No.0-skill

• Outcome: Review
• Latest audit: May 28, 2026 · 2:23 PM UTC
• Version: 1.0.1

Overview

This looks like a local agent-safety tool, but it needs Review because it can change agent control files and its access-control protections are weaker than advertised.

Treat this as a high-impact local security tool, not a simple utility. Review the code before installing, test in a disposable workspace first, avoid running examples against real private keys or production agent memory, and do not rely on the DLC as non-bypassable access control or strong MFA without hardening the fail-open paths, notification escaping, logging minimization, and install packaging.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (49)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

script = f'display notification "{message}" with title "{title}" sound name "default"'
        
        try:
            subprocess.run(
                ["osascript", "-e", script],
                check=True,
                capture_output=True

• Confidence: 96% confidence
• Finding: The macOS notification path builds an AppleScript command by interpolating untrusted request-derived text into a script string and then passes it to osascript. Although subprocess is invoked without shell=True, the dangerous interpreter is AppleScript itself, so crafted quotes or script fragments in request.operation or request.resource_path could break out of the notification string and execute unintended AppleScript commands.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

$balloon.Visible = $true
            $balloon.ShowBalloonTip(5000)
            '''
            subprocess.run(
                ["powershell", "-Command", script],
                check=True,
                capture_output=True

• Confidence: 97% confidence
• Finding: The Windows notification path constructs a PowerShell script using request-derived message content and executes it with powershell -Command. An attacker who controls request.operation or request.resource_path may inject quotes or PowerShell syntax, turning a notification into arbitrary command execution in the current user context.

Tainted flow: 'target_file' from os.getenv (line 1034, credential/environment) → shutil.copy2 (file write)

Medium

• Category: Data Flow

Content

save_backup_meta(current_backup, target_file)
    prune_old_versions(backup_dir, file_name, keep=10)

    shutil.copy2(backup_file, target_file)
    print(f"已回滚: {file_name} -> {version_text}")
    return 0

• Confidence: 87% confidence
• Finding: The rollback path writes `backup_file` into `target_file`, where `target_file` is under a user/environment-controlled monitor directory. Because the code does not verify that the resolved target stays within an approved workspace and does not reject symlinks, a local attacker who can influence `GUARDIAN_MONITOR_DIR` or CLI arguments could cause overwrite of unintended files during rollback.

Tainted flow: 'monitor_dir' from os.getenv (line 65, credential/environment) → shutil.copy2 (file write)

Medium

• Category: Data Flow

Content

if source_file is None:
                    unresolved.append(target_name)
                    continue
                shutil.copy2(source_file, monitor_dir / target_name)
                copied.append(target_name)
            missing = unresolved

• Confidence: 85% confidence
• Finding: The code copies core files into `monitor_dir`, which can be sourced from environment variables or command-line arguments, without checking whether the resolved destination is an expected workspace or whether destination entries are symlinks. In hostile local contexts, this enables unintended writes to attacker-chosen paths and could overwrite sensitive files accessible to the running user.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The documentation explicitly instructs the DLC to shell out to Core using a rollback command with interpolated file/version parameters, but it does not require safe argument separation, validation, or avoidance of shell invocation. If an implementation follows this example naively with event-derived or user-controlled values, it can introduce command injection or unsafe command execution in a privileged recovery path.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The comment and operational intent are inconsistent with the actual backup rotation behavior. On detection, the code rotates the clean v1 backup to v2 and then copies the already modified live file into the new v1, so operators relying on v1 as the trusted baseline may restore or analyze a tampered snapshot by mistake. In a security-monitoring skill, misleading backup semantics directly weakens incident response and forensic trust.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The `clear` command is documented as deleting logs and artifacts, but it also terminates running processes and removes PID state. This hidden destructive behavior can cause operational denial of service or accidental shutdowns because users may invoke cleanup expecting only file deletion, not process termination.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The approval UI says the agent is requesting file access, but the backend supports READ, WRITE, DELETE, and EXECUTE. This mismatch can mislead users into approving far more dangerous actions than they intended, creating a consent-integrity flaw that could enable destructive or code-execution operations under the guise of simple file viewing.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The code claims one-time-use tokens, but cleanup_consumed_tokens() can wipe the entire replay-protection set once it exceeds 10,000 entries. Any previously consumed token that is still unexpired would then be accepted again, breaking the anti-replay guarantee and potentially allowing repeated unauthorized operations with a captured token.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The module-level documentation claims all agent file access is forced through the Reference Monitor, but the wrapper explicitly bypasses monitoring when AgentContextManager.get_context() returns no context and directly executes the tool. In a security boundary component, this mismatch is dangerous because failures, missing context propagation, or intentional invocation outside context can silently disable enforcement and allow unauthorized file operations.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The interceptor's documentation promises that all file operations are forced through the Reference Monitor, yet the implementation permits unchecked execution whenever no agent context is present. In this skill context, the code is part of an access-control interception layer, so a context-loss or bypass condition directly undermines the core protection model and may create a practical authorization bypass.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The module claims non-bypassability and mandatory mediation for all agent file access, but the implementation only exposes a decision/check API and a token generator. Without actual interception or enforcement at the file-operation layer, callers can bypass the monitor entirely, creating a false sense of security around sensitive file access.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The authenticator advertises digital-signature-based verification, but authenticate() merely looks up an agent_id in memory and updates last_authenticated. Any component able to supply a known agent ID can impersonate that agent, including higher-privileged identities, which undermines the trust model for all authorization decisions.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The code comments and docstring claim TOTP codes are not returned to callers, but `_compute_totp()` directly returns a `TOTPCode` object containing the live MFA code. In this vault context, exposing the code to any internal caller defeats the stated containment boundary and increases the chance that higher-level code, logs, or plugins can access or leak the OTP.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The rotation logic says the old key remains usable during a grace period, but the implementation overwrites the stored secret under the same `key_id` before marking rotation. That means there is no preserved old secret to honor the grace period, which can break MFA workflows and invalidate assumptions during emergency recovery or staged rollout.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The fallback path does not encrypt at all; it merely base64-encodes plaintext while the API and comments claim encryption. If the cryptography package is unavailable, secrets stored through this helper are trivially recoverable by anyone with file or backup access, creating a silent confidentiality failure in a TOTP vault context.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The demo callback includes a hidden MFA bypass path controlled by the TOTP_AUTO_APPROVE environment variable, which returns approval without any real human confirmation. In an MFA integration component, even a 'demo' auto-approve path is dangerous because environment variables are often easy to influence in deployment, CI, containers, or local runtime environments, turning a protected PENDING decision into unconditional access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The uninstall instructions include recursive deletion commands (`rm -rf`) against user-controlled and home-directory paths without an explicit warning about irreversible data loss or guidance to verify the path first. In installation documentation, this creates a realistic risk of accidental destructive execution, especially if variables are mis-set or copied blindly.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The verification example references `~/.ssh/id_rsa`, which is a highly sensitive private key path, without warning users not to expose, transmit, or modify real private keys during testing. Even if intended only as a classification demo, normalizing direct interaction with private key material can lead to accidental disclosure or unsafe handling.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The quickstart instructs users to append data directly to ~/.openclaw/workspace/MEMORY.md as part of a smoke test, which modifies user state without any warning, backup guidance, or use of a disposable test workspace. Even though it later suggests a rollback, this still normalizes editing a potentially important user data file and could cause unintended state changes or loss if rollback fails or users adapt the example incorrectly.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The smoke test tells users to run classification on ~/.ssh/id_rsa, a highly sensitive private key path, without any privacy or handling warning. Encouraging interaction with private key material in a demo can expose metadata, normalize unsafe handling of secrets, and risks accidental logging, transmission, or retention by the tool or surrounding system.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The schema stores absolute paths, diff previews, rule hits, and classification reasons on disk under a predictable location, which can expose sensitive file names, content fragments, and system layout to other local users or processes if permissions are weak. Even as documentation, this design materially increases privacy and information disclosure risk because the event payload contains operationally sensitive metadata by default.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The verification example explicitly tells the user to run a classification command against ~/.ssh/id_rsa, a highly sensitive private key path. Even if intended as a demo, encouraging processing of private key material is dangerous because the skill may read, log, classify, transmit, or otherwise mishandle credentials during normal operation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code emits high-severity tamper events via emit_tamper_event() and includes the full event payload, reason text, rule hits, and path metadata. Because the payload may contain diffs, before/after content, or other sensitive change-log data, this can leak sensitive internal information to an external sink without any visible consent, minimization, or sanitization in this file.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script records full file contents, truncated content, and detailed diffs from monitored cognitive files into change-log artifacts on disk. If those files contain secrets, prompts, credentials, internal instructions, or sensitive user data, the monitor creates a secondary disclosure surface with potentially broader retention and access than the source files. In this skill context, the monitored files appear central and sensitive, which makes content replication into logs materially more dangerous.

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.dynamic_code_execution

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: INSTALL.md:35

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: no0-core/scripts/heartbeat_processor.py:44