Back to skill

Security audit

DualAgentSolver

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned, but it automatically stores full run data and can send generated problem-solving content to OpenAI when an API key is present, so it needs review before installation.

Review before installing. Use it only for non-sensitive problems unless you are comfortable with full run data being stored in OpenBrain memory and, when OPENAI_API_KEY is set, generated critic inputs being sent to OpenAI. Unset OPENAI_API_KEY for local OpenClaw-only critic behavior and review or delete stored memories after sensitive runs.

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Warning
Location
scripts/dual_agent_solver.py:97
Finding

Potential Disclosure of Internal OpenBrain Context to an External Model Provider

Content
View full analysis
str: key = os.environ.get("OPENAI_API_KEY") if not key: return openclaw_agent_turn(system_role, prompt) payload = { "model": os.environ.get("SOLVER_SECOND_MODEL", "gpt-4o-mini"), "messages": [ {"role": "system", "content": system_role}, {"role": "user", "content": prompt}, ], "temperature": 0.2, } headers = {"Authorization": f"Bearer {key}"} out = post_json("https://api.openai.com/v1/chat/completions", payload, headers=headers, timeout=90) return out["choices"][0]["message"]["content"].strip() ``` ```python # Optional context pull q = args.query.replace('\\', '\\\\').replace('"', '\\"') gql = 'query { searchDocs(query: "' + q + '", limit: 4) { nodes { ... on Guide { title href content } ... on CLICommandReference { title href content } } } }' ctx = mcp_call(docs_tool, {"graphql_query": gql}) context = extract_text(ctx.get("result"))[:6000] if ctx.get("ok") else "" solver_role = ( "You are Agent A (OpenClaw primary solver). Produce practical implementation plans with clear steps, tradeoffs, and rollback strategy." ) critic_role = ( "You are Agent B (adversarial reviewer). Find hidden risks, edge cases, missing assumptions, and force stronger plans." ) a_plan = "" b_crit = "" rounds = [] for i in range(1, max(1, args.rounds) + 1): a_prompt = ( f"Round {i}. Problem: {args.query}\n\n" f"Context:\n{context}\n\n" f"Previous critique:\n{b_crit}\n\n" "Output:\n1) Proposed solution\n2) Steps\n3) Risks\n4) Rollback" ) a_plan = openclaw_agent_t ...[truncated 3072 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/dual_agent_solver.py:139
Finding

Untrusted Retrieved Documents Are Inserted into Agent Prompts Without Prompt-Injection Isolation

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill invokes shell, reads environment variables, and uses networked services, but it does not declare any tool scope or permission boundaries. That omission weakens reviewability and consent, because an operator cannot easily tell from the skill manifest that running it may access secrets, call external services, or execute local commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The top-level skill description says the final solution is stored in Open Brain memory, but it does not clearly warn that execution persists user-derived content into a database/memory store. In a collaborative solver skill, users may supply sensitive operational, business, or credential-adjacent information, so undisclosed persistence creates privacy, retention, and data-governance risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dual_agent_solver.py (reported line 84)May include surrounding context.

python
def openclaw_agent_turn(system_role: str, prompt: str) -> str:
    msg = f"SYSTEM ROLE:\n{system_role}\n\nTASK:\n{prompt}"
    cmd = ["openclaw", "agent", "--json", "--agent", "main", "--thinking", "off", "--message", msg]
    out = subprocess.check_output(cmd, text=True, stderr=subprocess.STDOUT)
    data = parse_openclaw_json(out)
    payloads = data.get("payloads", [])
    if not payloads:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

If OPENAI_API_KEY is present, the skill silently sends the critic prompt, which includes the user's query and generated plan content, to an external OpenAI endpoint. This materially expands the trust boundary beyond the advertised two-agent/OpenClaw workflow and can expose sensitive user data, internal context, or generated operational plans to a third party without explicit consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This code explicitly posts content to https://api.openai.com/v1/chat/completions, creating an external data egress path for user input and generated content. In the context of a solver skill that may process sensitive prompts and planning data, that transmission is dangerous unless clearly disclosed, justified, and controllable.

Content

Scanner excerpt · scripts/dual_agent_solver.py (reported line 105)May include surrounding context.

python
"temperature": 0.2,
    }
    headers = {"Authorization": f"Bearer {key}"}
    out = post_json("https://api.openai.com/v1/chat/completions", payload, headers=headers, timeout=90)
    return out["choices"][0]["message"]["content"].strip()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill transmits user query content and generated plan text to an external API without any visible notice or consent mechanism. Even if the transmission is intentional for functionality, undisclosed external sharing can violate user expectations and expose sensitive operational or personal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The context retrieval step sends the user's raw query over MCP to another service without any user-facing warning. In a problem-solving skill, queries may contain sensitive business, security, or personal information, so undisclosed forwarding increases privacy and trust-boundary risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code stores the full query, all intermediate solver/critic rounds, and the final solution in the memories table, despite the skill description implying only the merged final solution will be stored. This can retain sensitive prompts, internal reasoning artifacts, and potentially confidential context longer than users expect, increasing privacy and data-governance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill automatically persists the run data to a SQL-backed memories table without warning, including user query material and intermediate model outputs. Silent persistence is especially risky here because the workflow is collaborative and iterative, causing more potentially sensitive content to be retained than users may realize.

Content

No source excerpt is available for this finding.