ClawHub
Back to skill

Security audit

OpenClaw-Halo-CMS

Security checks for vulnerabilities and agentic risk

Overview

This Halo blog-management skill is purpose-related, but it uses under-disclosed credentials and can make live CMS changes without strong built-in safeguards.

Review before installing. Use a least-privilege Halo account, avoid placing unrelated .env.halo files in parent directories, set HALO_URL only to a trusted Halo instance, and require explicit user confirmation before publishing, replying, creating tags, or recycling posts/comments.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (6)

Tainted flow: 'req' from os.environ.get (line 91, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
data = json.dumps(body).encode() if body else None
    req = urllib.request.Request(url, data=data, headers=headers, method=method)
    try:
        with urllib.request.urlopen(req) as resp:
            rdata = resp.read().decode()
            if resp.status == 204 or not rdata:
                return None
Confidence
88% confidence
Finding
The request URL is built from HALO_URL, which is taken from the environment without validation, and then sent via urllib.request.urlopen. An attacker who can influence environment variables can redirect authenticated requests, including Basic Auth credentials and blog content, to an attacker-controlled host, causing credential exfiltration or SSRF-style outbound access.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares access to an environment secret (`HALO_PAT_TOKEN`) and uses networked API calls, but does not declare corresponding permissions. This creates a capability/permission mismatch that can bypass expected operator review and increase the chance that a token-bearing skill is installed or invoked without users understanding its access to authenticated CMS operations.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The skill recursively searches the workspace and parent directories for a .env.halo file and reads credentials from it, which expands its access beyond explicit user input. In an agent setting, this can unintentionally harvest secrets from nearby directories and use them automatically, violating least privilege and increasing secret exposure risk.

Intent-Code Divergence

Low
Confidence
78% confidence
Finding
The function claims to reject dangerous content, but it only emits warnings and still publishes posts or replies. This mismatch can cause operators to rely on a non-existent safeguard, leading to accidental publication of secrets such as tokens, passwords, or internal IP information.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger phrases are broad and overlap with common conversation topics such as writing a blog post, posting, replying to comments, or mentioning Halo. That raises the likelihood of accidental invocation, which is more dangerous here because the skill can use a PAT-backed API to create content or interact with comments on a live CMS.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The script consumes credentials from environment variables and .env.halo without any user-facing disclosure or consent boundary. In an agent context, hidden secret use is risky because users may trigger the skill without realizing it will access and transmit stored credentials to perform authenticated actions.

Static analysis

No suspicious patterns detected.