ClawHub
Back to skill

Security audit

OpenClaw Russian — русскоязычный AI-ассистент с характером.

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Russian-language persona skill with rough tone and examples; it has some unsafe sample-code and safety-advice caveats but no hidden execution, persistence, or data theft behavior.

Install only if you explicitly want a Russian, blunt, profanity-tolerant assistant style. Do not copy the API examples into real projects without changing HTTP to HTTPS, moving keys into environment variables or a secrets manager, and pinning dependencies in an isolated environment. Treat the wilderness-survival content as general commentary, not emergency or expert guidance.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:180
Finding

API Credential Transmitted Over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:217
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation
``` 2. Maintain dependencies in a lockfile or requirements file with cryptographic hashes: ```text pip install --require-hashes -r requirements.txt ``` 3. Generate and review the lockfile using a dependency-management tool, and update it through a controlled review process. 4. Install dependencies inside a dedicated virtual environment rather than into the system Python environment. 5. Use an explicitly trusted package index and secure repository configuration. 6. Add automated dependency vulnerability scanning and scheduled review of pinned versions. 7. Do not run package installation commands with administrator or root privileges unless strictly necessary. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill states that the assistant 'works in Russian' and reinforces a Russian-language, profanity-heavy persona without clearly requiring the user's consent. That can override the user's locale, accessibility, or professionalism expectations and may cause policy noncompliance or harmful behavior in contexts where language switching or profanity is inappropriate.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation guidance recommends broad triggers like wanting a direct answer, technical analysis, criticism, or discussing difficult topics. Such generic phrases can cause accidental invocation in ordinary conversations, unexpectedly switching tone and behavior in ways the user did not explicitly request, which can bypass user expectations and platform policy constraints.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The example code sends requests to an external weather API over plain HTTP, exposing API keys and query contents to interception or manipulation in transit. Even though this appears in documentation, it provides actionable insecure implementation guidance that users may copy directly into production or automation scripts.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md
CITIES = ['Moscow', 'Saint Petersburg', 'Novosibirsk']

def get_weather(city):
    url = f"http://api.openweathermap.org/data/2.5/weather?q={city}&appid={API_KEY}&units=metric"
    try:
        response = requests.get(url, timeout=10)
        response.raise_for_status()

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documented system prompt says the skill must not give dangerous advice, yet the skill includes detailed survival guidance that can be physically hazardous if wrong, outdated, or overgeneralized. Advice about wildlife encounters, foraging, navigation, fire, and emergency response can directly influence real-world life-or-death decisions, so this contradiction increases the chance of unsafe outputs under a veneer of safety.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.