T09 · Insecure Skill Coding Practices
Error
- Location
unpack.js:40- Finding
Shell Command Injection Through User-Controlled Unpack Paths
- Content
View full analysis
- Remediation
View remediation
Security audit
Birth System Manager
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent local birth-identity and migration purpose, but it handles wallet keys, archives workspace data, and unpacks archives in ways that can expose secrets or overwrite trusted files.
Review this skill carefully before installing. It should only be used in a contained environment with non-valuable test wallets unless the code is changed to avoid plaintext private keys, stop printing secrets, restrict package contents, and validate migration archives before extraction.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (7)
T07 · Tool Hijacking and Spoofing
Error
- Location
unpack.js:34- Finding
Unverified Migration Archive Can Overwrite Trusted Agent Content
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
pack.js:18- Finding
Wallet Backup Password Is Disclosed Alongside Encrypted Key Material
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
generate-birth-id.js:42- Finding
Ethereum Private Key Is Persisted in Plaintext
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
decrypt-wallet.js:78- Finding
Wallet Decryption Exposes the Full Private Key Through Output or Disk
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
pack.js:332- Finding
Migration Package Copies Agent Workspace and Memory Without Confidentiality Protection
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
clone-init.js:87- Finding
Clone Initialization Persists Changed Identity Data With a Stale Signature
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (36)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description focuses on birth-system management, but the documented packaging behavior is broader and may archive workspace, skills, or memory content, creating a data exfiltration and oversharing risk. Packaging more than the user reasonably expects is dangerous because local archives often become transferable artifacts that can leak secrets, history, or other sensitive state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description focuses on birth-system management, but the documented packaging behavior is broader and may archive workspace, skills, or memory content, creating a data exfiltration and oversharing risk. Packaging more than the user reasonably expects is dangerous because local archives often become transferable artifacts that can leak secrets, history, or other sensitive state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description focuses on birth-system management, but the documented packaging behavior is broader and may archive workspace, skills, or memory content, creating a data exfiltration and oversharing risk. Packaging more than the user reasonably expects is dangerous because local archives often become transferable artifacts that can leak secrets, history, or other sensitive state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description focuses on birth-system management, but the documented packaging behavior is broader and may archive workspace, skills, or memory content, creating a data exfiltration and oversharing risk. Packaging more than the user reasonably expects is dangerous because local archives often become transferable artifacts that can leak secrets, history, or other sensitive state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description focuses on birth-system management, but the documented packaging behavior is broader and may archive workspace, skills, or memory content, creating a data exfiltration and oversharing risk. Packaging more than the user reasonably expects is dangerous because local archives often become transferable artifacts that can leak secrets, history, or other sensitive state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description focuses on birth-system management, but the documented packaging behavior is broader and may archive workspace, skills, or memory content, creating a data exfiltration and oversharing risk. Packaging more than the user reasonably expects is dangerous because local archives often become transferable artifacts that can leak secrets, history, or other sensitive state.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description focuses on birth-system management, but the documented packaging behavior is broader and may archive workspace, skills, or memory content, creating a data exfiltration and oversharing risk. Packaging more than the user reasonably expects is dangerous because local archives often become transferable artifacts that can leak secrets, history, or other sensitive state.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script writes sensitive wallet material, including a private key, to disk in JSON without any user-facing warning, encryption, or permission hardening. In the context of an agent skill, this is especially risky because users may not expect credential generation and storage, and any local attacker, backup system, or accidental file exposure could compromise the key.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js fs.chmodSync(envScriptPath, '0o755'); console.log(`✅ Environment script created: ${envScriptPath}\n`); // Step 7: Display instructions console.log('✨ Unpack completed successfully!\n'); console.log('Next Steps:'); console.log(' 1. Source environment:');
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README advertises a wallet decryption capability but does not clearly warn that this action may expose raw private key material in process output, terminal history, logs, screenshots, or copied text. In a skill centered on agent identity and Ethereum-backed cryptographic proof, that omission is materially risky because users may invoke decryption casually and irreversibly compromise the wallet used to assert identity.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill invokes local Node scripts and explicitly relies on environment variables such as BIRTH_PRIVATE_KEY_PASSWORD and IS_CLONE, but it does not declare any tool scope or permissions boundary. Missing scope declarations increase the chance that an agent can access environment-sourced secrets or execute behaviors beyond what operators expect, reducing reviewability and containment.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases use broad natural-language matching such as "or similar," which can cause the skill to activate on unintended requests and run local scripts that create wallets, mutate identity state, or package data. Overbroad invocation is especially risky here because the actions are stateful and touch sensitive files and secrets.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
Generating a persistent Ethereum wallet, birth identifier, and signature creates durable identity artifacts tied to the local environment. Even without network use, this introduces session persistence and potentially long-lived sensitive state that can be copied, packed, or later disclosed, making subsequent compromise more damaging.
- Content
md - When user says "birth init", "generate birth id", "出生认证", "初始化出生系统" or similar: Run: node {baseDir}/generate-birth-id.js This will generate a unique Birth ID for new instances, create an Ethereum wallet, and generate a cryptographic signature. If IS_CLONE=true is set, it will automatically generate a clone Birth ID. Return the generated Birth ID, wallet address, and signature verification status.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The general activation clause is ambiguous and may cause the skill to engage for broad discussion of the birth system rather than clear execution requests. In this context, accidental invocation could expose identity information or initiate sensitive local operations under weak user intent signals.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The comments and workflow imply a fresh signature is created for the clone identity, but multiple fallback paths silently reuse the existing signature when decryption or key access fails. That can produce metadata that looks re-signed when it is not, weakening identity integrity and enabling spoofed or unverifiable clone lineage records.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script reads either a raw private key or encrypted private key material from the local birth data and proceeds to use it without strong disclosure or guardrails. In this skill context, the file appears to manage agent identity state, so embedding or accessing private key material in ordinary application storage substantially increases the blast radius of local compromise or operator misuse.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code decrypts a wallet private key and uses it directly in process memory based on an environment-supplied password. Even though this appears intended for legitimate clone initialization, handling signing keys this way increases exposure to credential theft via process inspection, logs, crash dumps, inherited environment variables, or accidental persistence in the birth-info file.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 72% confidence
- Finding
The script persists updated identity state back to ~/.openclaw/birth-info.json, potentially including sensitive fields inherited from the original object such as private_key or encrypted_private_key. In a system that tracks clone lineage and wallet-linked identity, long-lived local persistence can preserve sensitive material and metadata beyond the immediate operation, increasing exposure after host compromise.
- Content
js clone_initialized_at: new Date().toISOString() }; // Write updated birth info try { fs.writeFileSync(BIRTH_INFO_PATH, JSON.stringify(newBirthData, null, 2), 'utf8'); } catch (error) {
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script intentionally reveals the decrypted private key either by printing it to stdout or writing it to a plaintext file on disk. In practice, stdout is commonly captured by terminal scrollback, shell history workflows, CI logs, remote session recording, and process supervisors, while disk output leaves a recoverable secret at rest; both materially increase the chance of wallet compromise.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The comment states stdout output is 'safe' even though the code prints the full decrypted private key. This is dangerous because it normalizes an unsafe handling pattern and may cause operators or downstream developers to expose wallet secrets in logs, recordings, or shared terminals under the false belief that the behavior is secure.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
js console.log('\nUsage:'); console.log(' node fix-clone.js <parent_birth_id> [--force]'); console.log('\nOptions:'); console.log(' --force Skip confirmation if already a clone'); console.log('\nExample:'); console.log(' node fix-clone.js did:ethr:0xF80042413226cf4a5F1b7de458Cf0EEd19237662'); console.log('\nTo find parent_id from a package:');
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The script rewrites ~/.openclaw/birth-info.json with sensitive identity material, including potentially a plaintext private key or decrypted-key-derived metadata, without any file-permission hardening, atomic write pattern, or secret minimization. On multi-user systems or weakly permissioned environments, this can expose long-lived credentials and allow identity tampering or wallet compromise if the file is read or replaced by another local process.
- Content
js original_created_at: originalCreatedAt }; // Write updated birth info try { fs.writeFileSync(BIRTH_INFO_PATH, JSON.stringify(newBirthData, null, 2), 'utf8'); } catch (error) {
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes secure wallet decryption and full lineage tracking for clone parent-child relationships, but the code in this file only creates an Ethereum wallet, derives a DID-like birth ID, stores basic parent_id metadata, and verifies a signature. There is no wallet decryption logic and no family-tree or lineage traversal/storage beyond a single parent reference.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script performs filesystem writes to birth-info.json and potentially SOUL.md without clear warning or confirmation. In an agent-skill setting, undocumented write behavior is more dangerous because it can silently alter user state, create tracking artifacts, or overwrite important files if environment-controlled paths point somewhere unexpected.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script writes to SOUL.md in the workspace as a side effect unrelated to core birth-ID generation. Unexpected modification of user workspace files increases risk because an agent skill can alter project state outside its stated purpose, which can be abused for persistence, misleading metadata, or unauthorized file tampering.
- Content