T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fritz_status.py:13- Finding
Shared credential store and unrestricted router destination
- Content
View full analysis
- Remediation
View remediation
Security audit
Fritz Connection
Security checks for vulnerabilities and agentic risk
Overview
The skill’s router monitoring purpose is coherent, but it can immediately reboot, reconnect, or disable Wi-Fi and handles router credentials with weak scoping.
Review before installing. Use a dedicated low-privilege FRITZ!Box account where possible, keep credentials in a skill-specific file with restricted permissions, verify FRITZBOX_HOST points only to your router, and avoid letting agents run reboot, reconnect, wlan off, or calls without explicit confirmation. Pin dependencies or install in an isolated virtual environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fritz_status.py:171- Finding
Unvalidated call-list URL permits server-side request forgery and unsafe resource retrieval
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fritz_status.py:135- Finding
Router-wide destructive operations execute without runtime confirmation
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Open-ended dependency versions create a supply-chain risk
- Content
View full analysis
=1.15.0 python-dotenv>=1.0.0 ``` ### Technical Analysis Both dependencies use open-ended lower-bound constraints. A future installation may therefore select any later compatible release available from the configured package index. The project also provides no hashes to verify downloaded artifacts. No evidence was found that either named dependency is currently malicious, misspelled, or fetched from an explicitly unsafe source. The risk arises because future package releases can be installed without review, making installations non-reproducible and expanding exposure to compromised maintainer accounts, malicious upstream releases, or package-index compromise. Python package installation can execute build-system code, and imported packages execute with the same privileges as the Skill process. `python-dotenv` handles credential loading, while `fritzconnection` receives the router address and password and performs network operations, making compromise of either dependency security-sensitive. ### Attack Path 1. An upstream package account, release process, distribution artifact, or configured package index is compromised. 2. A malicious version newer than the stated minimum is published. 3. A user follows the documented installation command: `pip install -r requirements.txt`. 4. The resolver selects the malicious newer release because it satisfies the `>=` constraint. 5. Build-time or import-time code executes with the installing user's privileges. 6. The compromised package can access the Skill process, environment variables, router credentials, local files available to that user, and network connectivity. ### Impact Assessment A compromised dependency could execute arbitrary Python code under the account installing or runn ...[truncated 367 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (16)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ FritzBox Status Checker Lädt Credentials aus ~/.openclaw/skills/.env """ import os
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ FritzBox Status Checker Lädt Credentials aus ~/.openclaw/skills/.env """ import os
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ FritzBox Status Checker Lädt Credentials aus ~/.openclaw/skills/.env """ import os
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """ FritzBox Status Checker Lädt Credentials aus ~/.openclaw/skills/.env """ import os
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from datetime import datetime # Fallback: skill-lokales .env SKILL_ENV = Path(__file__).parent.parent / ".env" OPENCLAW_ENV = Path.home() / ".openclaw" / "skills" / ".env"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from datetime import datetime # Fallback: skill-lokales .env SKILL_ENV = Path(__file__).parent.parent / ".env" OPENCLAW_ENV = Path.home() / ".openclaw" / "skills" / ".env"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
⚙️ Configuration
Create or update your
~/.openclaw/skills/.envfile:env FRITZBOX_HOST=192.168.178.1
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents use of environment secrets and direct network access to a local FRITZ!Box, but it declares no explicit tool scope or permission boundary. That omission increases the chance an agent can access secrets or invoke networked router-control actions without clear policy gating, which is especially risky because the documented capabilities include disruptive actions like reboot, reconnect, and WLAN changes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description and the entire user-facing documentation are written in German, including command guidance and safety instructions, with no indication that language choice is optional. This creates a locale/language policy concern because the skill appears to require a specific language without explicit user opt-in or a documented region-specific need.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The
callscommand fetches and processes the router's call list, which contains sensitive personal communication metadata such as caller identities, timestamps, and durations. While the command help says it shows the call list, there is no explicit warning in code comments, prompts, or output that sensitive telephony data will be retrieved from the router.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The WLAN command performs immediate state changes across configured radios when given 'on' or 'off', without any confirmation or safety interlock. In an agent/automation context this is disruptive because it can instantly disconnect users and dependent devices, and may lock out remote administrators relying on Wi‑Fi.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The manifest describes status queries and control of the FRITZ!Box itself, specifically status, traffic, host lists, WLAN control, call lists, reconnect, and reboot. In the extension examples, the file documents DECT smart-home capabilities such as listing home automation devices and switching a smart plug, which expands the skill's apparent capability into controlling unrelated end devices in the home.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The manifest and earlier documentation describe access to call lists, which implies retrieval of stored call history. The call-monitoring section adds a distinct capability: live monitoring of incoming and outgoing call events, which is more privacy-sensitive and not stated in the declared purpose.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency is specified with only a lower bound, so builds may resolve to different versions over time. This weakens reproducibility and can unintentionally pull in a later vulnerable or breaking release through normal dependency resolution.
- Content
text fritzconnection>=1.15.0 python-dotenv>=1.0.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
python-dotenv is also unpinned, which means the installed version is not deterministic and may vary across environments or over time. In a skill that may handle local configuration and secrets, uncontrolled dependency drift increases the chance of introducing a vulnerable or incompatible release.
- Content
text fritzconnection>=1.15.0 python-dotenv>=1.0.0
Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 82% confidence
- Finding
The manifest does not pin python-dotenv, and there are known advisories affecting some versions, so the project cannot demonstrate that it avoids those vulnerable releases. While the requirements file alone does not prove an exploitable condition, the uncertainty is a supply-chain risk, especially because dotenv libraries commonly interact with local files and environment-based secrets.
- Content
Static analysis
No suspicious patterns detected.