T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
telegram-commands/agents_monitor.plugin.json:12- Finding
Unrestricted Telegram Command Exposes Local Agent and Host Status
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Status Monitor
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it says, but its Telegram command can expose local agent and host status too broadly and its references include commands that may reveal private prompt history.
Install only if you are comfortable exposing local agent status, session counts, and some local paths. Avoid enabling the Telegram command in groups or shared chats unless you add an allowlist or private-chat restriction, and do not run the reference commands that print prompt history or search your whole home directory. Prefer the ClawHub install path or a pinned installer version over unpinned npx.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/agent-commands.md:89- Finding
Reference Commands Encourage Access to Private Prompt History and Broad Home-Directory Enumeration
- Content
View full analysis
/dev/null ``` ### Technical Analysis The project describes itself as a metadata-based, read-only status monitor and states that it does not access private data. The reference documentation nevertheless instructs an operator or agent to print the complete OpenCode prompt-history file. Prompt-history files may contain source code, user requests, internal project details, credentials accidentally included in prompts, or other private conversation content. Reading the complete file is unnecessary for determining whether an agent is running or recently active. The second command searches the entire home directory rather than the declared agent session directories. It can enumerate unrelated application logs and session files. The `find` expression also has a precedence defect. Without parentheses, it is interpreted approximately as: ```text -name "*.log" OR (-name "sessions.json" AND -mmin -60) ``` Consequently, the modification-time restriction does not apply to matching `.log` files. All `.log` paths under the home directory may be enumerated, regardless of age. ### Attack Path 1. An agent or operator uses `references/agent-commands.md` while troubleshooting or extending status monitoring. 2. The documented prompt-history command is executed. 3. Complete OpenCode prompt content is printed into the terminal, agent context, logs, or a remote response. 4. Alternatively, the broad `find` command is executed and enumerates unrelated log files across the user’s home directory. 5. Sensitive information may then be exposed through the invoking agent’s output or retained in its ...[truncated 478 chars]- Remediation
View remediation
/dev/null ``` 5. Avoid printing file contents or sensitive filenames in status reports. 6. Update the documentation to state explicitly that prompt contents, conversation logs, and unrelated home-directory files must not be read. 7. Add tests or static checks that reject broad searches rooted at `$HOME` for this monitoring use case. ]]>
T08 · Insecure Dependencies
Note
- Location
README.md:19- Finding
Unpinned npx Installation Command Creates a Mutable Supply-Chain Execution Path
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (19)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
该描述在触发词中直接包含“监控开发工具”，范围较大，未限定必须是本地 Agent 状态检查场景，容易与一般性的开发工具监控、IDE 诊断或性能排查请求混淆。虽然文档后文解释了用途，但触发词本身缺少边界和排除条件。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
“agent 状态”可指代多种系统、服务或云端代理，不一定是该技能定义的本地开发 Agent。虽然后文有限制说明，但触发示例本身没有体现“本地开发工具 Agent”这一关键约束，可能导致误触发。
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The reference lists agent session and log directories for multiple tools but does not warn that these locations may store sensitive transcripts, tokens, local paths, or operational metadata. In a security-sensitive agent environment, providing these paths as routine troubleshooting steps can facilitate accidental browsing, collection, or disclosure of confidential information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document explicitly instructs users to print prompt history from a local session file without any warning that prompts may contain secrets, credentials, proprietary code, or personal data. In an agent-skill context, normalizing direct access to prompt/session history increases the likelihood of inadvertent data exposure or misuse by users or downstream automation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script's natural-language content, including comments, usage text, and user-facing status messages, is entirely in Chinese. This imposes a specific language on users without any opt-in, fallback, or indication that the skill is intentionally region-specific, which matches the locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This shell script's comments and user-facing output are written in Chinese, including the usage and status messages. Under the language/locale policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.
- Content
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
问题：找不到脚本
bash # 验证脚本路径 ls -la ~/.openclaw/workspace/skills/agent-status-monitor/scripts/📄 文件结构
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
问题：找不到脚本
bash # 验证脚本路径 ls -la ~/.openclaw/workspace/skills/agent-status-monitor/scripts/📄 文件结构
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
问题：找不到脚本
bash # 验证脚本路径 ls -la ~/.openclaw/workspace/skills/agent-status-monitor/scripts/📄 文件结构
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file's docstrings and all returned status/error messages are written in Chinese, indicating the skill is designed to operate in a single language. There is no opt-in, language selection mechanism, or justification that this is a region-specific tool, which conflicts with the policy against forcing a specific language without user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file's natural-language interface is exclusively in Chinese, including the description and usage text. Under the stated policy, forcing a specific language without offering a user choice or documenting a justified locale restriction is a policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The file presents its instructions in Chinese only, which can amount to a language/locale policy issue when no user opt-in or justification is provided. There is no indication that the skill is region-specific or that alternate language support is intentionally out of scope.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This shell script includes user-facing natural-language content in Chinese comments and output labels such as the usage and status section text, while also mixing in English output. Under the language/locale policy rule, forcing a specific language or mixed locale presentation without user opt-in can be a policy concern when no language choice or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This shell script's natural-language comments, usage text, and user-facing status output are all in Chinese, with no indication that the skill is region-specific or that users can choose another language. That creates a language-policy issue because it imposes a specific locale on all users without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
All user-facing comments and terminal output in the script are in Chinese, which imposes a specific language/locale on users. The file does not offer any language selection, fallback, or justification that the skill is intended only for a Chinese-speaking environment.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The user-facing documentation is written entirely in Chinese, including command usage guidance and warnings, with no indication that other languages are supported or that Chinese is a required locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest’s user-facing command description is written only in Chinese, which can impose a language choice on users without any indication of opt-in or regional scoping. This matches the language/locale policy concern for natural-language content in any file type.
- Content