T07 · Tool Hijacking and Spoofing
Error
- Location
extension/index.ts:83- Finding
Unauthenticated Legacy HTTP Control Plane Enables Godot Session Spoofing and Command Interception
- Content
View full analysis
- Remediation
View remediation
Security audit
Openclaw Godot Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Godot editor integration, but it deserves Review because it installs a persistent gateway extension that can mutate projects and exposes an under-protected HTTP control channel in some configurations.
Install only if you trust the local machine and Godot project, keep the bridge bound to localhost, do not expose the gateway port to shared or public networks, and use version control or backups before allowing scene saves, node deletion, input simulation, or script/project inspection. Review existing ~/.openclaw/extensions/godot contents before running the installer because it may overwrite files.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description focuses on runtime capabilities for controlling the Godot Editor and manipulating project/editor state. The actual code chunk does not implement any of those editor-control behaviors. Instead, it performs local installation of an extension by copying files into ~/.openclaw/extensions/godot and prompting a gateway restart. That is a materially different primary purpose and introduces filesystem modification capabilities that are not described. This is not merely a supporting detail of editor control in the supplied chunk; the entire chunk is an installer, so the description does not accurately represent what this code actually does.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
openclaw godot status
Check skill available
ls ~/.openclaw/workspace/skills/godot-plugin/SKILL.md
text ## Requirements
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill metadata frames usage as limited to trusted local projects, but the documentation explicitly supports a remote gateway mode for Telegram/Discord and other channels. This inconsistency can cause users to underestimate exposure, especially because the skill can control a live editor, read scripts/logs, capture screenshots, and perform destructive actions remotely.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The security guidance contradicts the meaning of disableModelInvocation by recommending 'true' while justifying it with autonomous AI behavior, even though 'true' blocks auto-invocation. Misstated security semantics can lead operators to configure the skill incorrectly, potentially enabling unintended model-triggered access to editor-control capabilities.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ### Recommendation: **`true`** **Reason:** During Godot development, it's useful for AI to autonomously perform supporting tasks like checking scene tree, taking screenshots, and inspecting nodes. **When to use `true`:** For sensitive tools (payments, deletions, message sending, etc.)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The godot_execute tool exposes powerful editor actions, including explicitly destructive ones like node.delete and scene/resource modifications, without any built-in confirmation, policy gate, or allowlist for sensitive operations. In an agent-driven workflow, this creates a real risk that a mistaken prompt, prompt injection, or model error can irreversibly modify or delete project assets without the user knowingly approving the action.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file includes a Korean-only summary line alongside English content, but does not state whether multilingual presentation is intentional, optional, or targeted to a specific locale. Under the policy rule, language-specific content can be a concern when a skill imposes or assumes a locale without user opt-in or clear justification.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README first states the project is under the MIT License at L71-L73, then immediately states it has been licensed under Apache-2.0 since initial release at L75-L77. These two documentation statements actively contradict each other, creating a clear divergence in declared intent/documentation even though the code behavior is not implicated.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script recursively copies the extension into a fixed user extension directory without checking for pre-existing files, prompting the user, or creating a backup. That can unintentionally overwrite an existing Godot/OpenClaw extension installation or locally modified files, causing loss of user changes or installation of unintended content.
- Content
Static analysis
No suspicious patterns detected.