MEMORY_LIMIT=200` or `AGENTS_LIMIT=500`. See `audit.conf.example` for all options.

**How do I run it on a schedule?**
Add a cron job that calls `bash skills/workspace-audit/scripts/audit-all.sh`. It returns exit code 1 if issues are found, so your agent can alert you only when something drifts.

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script unconditionally sources a configuration file from either AUDIT_CONFIG or a path under the skill directory, which executes arbitrary shell code in the current process rather than merely parsing key/value settings. If an attacker can modify that file or influence AUDIT_CONFIG, running this audit script results in arbitrary command execution with the user's privileges.

Content

No source excerpt is available for this finding.