ClawHub
Back to skill

Security audit

Dev Team

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent multi-agent development orchestrator, but it defaults to powerful agent and local automation paths that can modify code, run shell commands, post to GitHub, persist scheduled jobs, and act without enough containment.

Install only if you are comfortable giving this skill broad local developer authority. Before use, remove dangerous approval-bypass defaults, avoid running it on untrusted repositories, disable automatic package installs or use --ignore-scripts in a sandbox, bind the dashboard to loopback with authentication, keep ENABLE_LOCAL_ACTIONS off unless needed, and do not register cron or LaunchAgent jobs until you have a removal plan and trust the script directory.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T06 · System Persistence

Warning
Location
references/initialization.md:15
Finding

Persistent Scheduled Execution Through Cron and LaunchAgents

Content
View full analysis
> ./assets/logs/cron.log 2>&1 0 3 * * * cd /path/to/skills/dev-team && ./scripts/cleanup-worktrees.sh >> ./assets/logs/cleanup.log 2>&1 10 3 * * * cd /path/to/skills/dev-team && ./scripts/prune-history.sh --keep-days 7 --keep-count 50 >> ./assets/logs/prune.log 2>&1 ``` ```xml Label com.dev-team.agent-check ProgramArguments /bin/bash /path/to/skills/dev-team/scripts/check-agents.sh StartInterval 600 ``` ```bash launchctl load ~/Library/LaunchAgents/com.dev-team.agent-check.plist ``` ### Technical Analysis The initialization guide instructs users to establish recurring execution through OpenClaw cron, the operating-system crontab, or a macOS LaunchAgent. These mechanisms survive the original Skill session and repeatedly execute scripts with the permissions of the account that registered them. Periodic monitoring and cleanup are relevant to multi-agent orchestration, so the mechanism has a legitimate operati ...[truncated 1318 chars]
Remediation
View remediation
` - removal of the relevant crontab entries - `launchctl unload ` followed by deletion of the plist - Run scheduled tasks in a dedicated, least-privileged account or isolated execution environment. - Use absolute, administrator-approved paths and reject writable or symlinked script locations. - Verify script ownership, permissions, and integrity before every scheduled execution. - Restrict inherited environment variables and credential access. - Log registration, execution, updates, and removal of persistent jobs. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error
Location
config/agents.json:3
Finding

Default Agent Configuration Disables Approval and Sandbox Protections

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
scripts/review-agent.sh:230
Finding

PR Diff Prompt Injection Reaches Privileged Review Agents

Content
View full analysis
"$PR_DIFF_FILE" 2>/dev/null; then python3 - < max_chars: excerpt = excerpt[:max_chars] if len(lines) > max_lines or len(text) > len(excerpt): excerpt += "\n\n[... diff truncated by dev-team review-agent ...]\n" Path("$PR_DIFF_EXCERPT_FILE").write_text(excerpt, encoding="utf-8") PYEOF fi ``` ```bash diff_context="$(cat "$PR_DIFF_EXCERPT_FILE" 2>/dev/null || echo 'Diff unavailable')" prompt=$(printf '%s\n' \ "You are a dev-team PR review subagent." \ "REVIEWER_NAME: $reviewer" \ "PR_NUMBER: $PR_NUM" \ "PR_URL: $PR_URL" \ "REPO: $REPO" \ "BASE_REF: $BASE_REF" \ "HEAD_REF: $HEAD_REF" \ "" \ "Review the PR metadata and diff excerpt below." \ "" \ "=== DIFF_EXCERPT_BEGIN ===" \ "$diff_context" \ "=== DIFF_EXCERPT_END ===") ``` ```bash case "$reviewer" in codex) _run_review_cmd "$output_file" "$REPO_PATH" \ codex exec --dangerously-bypass-approvals-and-sandbox "$prompt" ;; claude) _run_review_cmd "$output_file" "$REPO_PATH" \ claude --dangerously-skip-permissions -p "$prompt" ;; esac ``` ### Technical Analysis A pull-request diff is attacker-controlled content. The script inserts the diff excerpt verbatim into the reviewer prompt. Delimiters are present, but the prompt does not establish a strict trust rule that content inside those delimiters is data only and must never be followed as instructions. The resulting prompt is sent to reviewers configured with disabled approval and sandbox protec ...[truncated 1421 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/dev-board/apps/api/src/server.js:1414
Finding

Unauthenticated Development Board Is Not Explicitly Restricted to Loopback

Content
View full analysis
t.id === taskId || t.branch === taskId || t.tmuxSession === taskId ); const tail = tailFileWithMeta(task.logFile, lines); return json(res, 200, { taskId: task.id, logFile: task.logFile, content: tail. ...[truncated 2667 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/spawn-agent.sh:419
Finding

Automatic Package Installation Executes Repository-Controlled Lifecycle Scripts

Content
View full analysis
/dev/null || npm install 2>/dev/null || echo "No dependencies to install" cd "$SKILL_DIR" fi ``` ### Technical Analysis Whenever the target worktree contains `package.json`, the spawning workflow automatically runs `pnpm install` or falls back to `npm install`. Package managers normally execute lifecycle hooks such as `preinstall`, `install`, and `postinstall`. Those hooks can be defined directly by the repository or supplied by dependencies. Consequently, merely spawning an agent for an untrusted repository can execute repository-controlled code before the AI agent begins its assigned work. The installation does not require explicit user approval, does not suppress scripts, does not require a frozen lockfile, and is not shown to run in a disposable sandbox. Redirecting standard error also obscures useful security and failure diagnostics. ### Attack Path 1. An attacker places a malicious lifecycle hook in the repository's `package.json`, or introduces a compromised dependency with an installation hook. 2. A user invokes `spawn-agent.sh` against that repository. 3. The script detects `package.json`. 4. It automatically runs `pnpm install` or `npm install`. 5. The package manager executes the malicious lifecycle hook. 6. The hook runs with the permissions and environment of the Skill runner, before normal agent isolation can provide any protection. ### Impact Assessment A malicious installation hook could read or modify user-accessible files, alter the worktree or Skill scripts, access inherited credentials, contact external services, install additional payloads, or tamper with subsequ ...[truncated 169 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (70)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
- 禁止 SubAgent 在 `main/master` 上直接开发（`spawn-agent.sh` 已拦截）

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
- 禁止 SubAgent 在 `main/master` 上直接开发（`spawn-agent.sh` 已拦截）

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
- 禁止 SubAgent 在 `main/master` 上直接开发（`spawn-agent.sh` 已拦截）

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.

md
- 禁止 SubAgent 在 `main/master` 上直接开发（`spawn-agent.sh` 已拦截）

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 364)May include surrounding context.

md
- 禁止 SubAgent 在 `main/master` 上直接开发（`spawn-agent.sh` 已拦截）

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 369)May include surrounding context.

md
- 禁止 SubAgent 在 `main/master` 上直接开发（`spawn-agent.sh` 已拦截）

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md
- 结束后可自动触发 `cleanup-worktrees.sh` 与 `prune-history.sh`（避免 worktree / active-tasks 膨胀）

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.

md
- 结束后可自动触发 `cleanup-worktrees.sh` 与 `prune-history.sh`（避免 worktree / active-tasks 膨胀）

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 257)May include surrounding context.

md
- 结束后可自动触发 `cleanup-worktrees.sh` 与 `prune-history.sh`（避免 worktree / active-tasks 膨胀）

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md
./scripts/recommend-agent.sh --description "前端看板优化" --phase build

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.

md
./scripts/recommend-agent.sh --description "前端看板优化" --phase build

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md
./scripts/recommend-agent.sh --description "前端看板优化" --phase build

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.

md
- `enqueue-task.sh`：主 Agent 添加任务到队列（`assets/tasks.json`）

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

md
- `enqueue-task.sh`：主 Agent 添加任务到队列（`assets/tasks.json`）

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.

md
- `claim-task.sh`：认领一个 queued 任务并调用 `spawn-agent.sh` 派工

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.

md
- `claim-task.sh`：认领一个 queued 任务并调用 `spawn-agent.sh` 派工

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/cli-reference.md (reported line 8)May include surrounding context.

Codex

bash
codex exec [OPTIONS] "prompt"
  --dangerously-bypass-approvals-and-sandbox
  -C, --cd <DIR>

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/recommend-agent.sh (reported line 170)May include surrounding context.

sh
out = (proc.stdout or "") + (proc.stderr or "")
            if "Not logged in" in out:
                # Fallback: probe inside tmux because dev-team runs subagents in tmux and
                # some environments cannot read Keychain auth in non-interactive shells.
                if shutil.which("tmux"):
                    probe_session = f"teamdev-cursor-probe-{os.getpid()}"
                    probe_file = f"/tmp/{probe_session}.txt"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/spawn-agent.sh (reported line 323)May include surrounding context.

sh
out = (proc.stdout or "") + (proc.stderr or "")
            if "Not logged in" in out:
                # Fallback: probe inside tmux because dev-team runs subagents in tmux and
                # some environments cannot read Keychain auth in non-interactive shells.
                if shutil.which("tmux"):
                    probe_session = f"teamdev-cursor-probe-{os.getpid()}"
                    probe_file = f"/tmp/{probe_session}.txt"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/spawn-agent.sh (reported line 229)May include surrounding context.

sh
local cursor_status
            cursor_status=$(cursor agent status 2>&1 || true)
            if echo "$cursor_status" | grep -qi "not logged in"; then
                # 某些环境（非交互 shell / keychain 可见性差异）会误报未登录，tmux 场景再探测一次
                if command -v tmux >/dev/null 2>&1; then
                    local probe_session="teamdev-cursor-probe-$$"
                    local probe_file="/tmp/${probe_session}.txt"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding

The skill documents and encourages powerful operations including shell execution, file read/write, network access, environment interaction, git automation, PR creation, and auto-merge, but it declares no explicit tool scope or permission boundary. In an agent framework, this creates an over-privileged and ambiguous trust model: the orchestrator or subagents may be allowed to invoke dangerous capabilities without a manifest-level constraint, increasing the chance of destructive commands, credential misuse, or unintended repository changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill begins presenting operational instructions in Chinese from L010 onward, while other sections remain in English. This imposes a language expectation on users without opt-in or justification that the skill is only for a Chinese-speaking audience, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

This configuration explicitly launches multiple coding agents with approval bypass and effectively unsandboxed modes, such as --dangerously-bypass-approvals-and-sandbox, --dangerously-skip-permissions, and Gemini yolo approvals with shell and file-write tools. In a skill whose purpose is orchestrating automated software development across multiple agents, these settings materially increase the chance of unauthorized shell execution, filesystem changes, secret exposure, destructive git operations, or supply-chain compromise if prompts, tasks, or upstream agent behavior are manipulated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language descriptions for multiple agents are written only in Chinese, with no indication that language selection is optional or that the configuration is intended for a Chinese-only environment. This can violate a language/locale policy when users are not given a choice or explicit notice about the enforced locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document is written as mandatory operating guidance for the main agent, and its instructions are presented only in Chinese. This creates a language/locale constraint for agent operation without any stated opt-in, alternative language, or justification for the restriction.

Content

No source excerpt is available for this finding.