T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/check-skill-updates.py:284- Finding
Automatic Installation of Unverified Remote Skill Packages
- Content
View full analysis
- Remediation
View remediation
Security audit
Skills Updater
Security checks for vulnerabilities and agentic risk
Overview
This skill does act as a skill updater, but it can automatically replace installed skills with downloaded packages that are not independently verified.
Install only if you trust this publisher and are comfortable giving it authority to update all local OpenClaw skills. Prefer --dry-run first, avoid --auto for untrusted or important environments, review backups under ~/Desktop/skill-backups/, and understand that HTTPS alone does not prove a downloaded skill package is the intended publisher's signed release.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 92% confidence
- Finding
The updater downloads a zip from a remote registry and replaces the local skill directory with its contents, which is effectively remote self-modification of executable/agent behavior. Although TLS and a basic zip traversal check are present, there is no cryptographic verification of package authenticity or integrity beyond transport, so a compromised registry, malicious publisher, or supply-chain attack could push hostile skill code that the agent later executes.
- Content
python return None def update_skill(self, skill_path: Path, slug: str, latest_meta: Dict) -> bool: """Download and update skill to latest version.""" import tempfile try: # Use the correct download endpoint: /api/v1/download?slug=X&version=Y
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The markdown advertises an
--automode and later explains that the tool creates backups, downloads updates, and applies them to installed skills. Although features like dry-run and backup are documented, there is no clear user warning that running auto-upgrade will modify files under~/.openclaw/skills/and create artifacts on the Desktop and workspace.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md Try cache mode: `--cache-only` ### "Permission denied" Ensure write access to: - `~/.openclaw/skills/` - `~/Desktop/skill-backups/`
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The skill explicitly creates persistent backups of installed skills on the user's Desktop, which can retain executable content, embedded tokens, configuration files, or other sensitive state longer than necessary. Because these backups are stored in a prominent, user-accessible location and preserved for rollback, compromise of the local account or accidental sharing can expose historical skill contents and increase the attack surface.
- Content
Backup & Recovery
Updates create backups at:
text ~/Desktop/skill-backups/ ├── skill-name-1.0.0-20260325-094830/
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python self.scan_time = time.time() - start return self.updates_found def perform_updates(self, auto_approve: bool = False) -> List[Dict]: """Perform updates for found skills.""" if not auto_approve and self.updates_found: print("\n📦 Found updates:")
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python self.scan_time = time.time() - start return self.updates_found def perform_updates(self, auto_approve: bool = False) -> List[Dict]: """Perform updates for found skills.""" if not auto_approve and self.updates_found: print("\n📦 Found updates:")
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python self.scan_time = time.time() - start return self.updates_found def perform_updates(self, auto_approve: bool = False) -> List[Dict]: """Perform updates for found skills.""" if not auto_approve and self.updates_found: print("\n📦 Found updates:")
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python self.scan_time = time.time() - start return self.updates_found def perform_updates(self, auto_approve: bool = False) -> List[Dict]: """Perform updates for found skills.""" if not auto_approve and self.updates_found: print("\n📦 Found updates:")
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The document states that the tool fetches latest versions from the ClawHub API and downloads updates, but it does not explicitly warn users that running non-cache modes will contact a remote service. For markdown files, user-facing descriptions should disclose behaviors that may affect privacy or system integrity, especially network activity tied to local skill inventory and update application.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The title and opening description lead with Chinese text, followed by English, which can indicate a default language choice baked into the skill presentation. The file does not explicitly state that users may choose their preferred language or that the bilingual format is optional or region-specific.
- Content
Static analysis
No suspicious patterns detected.