ClawHub
Back to skill

Security audit

ViBo SkillQA

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local skill QA tester, but users should know it reads the skill being tested and executes its scripts in a limited sandbox.

Install only if you are comfortable with a local QA tool reading the target skill folder, checking .env-like files for masked secret findings, and executing that skill's scripts under a limited sandbox. For unknown or potentially hostile skills, run SkillQA inside a disposable VM or container because the included sandbox is disclosed as not being a strong OS security boundary.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
timeout=timeout, t0=t0)

    def _execute(self, cmd, cwd, env, timeout, t0):
        proc = subprocess.Popen(
            cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
            cwd=str(cwd), env=env, stdin=subprocess.DEVNULL,
            start_new_session=True,
Confidence
96% confidence
Finding
This code executes arbitrary discovered skill scripts via subprocess.Popen. Although arguments are passed as a list rather than through a shell, the core security risk is intentional execution of untrusted code supplied by the skill under test; the surrounding sandbox reduces but does not eliminate host risk because there is no strong OS-level confinement such as containers, seccomp, user namespaces, or mount isolation. A malicious skill can still consume CPU/memory, interact with the filesystem portions exposed to it, and potentially exploit interpreter or kernel/runtime escape bugs.

Missing User Warnings

Low
Confidence
91% confidence
Finding
The module reads an environment-controlled path (OPENCLAW_SKILLS_DIR) and then recursively scans SKILL.md files under that location. In this skill’s stated context, the scanner is supposed to tell the user what will be scanned, but this environment-derived source is implicit and may cause the tool to inspect unexpected local directories without clear user-facing disclosure, creating a privacy and trust issue rather than direct code execution.

Static analysis

No suspicious patterns detected.