Skill Composer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:16 AM UTC
• Version: 1.0.0

Overview

This workflow-composer skill has a coherent purpose, but it can invoke any installed skill and evaluates workflow conditions as Python code, creating review-worthy execution risk.

Install only if you trust the workflow files you will run and are comfortable with a skill that can invoke any installed OpenClaw skill. Prefer previewing workflows first, avoid third-party workflow YAML, and treat this as needing fixes before broad use: replace eval with a strict condition parser, fail closed on invalid conditions, pin dependencies, and restrict callable skills.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: source/composer.py:67

Finding

Arbitrary Code Execution Through Unsafe Workflow Condition Evaluation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: install.sh:20

Finding

Unpinned PyYAML Installation Creates Supply-Chain and Reproducibility Risk

Content

View full analysis

/dev/null; then echo "Installing PyYAML via pip..." pip3 install --user PyYAML ``` The related manifest permits any release satisfying a lower bound and instructs the installer to obtain an unspecified version: ```json "requirements": { "bins": ["python3"], "python": ["PyYAML>=5.4"] }, "install": [ { "id": "python-pyyaml", "kind": "pip", "package": "PyYAML", "label": "Install PyYAML dependency" } ] ``` ### Technical Analysis The pip fallback installs whichever PyYAML release is selected by the package index at installation time. The project does not pin a reviewed version or verify an artifact hash. The manifest similarly accepts any PyYAML version at or above 5.4. This does not demonstrate that PyYAML itself is malicious. The weakness is that separate installations may receive different, previously unreviewed artifacts. A compromised upstream release, package-index account, distribution channel, or future incompatible version could therefore affect installation without any change to this project's reviewed source. Python package installation may execute package build logic under the invoking user's account. Consequently, dependency integrity is relevant even before the composer is run. ### Attack Path 1. The installer runs on a system where `apt-get` is unavailable and `pip3` is present. 2. `pip3 install --user PyYAML` queries the configured package index. 3. The resolver selects the latest compatible artifact because no exact version or hash is required. 4. If the selected upstream artifact or configured index is compromised, malicious installation or runtime code is placed in the user's Python environment. 5. Installation-time code or a later `import yaml` execute ...[truncated 619 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

eval() call detected

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

The workflow file is attacker-controlled input, and this code evaluates its if condition with Python eval(). Even with __builtins__ removed, eval on untrusted expressions is unsafe and can often be abused for denial of service or sandbox escape techniques, while the fallback except: return True also causes malformed or malicious conditions to execute steps by default.

Content

Scanner excerpt · source/composer.py (reported line 74)May include surrounding context.

python

condition = condition.replace(placeholder, str(var_value))
        # 安全评估
        try:
            return eval(condition, {"__builtins__": {}})
        except:
            return True  # 默认执行

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill is explicitly designed to orchestrate execution of other skills and its documentation shows shell-based invocation of a Python runner, yet the manifest declares no tool scope such as permissions or allowed-tools. That means a user or platform cannot easily understand or constrain the file-read and command-execution capabilities implied by the workflow engine, increasing the chance of unexpected downstream file access or side effects from composed skills.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This skill is a workflow composer that chains arbitrary skills, including examples that publish content externally, but the user-facing description does not warn that execution can trigger file writes, external publishing, or other side effects through downstream skills. In this context, missing disclosure is security-relevant because users may treat the composer as a harmless planner when it actually acts as a privileged orchestrator.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file’s human-readable title and step descriptions are entirely in Chinese, and the pipeline is specifically oriented to Chinese platforms like WeChat and Xiaohongshu without offering a language or locale choice. Under the policy rule, forcing a specific language or locale without user opt-in is a natural-language policy concern unless the regional constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This manifest contains user-facing natural language almost entirely in Chinese, including the title, step names, and usage notes. Because it does not offer an opt-in language choice or state that the skill is intentionally limited to Chinese-speaking users or a China-specific workflow, it may violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This YAML file includes only a high-level description of automating a data report and lists related skills, but it does not specify any explicit trigger phrases, scope limits, or exclusion conditions. In a manifest-style file, that ambiguity can cause the skill to be invoked for loosely related requests about reports or stocks without clear boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest explicitly declares "skills": ["*"], allowing this composer skill to invoke or orchestrate any installed skill without scope restriction. In an automation/orchestration context, that broad capability increases blast radius: a malicious or unsafe workflow file could chain together high-privilege skills, access sensitive operations indirectly, or bypass intended least-privilege boundaries between skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring is written in Chinese and presents the skill description and inline documentation in that language without any indication that the user can choose another language. This is a natural-language locale policy concern because the file appears to impose a language preference rather than documenting an optional or region-specific constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The workflow engine expands variables into manifest-supplied conditions and then evaluates them as Python expressions, introducing code-execution-like behavior into a data file that should only describe orchestration. This is especially risky because the tool is explicitly designed to compose multiple skills automatically, so a bypassed or malicious condition can trigger unintended downstream actions across the workflow.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · source/composer.py (reported line 85)May include surrounding context.

python

print(f"     Args: {args}")

        try:
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
            if result.returncode == 0:
                return 'success', result.stdout
            else:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest description forces a specific language/locale in user-facing natural language without indicating user choice or that the skill is restricted to a Chinese-speaking audience. Under the policy, locale-specific language should be optional or clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The entire SKILL.md is presented in Chinese, and there is no note that the skill is region- or locale-specific, nor any offer of alternative language support. This can violate language/locale policy when users are not given a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file's user-facing descriptive comments are entirely in Chinese, which implicitly fixes the skill's language context without offering any user choice or documenting a justified locale restriction. This can conflict with organizational language/locale policy when users have not opted into that language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language description is written solely in Chinese, and the manifest does not indicate that language choice is optional or region-specific. This can violate language/locale policy expectations when a skill is presented to a broader user base without opt-in or justification.

Content

No source excerpt is available for this finding.