T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate-from-prompt.sh:7- Finding
Arbitrary Python Code Execution Through Unsanitized Output Name
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai 3d Generator
Security checks for vulnerabilities and agentic risk
Overview
This skill is for 3D model generation, but it can run user-influenced Python code without adequate safeguards.
Review this skill carefully before installing. Use it only with trusted prompts and simple output names, and avoid scheduled or automated use until generated Python is reviewed or run in a constrained sandbox with strict output-path validation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md ## 2. Skill OpenClaw Automatisé Crée le fichier `~/.openclaw/workspace/skills/ai-3d-generator/SKILL.md`: ### Utilisation
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly describes a workflow where an LLM generates Python code and that code is then executed to produce and export STL files, but it provides no sandboxing, allowlisting, or human review gate. Because the model output is executable Python, prompt injection or model misbehavior could lead to arbitrary code execution, filesystem access, or unintended writes beyond the intended STL export path.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Comments, usage instructions, and user-facing output strings are presented exclusively in French. The file does not offer user opt-in for language selection or explain that the skill is intentionally limited to a French-speaking context.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The docstring says this function creates a parametric advanced space station, but the example code calls add_cylinder with rotation_angle, a parameter not accepted by the method signature at L048. This directly contradicts the implied executable example and means the documented example will fail rather than generate the described model.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The natural-language instructions and examples are presented in French, which may impose a language preference without user opt-in. The file does not state that the skill is region-specific or provide an alternative language option.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This file contains natural-language prompts and status messages in French, beginning in the module docstring and continuing throughout execution. Under the policy provided, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This shell script creates a temporary file containing generated code, which is a file-write operation covered by the warning requirement for code files. Although the script prints progress messages, it does not disclose that it will write a temporary script under /tmp before executing it.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The embedded Python code creates directories and exports an STL file to a fixed path, which is a file-write operation. While the script reports the output path after completion, it does not clearly warn beforehand that it will create directories and write files in the workspace.
- Content
Static analysis
No suspicious patterns detected.