ClawHub
Back to skill

Security audit

Manusilized

Security checks for vulnerabilities and agentic risk

Overview

This package is not a normal isolated skill: it patches OpenClaw core agent files and adds an unsafe Markdown-to-tool-call fallback that can turn model text into tool invocations.

Treat this as a core OpenClaw patch, not a regular skill. Review the TypeScript diff carefully, prefer the upstream PR if available, and do not install it in an environment with powerful tools or sensitive credentials unless you add tool allowlisting, argument validation, and explicit approval for consequential tool calls.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
patches/ollama-stream.ts:337
Finding

Untrusted Markdown Content Is Promoted to an Executable Tool Call

Content
View full analysis
; const name = typeof parsed.name === "string" ? parsed.name : undefined; if (!name) { continue; } const args = parsed.arguments != null && typeof parsed.arguments === "object" ? (parsed.arguments as Record) : parsed.parameters != null && typeof parsed.parameters === "object" ? (parsed.parameters as Record) : {}; results.push({ function: { name, arguments: args } }); } catch { log.warn(`[manusilized] Failed to parse Markdown tool call: ${raw.slice(0, 120)}`); } } return results; } ``` The resulting calls are subsequently attached to the assistant response as structured tool calls: ```ts if (accumulatedToolCalls.length === 0 && accumulatedContent) { const markdownCalls = extractMarkdownToolCalls(accumulatedContent); if (markdownCalls.length > 0) { log.debug( `[manusilized] Extracted ${markdownCalls.length} tool call(s) from Markdown fallback`, ); accumulatedToolCalls.push(...markdownCalls); // Strip the tool-call JSON blocks from the visible content so the ...[truncated 3252 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
3. Replace the corresponding files in `src/agents/` (`ollama-stream.ts` and `ollama-models.ts`).

Self-Modification

High
Category
Rogue Agent
Confidence
96% confidence
Finding

The README instructs the user to manually replace core files in the host OpenClaw installation, which is a self-modifying/core-patching behavior rather than a normal isolated skill installation. This bypasses normal package boundaries, review controls, and update mechanisms, creating a high-risk supply-chain path where untrusted repository contents can alter privileged application logic.

Content

Scanner excerpt · patches/README.md (reported line 8)May include surrounding context.

md
## How to apply

1. Copy `ollama-stream.ts` and `ollama-models.ts` from this repository.
2. Replace the original files in your OpenClaw installation at `src/agents/`.
3. Rebuild your OpenClaw project using `pnpm build`.

Alternatively, please support our official PR to get these features merged into the main OpenClaw repository!