T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:5- Finding
Agent Role and Workflow Hijacking Through Skill Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Opencode Guide
Security checks for vulnerabilities and agentic risk
Overview
This skill is a real OpenCode workflow helper, but it installs shared scripts automatically and includes unsafe command, logging, and callback behavior that users should review before installing.
Install only if you want OpenClaw tasks delegated through these OpenCode callback scripts. Review the lifecycle hooks first, avoid using the bash-c wrapper with untrusted task text, treat session keys and task logs as sensitive, and expect task content and summaries to be written under ~/.openclaw/task-results and passed to the local callback mechanism.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/opencode-run-with-callback.sh:62- Finding
Arbitrary Command Execution Through User-Controlled bash -c Input
- Content
View full analysis
&1" > "$JSON_OUTPUT" 2>>"$LOG_FILE" EXIT_CODE=$? ``` ### Technical Analysis The third positional argument is stored in `OPENCODE_CMD` and interpolated directly into a command string evaluated by `bash -c`. Because a shell parses the resulting string, an attacker-controlled value can contain command separators, pipelines, substitutions, redirects, or other shell syntax. Appending `--format json 2>&1` does not restrict the command to OpenCode. For example, a supplied value containing `;`, `&&`, `$(...)`, or a newline can execute additional commands before the appended arguments are processed. Quoting the variable at the outer `bash -c` invocation only ensures that it is passed as one argument to Bash. It does not prevent the inner Bash process from parsing and executing its contents. ### Attack Path 1. An attacker or untrusted task controls the wrapper's third argument. 2. The attacker supplies a value containing a legitimate-looking OpenCode command followed by shell syntax and an additional command. 3. The script constructs a new shell program by concatenating the input with `--format json 2>&1`. 4. `bash -c` parses the attacker-controlled shell program. 5. The injected command executes with the same user identity and environment as the process invoking the wrapper. A representative input structure would be: ```text opencode run "task"; attacker_controlled_command ``` The exact capability of the injected command is limited only by the invoking account's operating-system permissions and available credentials. ### Impact Assessment Successful exploitation permits arbi ...[truncated 509 chars]- Remediation
View remediation
"$JSON_OUTPUT" 2>>"$LOG_FILE" ``` 3. Validate `TIMEOUT` as a bounded positive integer before passing it to `timeout`. 4. If only specific OpenCode options are required, enforce an allowlist and reject unknown flags. 5. Resolve or configure the trusted OpenCode executable explicitly rather than allowing the caller to supply the executable name. 6. Add tests using shell metacharacters, command substitutions, redirects, and newlines to confirm that input is treated strictly as data. ]]>
T07 · Tool Hijacking and Spoofing
Warning
- Location
package.json:25- Finding
Shared Agent Tool Overwrite and Overbroad Removal Through Package Lifecycle Scripts
- Content
View full analysis
/dev/null || true", "preuninstall": "rm -f ~/.openclaw/scripts/opencode-*.sh ~/.openclaw/scripts/README-opencode-callback.md 2>/dev/null || true" } ``` ### Technical Analysis The `postinstall` lifecycle hook copies every bundled script into the shared `~/.openclaw/scripts/` directory without checking whether files with the same names already exist. Existing trusted tools can therefore be silently overwritten. The `preuninstall` hook uses the wildcard `opencode-*.sh`. This can delete scripts that match the pattern even if they were created by another package or by the user. The package does not maintain an ownership manifest or verify that a target file is identical to the file it installed. Both commands discard standard error and end with `|| true`, concealing collisions, permission errors, partial installations, and incomplete removals from the user or package manager. ### Attack Path 1. A user installs the package and the package manager executes `postinstall`. 2. Bundled files are copied into the shared Agent script directory. 3. Any existing files with matching names are replaced without confirmation. 4. Future legitimate-looking tool invocations use the package-provided scripts instead of the prior trusted implementations. 5. During uninstallation, the wildcard removal command can delete unrelated `opencode-*.sh` tools from the same shared directory. ### Impact Assessment The installation hook can modify the behavior of subsequent Agent tool calls by replacing scripts in a shared execution location. The uninstall hook can cause integrity and availability loss by deleting unrelated tools. The affected privileges are those of the account running the package lifecycle ...[truncated 139 chars]- Remediation
View remediation
/dev/null || true`; report failures and abort on unsafe collisions. 7. Prefer an explicit installation command over an automatically executed package lifecycle hook when modifying Agent tool directories is necessary. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/opencode-auto-callback.sh:21- Finding
Sensitive Task Arguments and Outputs Stored Without Restrictive Permissions
- Content
View full analysis
"$LOG_FILE" echo "开始时间: $(date)" >> "$LOG_FILE" echo "任务描述: $TASK_DESC" >> "$LOG_FILE" echo "参数: $@" >> "$LOG_FILE" echo "=== 执行输出 ===" >> "$LOG_FILE" # 执行 opencode 命令，使用 JSON 格式输出 opencode run --format json "$@" > "$JSON_OUTPUT" 2>>"$LOG_FILE" ``` ```bash # 保存结果到文件 echo "$RESULT_TEXT" > "$RESULT_FILE" ``` The alternate wrapper performs equivalent storage: ```bash RESULT_DIR="$HOME/.openclaw/task-results" mkdir -p "$RESULT_DIR" TIMESTAMP=$(date +%Y%m%d-%H%M%S) RESULT_FILE="$RESULT_DIR/task-${TIMESTAMP}.txt" LOG_FILE="$RESULT_DIR/task-${TIMESTAMP}.log" ``` ```bash echo "命令: $OPENCODE_CMD" >> "$LOG_FILE" ``` ### Technical Analysis The scripts persist task descriptions, complete command arguments, OpenCode JSON output, log output, and extracted result text under `~/.openclaw/task-results`. These values may contain proprietary source code, filesystem paths, tokens included in prompts, credentials exposed in diagnostic output, or other confidential task data. No restrictive `umask` is established, and neither the directory nor the files receive explicit permission modes. Their accessibility therefore depends on the invoking process's ambient umask and existing directory permissions. The scripts also define no retention limit or cleanup mechanism, causing sensitive output to accumulate over time. The timestamp-based ...[truncated 1265 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (22)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The preuninstall lifecycle hook removes files from ~/.openclaw/scripts using a wildcard pattern, which affects user-home content outside the package directory. Automatic deletion in lifecycle hooks is risky because it can remove files without granular validation and normalizes package-managed access to persistent agent script locations; combined with shell expansion, mistakes or future path changes could broaden impact.
- Content
json ], "scripts": { "postinstall": "cp -r scripts/* ~/.openclaw/scripts/ 2>/dev/null || true", "preuninstall": "rm -f ~/.openclaw/scripts/opencode-*.sh ~/.openclaw/scripts/README-opencode-callback.md 2>/dev/null || true" } }
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README's '禁止行为' section says not to analyze code, modify files, execute commands, or act on its own, presenting those as prohibited behaviors. However, later sections explicitly direct use of command-invoking callback scripts and tell opencode to review code and fix problems, which is an active contradiction in documented intent rather than a mere omission.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README advertises automatic start/completion callbacks and result-summary extraction but does not disclose what data is transmitted, where it is sent, or what identifiers and task content may be included. In a multi-agent workflow, this can cause sensitive prompts, task metadata, summaries, or repository-derived information to be sent externally without informed consent or proper review.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file begins with a Chinese-only title and all operational instructions are written in Chinese, which effectively imposes a specific language on users or operators. The document does not offer an alternative language, opt-in, or a justification that this skill is intended only for a Chinese-specific context.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document repeatedly states '你是传话筒 + 协调员，不是执行者' and forbids '不自己执行命令', implying the skill should not itself run commands. However, later sections instruct invoking
/home/root1/.openclaw/scripts/opencode-auto-callback.sh,cat, andlscommands directly, which is active command execution rather than mere relaying.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
text **⚠️ 重要：必须使用 opencode-auto-callback.sh 脚本！** - ❌ 错误：`nohup opencode run "..." > log 2>&1 &`（没有完成通知） - ❌ 错误：`run-background-task.sh`（旧脚本，已废弃） - ✅ 正确：使用 `opencode-auto-callback.sh`（自动发送开始/完成通知）
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
text **⚠️ 重要：必须使用 opencode-auto-callback.sh 脚本！** - ❌ 错误：`nohup opencode run "..." > log 2>&1 &`（没有完成通知） - ❌ 错误：`run-background-task.sh`（旧脚本，已废弃） - ✅ 正确：使用 `opencode-auto-callback.sh`（自动发送开始/完成通知）
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
- 检查自动回调脚本是否正常：
bash ls -la /home/root1/.openclaw/scripts/opencode-auto-callback.sh cat /home/root1/.openclaw/scripts/README-opencode-callback.md
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The package presents itself as a usage guide/documentation package, but its install lifecycle hooks modify files under the user's home directory. That mismatch is security-relevant because users may install it expecting passive documentation while it performs persistent side effects outside the package directory.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This is a manifest file, so vague-trigger checks apply. The description says the package is a guide for getting OpenClaw to call opencode correctly, but it does not define any specific activation phrases, boundaries, or negative examples, leaving invocation scope ambiguous if this metadata is used for discovery or routing.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The natural-language description is written entirely in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without opt-in is a language/locale violation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The postinstall hook copies files into ~/.openclaw/scripts, creating installation-time persistence in a user configuration directory. This is dangerous because npm lifecycle scripts execute automatically during install, allowing silent placement of executable content that may later be invoked by the agent environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README explicitly states that task results, logs, and JSON output are stored under ~/.openclaw/task-results/, but it does not warn that these artifacts and automatic callbacks may contain sensitive prompts, model output, session identifiers, or operational data. In an agent workflow, silent persistence and transmission of task data increases the risk of unintended disclosure, especially if users assume the wrapper is only orchestration glue.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script transmits the session identifier and task status to an external callback script without any validation, user confirmation, or visibility into where the data ultimately goes. In an agent/automation context, session keys can be sensitive routing or correlation identifiers, and sending them externally expands the attack surface for tracking, leakage, or unauthorized message injection.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script logs the task description and full command arguments to a local file, which can capture sensitive prompts, tokens, file paths, or operational details without minimization or consent. Because these logs are stored under a predictable directory in the user's home area, any local compromise, backup exposure, or overly broad file permissions can leak sensitive data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script extracts result text, stores it on disk, and forwards the result file through a callback path, creating both at-rest and in-transit exposure of model output. If the task output contains secrets, proprietary code, or sensitive business data, this behavior can exfiltrate that information outside the expected execution boundary, which is especially risky in an agent skill that may process confidential content automatically.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This shell script includes its title, usage examples, and later user-facing status messages entirely in Chinese. Because the file provides no opt-in, fallback language, or justification that the skill is intended only for Chinese-speaking users, it creates a natural-language locale policy concern.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The inline parameter description presents opencode_command as a literal command to run, with examples like 'opencode run ...'. In execution, the script does not run that command directly; it reconstructs a new shell command with
bash -cand appends--format json, which changes the supplied command's behavior and can cause it to do something different than the documentation implies.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
Natural-language policy issues include forcing a specific language without user opt-in. This document presents all operational guidance in Chinese with no indication of alternative language support or explicit justification for a language restriction.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
Early workflow rules require asking for confirmation before execution and say not to act on one's own. Yet the later 'Plan 模式' section instructs the skill to analyze the existing implementation and produce a detailed plan before user confirmation, which conflicts with the earlier prohibition on self-analysis/action.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The file's natural-language instructions exclusively use Chinese, which effectively forces a specific language for users reading the skill documentation. Under the stated policy, locale or language restrictions should be opt-in or explicitly justified when the skill is region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Comments, usage text, and examples are all presented only in Chinese, and the script does not offer any locale or language selection. This is a natural-language policy concern because it forces a specific language without user opt-in or documented regional justification.
- Content
Static analysis
No suspicious patterns detected.