T09 · Insecure Skill Coding Practices
Error
- Location
scripts/architecture_health_check.py:14- Finding
Execution of Unverified Workspace Test Scripts
- Content
View full analysis
- Remediation
View remediation
Security audit
Architecture Evolution Coordinator
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent architecture-coordination purpose, but it includes under-scoped local code execution and a hardcoded personal email report path that users should review before installing.
Install only if you understand that this skill is tailored to a specific OpenClaw workspace. Before use, remove or reconfigure the hardcoded report recipient, avoid storing email passwords in plain environment variables where possible, and do not run the health check unless you trust the workspace test and adapter files it will execute or import.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/architecture_health_check.py:105- Finding
Unsafe Dynamic Import and Instantiation of External Adapter Modules
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
scripts/check_phase_status.py:12- Finding
Overbroad Reading of Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill documents capabilities that include shell execution, file read/write, environment variable access, and network operations, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege controls and can cause an agent to invoke powerful operations implicitly, especially because the skill also includes commands for running scripts, reading config, and accessing external resources.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill states that reports are automatically emailed to an external recipient, including a hardcoded Gmail address, without a prominent user-facing consent warning. This creates a clear data exfiltration path because generated reports may contain workspace details, architecture state, logs, or other sensitive content that users may not realize is being transmitted externally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation instructs users to set credential-bearing environment variables for an email account password and API token without any security warning or safer handling guidance. This increases the chance that secrets will be stored insecurely, leaked through logs, shell history, screenshots, or inherited subprocess environments used by the skill's scripts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The prompt explicitly states that automated email reports are sent to a personal address, but it does not require explicit user consent, disclosure, opt-out controls, or handling guidance for potentially sensitive report contents. In an agent skill that monitors architecture, updates, diffs, and system state, reports could include private project metadata or internal details, creating a privacy and data-exfiltration risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python file contains natural-language descriptions and user-facing console/report strings exclusively in Chinese, starting from the module docstring and continuing throughout the script. Because the skill does not offer any language or locale selection, it effectively forces a specific language on users, which matches the policy-violation criteria.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python # 尝试获取README（多种可能的文件名） readme_files = ['README.md', 'README.rst', 'README.txt', 'README'] api_base = f"https://api.github.com/repos/{user}/{repo}/contents" for readme_file in readme_files: try:
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file's stated purpose is to analyze external GitHub projects by fetching README content and producing architectural mapping/proposals. Accessing a local credential from the environment adds a sensitive-capability step that is not described in the file documentation and is not obviously necessary for basic README analysis, especially when public repositories can be queried anonymously.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documented behavior emphasizes analyzing an external project and mapping concepts, but this block probes the local filesystem under /root/.openclaw/workspace/skills to inventory installed skills/plugins. That local environment inspection is a separate capability not inherent to fetching and analyzing a GitHub README.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s natural-language descriptions and user-facing report strings are entirely in Chinese, indicating a fixed language choice. The policy allows locale constraints only when the user is given a choice or the constraint is clearly documented and justified, which is not present here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script launches external test files without an explicit user-facing warning that a health check will execute code. This lack of disclosure increases the risk of unsafe use because operators may run the script expecting read-only diagnostics, while it actually performs potentially dangerous actions.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 97% confidence
- Finding
The health-check script executes external Python test files from the workspace using subprocess.run(). Those files are treated as trusted, but if they are modified by an attacker or generated from untrusted content, running the health check will execute arbitrary code under the current user's privileges.
- Content
python test_name = os.path.basename(test_path) try: # 运行测试（超时30秒） result = subprocess.run( [sys.executable, test_path], capture_output=True, text=True,
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
A script presented as an architecture health check goes beyond observation and actively executes external test programs. This broadens the skill from reporting state to running arbitrary code from the workspace, which is dangerous because users may not expect execution side effects from a diagnostic command.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script dynamically imports and instantiates adapter modules to assess functionality, which executes adapter code and constructors from a writable integration directory. In context, this is more dangerous because a health check is expected to be low-risk, yet it creates an execution path for any compromised adapter implementation.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
The script modifies sys.path to point at a workspace directory and then dynamically imports adapter modules by name. Importing a Python module executes its top-level code, so any malicious or compromised adapter file in that directory will run during a supposedly routine health check, creating a code-execution path.
- Content
python for adapter_name in adapters_to_check: try: module_name = f"{adapter_name}_adapter" module = __import__(module_name, fromlist=['']) # 检查是否有适配器类 adapter_class = None
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This Python file presents all user-facing descriptions, status messages, and recommendations in Chinese, including the module docstring and console output. Because the skill does not offer a language choice or document that it is intentionally region-specific, it imposes a specific language/locale on users, which matches the policy-violation criterion.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This script's command description, status messages, and generated report content are entirely in Chinese, with no option for the user to select another language or locale. The policy requires flagging language constraints when a skill forces a specific language without explicit opt-in or documented justification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The planned monitoring of arXiv, GitHub, and other external sources introduces network access and external data collection behavior without clear disclosure, authorization boundaries, or privacy/security constraints. Even if intended for legitimate update discovery, silent outbound requests and content ingestion can surprise users, leak metadata, or pull untrusted content into later decision-making workflows.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The script imports and instantiates adapter modules without clearly disclosing that module code and constructors will run. In a health-check context this is misleading and increases operational risk, because simply checking status can trigger arbitrary side effects from adapter implementations.
- Content
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python adapter_class = None for attr_name in dir(module): if attr_name.endswith('Adapter') and not attr_name.startswith('_'): adapter_class = getattr(module, attr_name) break if adapter_class:
Static analysis
No suspicious patterns detected.