ClawHub
Back to skill

Security audit

Safespace Rater

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent security-audit purpose, but its wrapper can automatically download/build and execute a mutable external Go binary when users run normal commands.

Review carefully before installing. Use only with a preinstalled, trusted safespace-rater binary via SAFESPACE_RATER_BIN, avoid the automatic go install path unless you trust the remote module and current version, and treat audit reports, ratings, pending uploads, and optional LLM fallback data as potentially leaving your machine.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/safespace-rater.sh:79
Finding

Automatic Installation and Execution of a Mutable Remote Payload

Content
View full analysis
/dev/stderr || true cat >/dev/stderr <<'EOF' [safespace-rater] cannot locate executable. Use one of the following: 1) Auto-bootstrap with Go (recommended): go install github.com/vpn2004/SkillVet/cmd/safespace-rater@latest 2) Build in repository root: make build 3) Point to an existing binary: export SAFESPACE_RATER_BIN=/absolute/path/to/safespace-rater EOF exit 1 ...[truncated 3209 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly encourages publishing audit reports and reputation signals to a network, but the documentation does not clearly warn users that reports, comments, skill identifiers, and related metadata may leave the local machine and become externally visible. In a security-audit context, this omission is risky because users may unknowingly disclose sensitive information about local skills, internal tooling, or organizational assessments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The OpenAI-compatible fallback instructions ask users to configure an API key and outbound model endpoint, but they do not warn that skill contents, audit artifacts, or metadata may be sent to an external LLM provider. This can lead to accidental exposure of proprietary or sensitive data during security analysis, especially because users may assume the tool remains local unless told otherwise.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

export SAFESPACE_LLM_MODEL= export SAFESPACE_LLM_API_KEY=

optional / 可选

export SAFESPACE_LLM_BASE_URL=https://api.openai.com/v1 export SAFESPACE_LLM_TIMEOUT_MS=12000

text

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script does more than invoke an auditor: it attempts local builds and, failing that, downloads and installs the executable automatically. This expands the skill's capability from local analysis/publishing into code acquisition and build execution, which is a meaningful security boundary change because users may invoke the skill expecting only analysis, not compilation or remote package retrieval.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The wrapper will execute go install against a remote module source at runtime when the binary is missing, which causes network retrieval and execution of code outside the local skill boundary. For a skill described as auditing local OpenClaw skills and optionally publishing scores, silently bootstrapping an executable from @latest exceeds expected behavior and introduces supply-chain and trust risks if the module, transport, or dependency chain is compromised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.