T05 · Unauthorized Access and Privilege Escalation
Error
- Location
openexec/engine.py:42- Finding
Approval artifacts can be replayed for repeated execution
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenExec — Deterministic Execution Boundary for Agent Systems
Security checks for vulnerabilities and agentic risk
Overview
OpenExec does not look malicious, but its approval, replay, and receipt guarantees are weaker than documented, so it needs review before production or high-impact use.
Treat this as suitable only for local demo or carefully isolated evaluation until the authorization and audit issues are fixed. Do not rely on it for money movement, email sending, infrastructure changes, data deletion, or other high-impact actions unless approvals are made single-use, replay retrieval is authorization-bound, receipts are signed or HMAC-protected, dependencies are reviewed, ClawShield mode and an explicit action allow-list are enforced, and the service is kept behind localhost/firewall isolation.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
openexec/engine.py:16- Finding
Existing-nonce lookup bypasses approval validation and request binding
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
openexec/receipts.py:3- Finding
Unkeyed receipt hashes allow arbitrary receipt forgery
- Content
View full analysis
str: data = f"{exec_id}:{result}" return hashlib.sha256(data.encode()).hexdigest() ``` ```python # openexec/receipts.py:3-5 def verify_receipt(exec_id: str, result: str, receipt: str) -> bool: expected = hashlib.sha256(f"{exec_id}:{result}".encode()).hexdigest() return expected == receipt ``` ### Technical Analysis Receipt generation uses a plain SHA-256 hash over caller-reproducible values. No secret key or digital signature authenticates the receipt. Anyone can therefore generate a valid hash for any chosen execution ID and result. The verification function also does not consult the execution database. It only checks mathematical consistency among three caller-supplied values. As a result, successful verification does not establish that the execution occurred or that OpenExec generated the receipt. This provides accidental-corruption detection but not the documented receipt authenticity or evidence property. ### Attack Path 1. Choose an arbitrary execution ID and fabricated result. 2. Compute `SHA256(exec_id + ":" + result)` locally. 3. Submit the execution ID, result, and calculated digest to `/receipts/verify`. 4. The endpoint returns `{"valid": true}` even though no corresponding execution occurred. ### Impact Assessment An attacker can fabricate apparently valid execution evidence without access to the service or its database. This does not grant code-execution or host privileges, but it undermines audit integrity, non-repudiation, and any external workflow that trusts a successful receipt verification response. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (36)
Known Vulnerable Dependency: cryptography==46.0.5 — 11 advisory(ies): GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); CVE-2026-69247 (cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle th); CVE-2026-69249 (python-cryptography: Duplicate self-signed intermediates can cause exponential p) +8 more
Critical
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The dependency is pinned to cryptography==46.0.5, and the supplied finding indicates multiple published advisories affecting that exact version, including issues in bundled OpenSSL and cryptographic parsing/decryption behavior. In a service whose core trust model relies on signed approval artifacts and verifiable receipts, flaws in the cryptographic library directly undermine signature verification, certificate/path validation, or confidential data handling, making the context more dangerous rather than less.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md - No runtime plugin system - No remote code execution primitives - Static handler registry only - No self-modifying behavior ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## 12. Self-Modification OpenExec does not modify its own code, write executable files, or alter system configuration.
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
This finding is essentially about unverified security claims: the file asserts absence of outbound calls, signed-approval enforcement, pinned behavior, and no runtime downloads without direct proof in the supplied content. Unsupported guarantees are risky in security tooling because they can distort threat modeling and lead users to trust controls that may exist only as documentation statements.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
This finding is essentially about unverified security claims: the file asserts absence of outbound calls, signed-approval enforcement, pinned behavior, and no runtime downloads without direct proof in the supplied content. Unsupported guarantees are risky in security tooling because they can distort threat modeling and lead users to trust controls that may exist only as documentation statements.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding is essentially about unverified security claims: the file asserts absence of outbound calls, signed-approval enforcement, pinned behavior, and no runtime downloads without direct proof in the supplied content. Unsupported guarantees are risky in security tooling because they can distort threat modeling and lead users to trust controls that may exist only as documentation statements.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding is essentially about unverified security claims: the file asserts absence of outbound calls, signed-approval enforcement, pinned behavior, and no runtime downloads without direct proof in the supplied content. Unsupported guarantees are risky in security tooling because they can distort threat modeling and lead users to trust controls that may exist only as documentation statements.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This finding is essentially about unverified security claims: the file asserts absence of outbound calls, signed-approval enforcement, pinned behavior, and no runtime downloads without direct proof in the supplied content. Unsupported guarantees are risky in security tooling because they can distort threat modeling and lead users to trust controls that may exist only as documentation statements.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding is essentially about unverified security claims: the file asserts absence of outbound calls, signed-approval enforcement, pinned behavior, and no runtime downloads without direct proof in the supplied content. Unsupported guarantees are risky in security tooling because they can distort threat modeling and lead users to trust controls that may exist only as documentation statements.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding is essentially about unverified security claims: the file asserts absence of outbound calls, signed-approval enforcement, pinned behavior, and no runtime downloads without direct proof in the supplied content. Unsupported guarantees are risky in security tooling because they can distort threat modeling and lead users to trust controls that may exist only as documentation statements.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This finding is essentially about unverified security claims: the file asserts absence of outbound calls, signed-approval enforcement, pinned behavior, and no runtime downloads without direct proof in the supplied content. Unsupported guarantees are risky in security tooling because they can distort threat modeling and lead users to trust controls that may exist only as documentation statements.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 87% confidence
- Finding
This finding is essentially about unverified security claims: the file asserts absence of outbound calls, signed-approval enforcement, pinned behavior, and no runtime downloads without direct proof in the supplied content. Unsupported guarantees are risky in security tooling because they can distort threat modeling and lead users to trust controls that may exist only as documentation statements.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 87% confidence
- Finding
This finding is essentially about unverified security claims: the file asserts absence of outbound calls, signed-approval enforcement, pinned behavior, and no runtime downloads without direct proof in the supplied content. Unsupported guarantees are risky in security tooling because they can distort threat modeling and lead users to trust controls that may exist only as documentation statements.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says the service 'Runs only with a signed approval artifact (ClawShield mode),' but this endpoint explicitly supports and reports a default 'demo' mode with signature verification disabled. It also reports an 'open' restriction state and warns when no execution allow-list is configured, indicating operation outside the claimed mandatory approval-only model.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The engine explicitly bypasses approval validation in demo mode by setting
approved = Truewithout requiring or verifying a signed approval artifact. That directly contradicts the stated security model that execution is gated by signed approval, so if demo mode is enabled in any reachable environment, unauthorized actions can execute while appearing legitimately approved.- Content
Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'
High
- Category
- Supply Chain
- Confidence
- 70% confidence
- Finding
Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script performs
pip install -r requirements.txt, which directly contradicts the skill metadata claim that no runtime package installation or dynamic downloads occur. This creates supply-chain risk because installation behavior depends on package indexes and the contents ofrequirements.txt, allowing unreviewed or mutable dependencies to be fetched and executed during setup.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Confirm health:
bash curl http://localhost:5000/healthExecute:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md tool_call = model_output["tool_calls"][0] response = requests.post( "http://localhost:5000/execute", json={ "action": tool_call["function"]["name"],
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md tool_call = model_output["tool_calls"][0] response = requests.post( "http://localhost:5000/execute", json={ "action": tool_call["function"]["name"],
Internal Network Request
Medium
- Category
- Server-Side Request Forgery
- Confidence
- 70% confidence
- Finding
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
- Content
md tool_call = model_output["tool_calls"][0] response = requests.post( "http://localhost:5000/execute", json={ "action": tool_call["function"]["name"],
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Line L182 states 'OpenExec determines whether it runs,' which contradicts repeated statements elsewhere in the same file that OpenExec does not define policy, decide approvals, or originate execution authority. The documented intent is that OpenExec verifies externally produced approval artifacts and executes only already-authorized actions, so this wording materially misstates the security boundary.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Forged approval artifacts (ClawShield mode) - Parameter mutation after approval - Silent execution without receipt - Unauthorized execution without approval OpenExec does NOT protect against:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - [ ] Use TLS termination - [ ] Pin dependencies (already enforced in `requirements.txt`) - [ ] Run inside container or VM - [ ] Do NOT run as root - [ ] Configure `OPENEXEC_ALLOWED_ACTIONS` - [ ] Provide valid `CLAWSHIELD_PUBLIC_KEY` - [ ] Protect `CLAWSHIELD_TENANT_ID` appropriately
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - [ ] Use TLS termination - [ ] Pin dependencies (already enforced in `requirements.txt`) - [ ] Run inside container or VM - [ ] Do NOT run as root - [ ] Configure `OPENEXEC_ALLOWED_ACTIONS` - [ ] Provide valid `CLAWSHIELD_PUBLIC_KEY` - [ ] Protect `CLAWSHIELD_TENANT_ID` appropriately
Static analysis
No suspicious patterns detected.