Git Repo Analyzer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 1.0.0

Overview

The skill is a URL and repository analyzer, but it can make persistent local changes, install remote skills, and save fetched content into agent memory with weak safeguards.

Install only if you are comfortable with a skill that can contact URLs you provide, clone remote repositories, write to OpenClaw memory, and install or replace local skills. Use it only on trusted repositories and links, and prefer adding explicit confirmation and path validation before install or memory-write actions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/install_skill.py:7

Finding

Arbitrary Directory Deletion and Path Traversal During Skill Installation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/analyze_skill_security.py:77

Finding

Repository Name Traversal Allows Staging Directory Escape and Unsafe Cleanup

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/analyze_skill_security.py:29

Finding

Incomplete Security Scanner Can Approve and Install Malicious Skill Payloads

Content

View full analysis

3 else "pass", "details": f"发现 {len(network_calls)} 个网络调用", }, "systemPermissions": { "status": "warn" if requires_sudo else "pass", "details": "需要系统权限" if requires_sudo else "无需特殊权限", }, "dependencies": {"status": "pass", "details": "已检查依赖声明"}, "overall": "safe", "tmpDir": staging_dir, "repo": repo_name, } fail_count = sum(1 for r in [report["fileStructure"], report["networkBehavior"], report["systemPermissions"], report["dependencies"]] if r["status"] == "fail") warn_count = sum(1 for r in [report["fileStructure"], report["networkBehavior"], report["systemPermissions"], report["dependencies"]] if r["status"] == "warn") if fail_count > 0: report["overall"] = "dangerous" elif warn_count > 1: report["overall"] = "caution" ``` ### Technical Analysis The security review exa ...[truncated 1848 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/detect_url_type.py:35

Finding

Unrestricted URL Classification Request Enables Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: scripts/process_webpage.py:46

Finding

Untrusted Remote Article Content Is Persisted in Agent Memory

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (43)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Claiming broad routing and analysis while mostly writing to a local queue is not just a product-quality issue; it affects safe invocation and review. Security controls are often chosen based on declared behavior, and misleading descriptions can cause a skill with write side effects to be treated as read-only analysis.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Claiming broad routing and analysis while mostly writing to a local queue is not just a product-quality issue; it affects safe invocation and review. Security controls are often chosen based on declared behavior, and misleading descriptions can cause a skill with write side effects to be treated as read-only analysis.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Claiming broad routing and analysis while mostly writing to a local queue is not just a product-quality issue; it affects safe invocation and review. Security controls are often chosen based on declared behavior, and misleading descriptions can cause a skill with write side effects to be treated as read-only analysis.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Claiming broad routing and analysis while mostly writing to a local queue is not just a product-quality issue; it affects safe invocation and review. Security controls are often chosen based on declared behavior, and misleading descriptions can cause a skill with write side effects to be treated as read-only analysis.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Claiming broad routing and analysis while mostly writing to a local queue is not just a product-quality issue; it affects safe invocation and review. Security controls are often chosen based on declared behavior, and misleading descriptions can cause a skill with write side effects to be treated as read-only analysis.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Claiming broad routing and analysis while mostly writing to a local queue is not just a product-quality issue; it affects safe invocation and review. Security controls are often chosen based on declared behavior, and misleading descriptions can cause a skill with write side effects to be treated as read-only analysis.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Claiming broad routing and analysis while mostly writing to a local queue is not just a product-quality issue; it affects safe invocation and review. Security controls are often chosen based on declared behavior, and misleading descriptions can cause a skill with write side effects to be treated as read-only analysis.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Claiming broad routing and analysis while mostly writing to a local queue is not just a product-quality issue; it affects safe invocation and review. Security controls are often chosen based on declared behavior, and misleading descriptions can cause a skill with write side effects to be treated as read-only analysis.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Claiming broad routing and analysis while mostly writing to a local queue is not just a product-quality issue; it affects safe invocation and review. Security controls are often chosen based on declared behavior, and misleading descriptions can cause a skill with write side effects to be treated as read-only analysis.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger conditions are extremely broad ('any URL', analyzing links, processing projects, saving webpages), making accidental invocation likely during ordinary conversation. Because the skill can perform network access, queue writes, browser fetching, cloning, or installation-related steps, overbroad activation materially raises the risk of unintended side effects on untrusted or casually mentioned URLs.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

浅克隆仓库到 staging，读取 `SKILL.md` 并扫描危险指令，返回安全评级（safe / caution / dangerous）。

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script's behavior materially differs from the declared purpose of a repository/link analyzer: it installs content into ~/.openclaw/skills/installed and deletes existing directories. That mismatch is dangerous because a user invoking what appears to be a passive analysis skill could instead cause persistent local modification and replacement of installed skills, enabling unauthorized code/content deployment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares no explicit tool restrictions while its documented workflow includes network access, shell execution, environment-variable use, and local file writes under ~/.openclaw. That combination gives the skill broad effective authority and increases the blast radius if the workflow is triggered on untrusted input or if downstream scripts behave unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 68% confidence

Finding

The natural-language instructions and operational descriptions are entirely in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, a skill should not impose a language or locale without opt-in or clear justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill omits a clear top-level warning that some webpages may be automatically fetched via browser automation and saved into local memory. That weakens informed consent and can surprise users with network activity, content retention, or handling of pages they did not expect to be archived locally.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/analyze_git_repo.py (reported line 11)May include surrounding context.

python

repo = repo.replace(".git", "")
    headers = {}
    if platform == "github":
        url = f"https://api.github.com/repos/{owner}/{repo}/contents"
        token = os.environ.get("GITHUB_TOKEN")
        if token:
            headers["Authorization"] = f"token {token}"

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes four content types with concrete actions such as risk detection, collecting skills, adding papers/pages to a wiki queue, and evaluating OpenClaw learning feasibility. In this file, the implementation merely infers a subtype from top-level filenames and returns a JSON summary, without performing any of the described processing actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill supports both Git repository URLs and normal links/pages, including article collection and webpage saving flows. However, this file validates input strictly against a Git-hosting regex and returns an error for anything else, so its implemented behavior is narrower than the described capability.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script claims to perform a basic security review of a cloned skill repository, but in reality it only reads SKILL.md and scans its text for a few regexes. This creates a dangerous false sense of assurance: malicious code in other files, dependency manifests, hooks, or embedded scripts will be missed while the tool may still label the repo safe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python file performs safety-relevant operations: it clones a remote repository and later deletes the staging directory with rm -rf. While the module docstring mentions cloning and review at a high level, there is no user-facing disclosure, prompt, or explicit warning near execution that local files will be created and may be automatically removed.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_skill_security.py (reported line 21)May include surrounding context.

python

def clone_repo(url: str, staging_dir: str):
    subprocess.run(
        ["git", "clone", "--depth", "1", url, staging_dir],
        check=True, capture_output=True, text=True,
    )

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/analyze_skill_security.py (reported line 37)May include surrounding context.

python

file_structure_check = any(p.search(content) for p in DANGEROUS_PATTERNS)
    network_calls = re.findall(r"https?://[^\"'\s]+", content)
    suspicious = [u for u in network_calls if "github.com" not in u and "gitlab.com" not in u]
    requires_sudo = re.search(r"sudo|chown root|setuid", content) is not None

    report = {
        "fileStructure": {

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/analyze_skill_security.py (reported line 49)May include surrounding context.

python

file_structure_check = any(p.search(content) for p in DANGEROUS_PATTERNS)
    network_calls = re.findall(r"https?://[^\"'\s]+", content)
    suspicious = [u for u in network_calls if "github.com" not in u and "gitlab.com" not in u]
    requires_sudo = re.search(r"sudo|chown root|setuid", content) is not None

    report = {
        "fileStructure": {

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/analyze_skill_security.py (reported line 50)May include surrounding context.

python

file_structure_check = any(p.search(content) for p in DANGEROUS_PATTERNS)
    network_calls = re.findall(r"https?://[^\"'\s]+", content)
    suspicious = [u for u in network_calls if "github.com" not in u and "gitlab.com" not in u]
    requires_sudo = re.search(r"sudo|chown root|setuid", content) is not None

    report = {
        "fileStructure": {

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Natural-language output such as 检测到危险系统指令, 文件结构安全, 需要系统权限, and 无需特殊权限 forces Chinese-language results for all users. This is a locale policy concern because the file does not provide opt-in, fallback, or documentation that the tool is intentionally region-specific.

Content

No source excerpt is available for this finding.