Security checks for vulnerabilities and agentic risk
Overview
This is a straightforward WrynAI web crawling skill, with cautions around third-party data sharing, an unpinned SDK install, and a screenshot example that can overwrite a local file.
Install this only if you are comfortable using WrynAI as a third-party crawling provider. Prefer a virtual environment and a pinned SDK version, do not send private/internal URLs or sensitive page content unless approved, and change the screenshot example to use a chosen non-overwriting output path.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
Location
SKILL.MD:22
Finding
Unpinned Third-Party SDK Installation
Content
View full analysis
Vulnerability Details
File Location: SKILL.MD:22 and SKILL.MD:678 Vulnerability Type: Unpinned third-party dependency Risk Level: Medium
Vulnerable Code
bash
pip install wrynai
The same unpinned installation command appears in both the prerequisite and OpenClaw integration instructions.
Technical Analysis
The skill instructs users to install wrynai without specifying an exact version or validating package integrity. Although the document later identifies the expected SDK as version 1.0.0, the installation command does not enforce that version.
Package resolution is therefore mutable: pip will install whichever release the configured package index currently considers appropriate. A compromised package release, compromised package index, or unexpected future version could introduce code that was not part of this audit. Python packages can execute code during installation or when imported.
The SDK is subsequently initialized with the WRYNAI_API_KEY, so a malicious dependency version could access that credential in addition to the files, network resources, and other capabilities available to the invoking user.
Attack Path
An attacker compromises the package distribution account, package index, or a future dependency release.
The attacker publishes a modified version under the package name resolved by pip install wrynai.
A user follows the skill instructions without a lock file, version constraint, or integrity hashes.
Pip retrieves and installs the attacker-controlled release.
Malicious code runs during installation or when wrynai is imported.
The code operates with the invoking user's privileges and may access the API key supplied to the SDK, local user-accessible data, and network resources.
Impact Assessment
Successful exploitation could allow arbitrary Python code execution with the privileges of the user installing or running the skill. The
...[truncated 281 chars]
Remediation
View remediation
Remediation Suggestions
Pin the dependency to a reviewed version:
bash
python -m pip install "wrynai==1.0.0"
Prefer a locked requirements file containing cryptographic hashes:
text
# Decode and save
image_data = result.screenshot
if "," in image_data:
image_data = image_data.split(",")[1]
filename = "screenshot.png"
with open(filename, "wb") as f:
f.write(base64.b64decode(image_data))
Technical Analysis
The screenshot example always writes to screenshot.png in the process's current working directory. Opening the file with mode "wb" truncates an existing file. The operation also follows symbolic links on platforms where they are supported.
Because the filename is predictable and no checks are performed for prior existence, file type, or symbolic links, another local actor able to modify the working directory can prepare the path before the function runs. The write may then overwrite an existing file or be redirected through a symbolic link to another path writable by the invoking user.
The decoded content is treated as image data and is not executed, so the issue is local file clobbering rather than payload execution.
Attack Path
An attacker obtains write access to the directory from which the screenshot example will run.
The attacker creates screenshot.png as a symbolic link to another file writable by the victim, or relies on the fixed filename colliding with an existing file.
The victim invokes capture_page_screenshot.
open(filename, "wb") follows the prepared link or opens the existing file and truncates it.
The function writes decoded screenshot bytes over the selected target.
Impact Assessment
Exploitation can corrupt or replace files writable by the invoking user. It does not independently grant additional privileges: the process remains constrained by the caller's filesystem permissions. The practical scope depends on the working directory and the privileges u
...[truncated 124 chars]
Remediation
View remediation
Remediation Suggestions
Accept an explicit output path from the caller and validate that it is inside an approved output directory.
Refuse to overwrite existing files unless the caller explicitly requests replacement.
Use exclusive creation to prevent silent clobbering:
python
from pathlib import Path
output_path = Path("screenshot.png")
with output_path.open("xb") as f:
f.write(base64.b64decode(image_data, validate=True))
For temporary screenshots, use tempfile.NamedTemporaryFile or tempfile.mkstemp to create a unique file atomically.
Where available, reject symbolic links and use no-follow semantics when opening the destination.
Avoid running the screenshot routine with elevated privileges or from directories writable by untrusted users.
Validate Base64 input and impose a maximum decoded size before writing to limit malformed-data and resource-exhaustion risks.
The skill is built around sending user-supplied URLs, search queries, and retrieved page content to the external WrynAI service, but it does not clearly warn users about third-party data disclosure. In an agent setting, this can expose sensitive research topics, internal URLs, or proprietary content to an external provider without informed consent.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Low
Category
Not specified by scanner
Confidence
93% confidence
Finding
The screenshot helper is documented as capturing a screenshot, but it also decodes attacker-controlled response data and writes it to a fixed local filename. That mismatch can cause unintended filesystem side effects, including silent overwrite of an existing file, especially when this code is copied into automation without review.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
91% confidence
Finding
The screenshot example writes output to a hard-coded local filename without explicitly warning that running it will create or overwrite a file on disk. In practice, this can lead to unintended file modification in shared workspaces or automated environments where users assume the example is read-only or API-only.
