Speckit Workflow for Openclaw

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:40 PM UTC
• Version: 1.0.3

Overview

This skill is a disclosed repository automation workflow, but its bundled shell scripts contain a real command-execution flaw that users should review before installing.

Install only if you are comfortable with an agent modifying your repository and, if enabled, committing and pushing changes. Review or patch the bundled shell scripts before use, especially the eval path in common.sh, and avoid running the workflow in environments where untrusted branches, environment variables, or project files can influence SPECIFY_FEATURE.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: .specify/scripts/bash/common.sh:126

Finding

Arbitrary Command Execution Through Unsafe Evaluation of SPECIFY_FEATURE

Content

View full analysis

Remediation

View remediation

&2 return 1 fi fi ``` 4. Validate actual Git branch names and all path-derived identifiers as defense in depth. Reject control characters, quotes, whitespace, path separators, and shell metacharacters. 5. If values must be transferred between processes, use a non-executable representation such as JSON and parse it with a dedicated parser. Do not pass parser output into `eval`. 6. Update all three sinks—`check-prerequisites.sh`, `setup-plan.sh`, and `update-agent-context.sh`—because fixing only one caller leaves the other normal workflow paths exploitable. 7. Add regression tests using feature values containing single quotes, command substitutions, semicolons, newlines, spaces, and path traversal sequences. Tests should verify rejection and confirm that no side-effect command is executed. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (27)

Concealed Executable Artifact

High

• Category: Supply Chain
• Confidence: 100% confidence

Finding

An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.

Content

No source excerpt is available for this finding.

Concealed Executable Artifact

High

• Category: Supply Chain
• Confidence: 100% confidence

Finding

An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.

Content

No source excerpt is available for this finding.

Concealed Executable Artifact

High

• Category: Supply Chain
• Confidence: 100% confidence

Finding

An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.

Content

No source excerpt is available for this finding.

Concealed Executable Artifact

High

• Category: Supply Chain
• Confidence: 100% confidence

Finding

An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.

Content

No source excerpt is available for this finding.

Concealed Executable Artifact

High

• Category: Supply Chain
• Confidence: 100% confidence

Finding

An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · .specify/scripts/bash/update-agent-context.sh (reported line 112)May include surrounding context.

sh

# Cleanup function for temporary files
cleanup() {
    local exit_code=$?
    rm -f /tmp/agent_update_*_$$
    rm -f /tmp/manual_additions_$$
    exit $exit_code
}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · .specify/scripts/bash/update-agent-context.sh (reported line 113)May include surrounding context.

sh

cleanup() {
    local exit_code=$?
    rm -f /tmp/agent_update_*_$$
    rm -f /tmp/manual_additions_$$
    exit $exit_code
}

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · .specify/templates/plan-template.md (reported line 14)May include surrounding context.

md

## Technical Context

<!--
  ACTION REQUIRED: Replace the content in this section with the technical details
  for the project. The structure here is presented in advisory capacity to guide
  the iteration process.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · .specify/templates/spec-template.md (reported line 10)May include surrounding context.

md

## User Scenarios & Testing *(mandatory)*

<!--
  IMPORTANT: User stories should be PRIORITIZED as user journeys ordered by importance.
  Each user story/journey must be INDEPENDENTLY TESTABLE - meaning if you implement just ONE of them,
  you should still have a viable MVP (Minimum Viable Product) that delivers value.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · subskills/speckit-implement/SKILL.md (reported line 77)May include surrounding context.

md

- Check if .eslintrc* exists → create/verify .eslintignore
   - Check if eslint.config.* exists → ensure the config's `ignores` entries cover required patterns
   - Check if .prettierrc* exists → create/verify .prettierignore
   - Check if .npmrc or package.json exists → create/verify .npmignore (if publishing)
   - Check if terraform files (*.tf) exist → create/verify .terraformignore
   - Check if .helmignore needed (helm charts present) → create/verify .helmignore

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · subskills/speckit-implement/SKILL.md (reported line 105)May include surrounding context.

md

- **ESLint**: `node_modules/`, `dist/`, `build/`, `coverage/`, `*.min.js`
   - **Prettier**: `node_modules/`, `dist/`, `build/`, `coverage/`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`
   - **Terraform**: `.terraform/`, `*.tfstate*`, `*.tfvars`, `.terraform.lock.hcl`
   - **Kubernetes/k8s**: `*.secret.yaml`, `secrets/`, `.kube/`, `kubeconfig*`, `*.key`, `*.crt`

5. Parse tasks.md structure and extract:
   - **Task phases**: Setup, Tests, Core, Integration, Polish

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · subskills/speckit-implement/SKILL.md (reported line 105)May include surrounding context.

md

- **ESLint**: `node_modules/`, `dist/`, `build/`, `coverage/`, `*.min.js`
   - **Prettier**: `node_modules/`, `dist/`, `build/`, `coverage/`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`
   - **Terraform**: `.terraform/`, `*.tfstate*`, `*.tfvars`, `.terraform.lock.hcl`
   - **Kubernetes/k8s**: `*.secret.yaml`, `secrets/`, `.kube/`, `kubeconfig*`, `*.key`, `*.crt`

5. Parse tasks.md structure and extract:
   - **Task phases**: Setup, Tests, Core, Integration, Polish

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly states that the agent is directed to commit and push changes after task completion, but it does not prominently warn users that this can modify repository history and publish changes to a remote automatically. In an autonomous workflow skill, that omission is security-relevant because users may activate the skill without understanding that local changes could be transmitted externally, potentially exposing secrets, unreviewed code, or destructive changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to copy the .specify directory into the project root as part of initialization without an explicit warning that local project files will be created or modified. Because this skill is an orchestrator for repository-affecting actions, silent initialization can unexpectedly alter a user's workspace and seed downstream automated changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill tells the agent to 'start or resume the workflow' whenever user context is present, but it does not define clear trigger boundaries, confirmation requirements, or exclusions. In a workflow that can create files, branches, commits, and pushes, this ambiguity can cause the agent to initiate impactful actions in situations where the user only intended to provide background context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill declares itself "STRICTLY READ-ONLY" and says it must not modify files, but it also instructs the agent to execute a local shell script. Even if the script is intended only to inspect prerequisites, executing repository-controlled code breaks the read-only trust boundary and can trigger arbitrary commands, environment access, or side effects if the script is malicious or has been tampered with.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This analysis/reporting skill runs .specify/scripts/bash/check-prerequisites.sh, a local shell script sourced from the repository being analyzed. In a hostile or compromised repo, that script can execute arbitrary shell commands under the agent's privileges, making the analysis skill an unintended code-execution path rather than a passive reviewer.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · subskills/speckit-checklist/SKILL.md (reported line 69)May include surrounding context.

md

Question formatting rules:
   - If presenting options, generate a compact table with columns: Option | Candidate | Why It Matters
   - Limit to A–E options maximum; omit table if a free-form answer is clearer
   - Never ask the user to restate what they already said
   - Avoid speculative categories (no hallucination). If uncertain, ask explicitly: "Confirm whether X belongs in scope."

   Defaults when interaction impossible:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill directs the agent to create directories and write or append files inside the repository without an explicit user-facing warning or confirmation at the point of action. In an agent setting, silent workspace mutation can cause unintended changes, pollute version control, or overwrite/alter trusted project artifacts, especially because the instructions also permit appending to an existing file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions say both 'If file exists, append to existing file' and 'Each speckit-checklist run creates a NEW file (never overwrites existing checklists)'. Appending to an existing file is incompatible with always creating a new file, so the documentation contains an active contradiction about the skill's write behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This section says each invocation creates a checklist file using descriptive names 'unless file already exists', which conflicts with the earlier claim that each run creates a new file and never overwrites existing checklists. These instructions cannot both be true and create ambiguity about actual file modification behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly directs the agent to create or modify repository ignore files based on detected tooling, which changes project state automatically without requiring clear user consent at the point of modification. In an agentic environment, silent edits to .gitignore/.dockerignore/.npmignore and similar files can hide files from version control or packaging, including security-relevant artifacts, making the behavior risky even if intended as convenience automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to mark completed tasks as [X] in tasks.md, which silently alters project tracking records without explicit disclosure or approval. Automatic status updates can misrepresent completion, obscure partial failures, or create auditability issues if the agent marks work done before full validation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · subskills/speckit-specify/SKILL.md (reported line 22)May include surrounding context.

md

## Outline

The text the user typed after `speckit-specify` in the triggering message **is** the feature description. Assume you always have it available in this conversation even if `{{user_provided_context}}` appears literally below. Do not ask the user to repeat it unless they provided an empty skill.

Given that feature description, do this:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This section directs the agent to run git operations and a feature-creation script that fetches remotes, creates/checks out branches, and initializes files, all without an explicit user-facing warning or consent step. That is dangerous because it changes repository state, may pull untrusted remote metadata, and can trigger side effects through project scripts in a way the user may not anticipate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.