ClawHub
Back to skill

Security audit

Generate Orthopedic Physical Therapy Practice Client Education Handout

Security checks for vulnerabilities and agentic risk

Overview

The skill is a simple handout generator, but it unnecessarily asks for shell access that can affect the user's local system.

Install only if you are comfortable granting this skill shell access, or prefer a version that removes Bash and keeps only the minimum tools needed for drafting, reading user-provided material, and optional image generation. Review any patient-facing medical content with a qualified human before use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:7
Finding
Unpinned Third-Party Installation Sources<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 7–15 **Vulnerability Type**: Supply-chain integrity weakness caused by mutable, unverified installation sources **Risk Level**: Medium ### Evidence ```markdown ### Via ClawHub ```bash clawhub install qiaomu-generate-orthopedic-physical-therapy-practice-client-education-handout ``` ### Manual Installation ```bash git clone https://github.com/qiaomucom/generate-orthopedic-physical-therapy-practice-client-education-handout.git cp -r generate-orthopedic-physical-therapy-practice-client-education-handout ~/.openclaw/skills/generate-orthopedic-physical-therapy-practice-client-education-handout ``` ``` ### Technical Analysis Both documented installation procedures retrieve mutable third-party content without identifying a reviewed package version, immutable Git commit, checksum, or cryptographic signature. The ClawHub command does not visibly pin a specific release. The Git command clones the repository's current default branch rather than a fixed commit. Consequently, the content installed by a user may differ from the content covered by this audit. A compromise of the package publisher, registry entry, GitHub account, repository, or release process could introduce malicious skill instructions or executable content after review. The risk is classified as insecure dependencies because trust is placed in externally maintained supply-chain sources without an integrity control that binds installation to the audited artifact. ### Attack Path 1. An attacker compromises the ClawHub publisher account, registry entry, GitHub account, or repository. 2. The attacker modifies the latest package or default branch to include hostile skill instructions, excessive tool permissions, or executable files. 3. A user follows one of the installation commands in `README.md`. 4. The installation mechanism retrieves the attacker's modified content because no immutable version or commit is specified. 5. OpenClaw ...[truncated 759 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the ClawHub installation to an explicitly reviewed release version, using the registry's supported version-selection mechanism. 2. Pin manual installations to an immutable Git commit rather than relying on the repository's default branch. 3. Publish a SHA-256 or stronger digest for the reviewed artifact and require users to verify it before installation. 4. Cryptographically sign releases and document signature-verification steps. 5. Document the ownership and trust relationship of the ClawHub publisher and GitHub repository. 6. Add a release process that re-runs security review whenever skill instructions, permissions, scripts, or dependencies change. 7. Prefer installation tooling that rejects artifacts whose signature or digest does not match the approved release metadata. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:7
Finding
Unnecessary Bash Permission Violates Least Privilege<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 7 **Vulnerability Type**: Excessive tool authorization **Risk Level**: Medium ### Evidence ```yaml allowed-tools: Bash, Read ``` ### Technical Analysis The skill's documented purpose is to produce an orthopedic physical-therapy client education handout. Its workflow consists of clarifying requirements, drafting content, enriching supporting assets, and refining the result. No documented workflow step requires arbitrary operating-system command execution. Nevertheless, the skill requests access to `Bash`. A general-purpose shell can execute commands, start processes, manipulate files, invoke network-capable utilities, and access resources available to the OpenClaw process. This permission therefore exceeds the least privilege required for the stated task. The declaration alone does not execute commands and is not evidence of current malicious activity. However, pre-authorizing a powerful tool unnecessarily increases the effect of malicious contextual input, compromised skill content, or future instruction changes. ### Attack Path 1. The skill is installed and loaded with its declared `Bash` permission. 2. Attacker-controlled content reaches the agent through a user-supplied request, referenced material, compromised upstream skill update, or other untrusted context. 3. The hostile content instructs or persuades the agent to invoke Bash under the pretext of generating or enriching the handout. 4. Because Bash is already authorized, the agent executes a shell command without needing a legitimate handout-generation requirement. 5. The command accesses or modifies resources available to the OpenClaw process. This exploitation path remains dependent on the agent following hostile instructions and on the runtime's approval and sandboxing behavior. Removing the unnecessary permission eliminates the direct shell-execution channel from this skill. ### Impact Assessment Potential privileges ar ...[truncated 674 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove `Bash` from `allowed-tools` because the documented handout-generation workflow does not require shell execution. 2. Retain only the minimum tools necessary for the task, such as narrowly scoped reading and approved content or image-generation capabilities. 3. Restrict file-reading access to explicitly selected, user-provided resources where the runtime supports path scoping. 4. If a future feature genuinely requires command execution, replace general-purpose Bash access with a purpose-built tool that: - Accepts structured arguments. - Uses a strict command allowlist. - Rejects shell metacharacters and command substitution. - Limits accessible paths. - Runs in a sandbox without sensitive credentials. - Disables network access unless explicitly required. 5. Require explicit user confirmation before any command execution or access to files outside the task workspace. 6. Reassess tool permissions whenever the workflow or external integrations change. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.