L76 Core Arch

• Outcome: Pass
• Latest audit: May 28, 2026 · 9:01 AM UTC
• Version: 1.0.1

Overview

This is a coherent OpenClaw skill template with limited runtime behavior, but its sample code should be reviewed carefully before reuse.

Use this as a learning template, not as production-ready code to copy blindly. Before adapting the examples, replace shell string interpolation with safer APIs or argument-vector execution, add dry-run and confirmation steps for file/Git/publish actions, restrict watch/API/report scopes, and avoid logging or storing secrets in state.json, reports, caches, or memory files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The report and batch examples expose arbitrary command execution through user-controlled fields such as section.command and item.command. In a demonstration/template skill, this unnecessarily normalizes dangerous patterns and can lead downstream skill authors to embed command execution where safer APIs would suffice, creating command injection and privilege-abuse risk if inputs are not tightly constrained.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The API example builds a shell command for curl by interpolating method, endpoint, headers, and data into a single command string. This creates a direct command injection path and also adds shell execution capability beyond the stated architectural-demo purpose, making the example materially riskier than necessary.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The watcher backup example shells out with filePath and backupPath embedded in a command string. Although quotes reduce some risk, shell metacharacters and platform-specific parsing can still produce injection or unintended behavior, and the example introduces command execution where a file-copy API would be safer and sufficient.

Intent-Code Divergence

Medium

• Confidence: 77% confidence
• Finding: The recovery path for validate returns data and logs that processing will continue, but the surrounding loop records the stage as failed and does not clearly reconcile state before proceeding. This can leave inconsistent execution history and state, which may cause downstream logic, audits, or operators to misinterpret whether validation actually succeeded.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The logging plugin builds a shell command using interpolated serialized log data and a file path: `echo ... >> ${this.logFile}`. If `logFile` or logged content contains shell metacharacters, quoting breaks, or command substitution payloads, this can lead to command injection and arbitrary command execution under the agent's privileges.

Intent-Code Divergence

High

• Confidence: 91% confidence
• Finding: The document presents the tool wrappers as safe or production-ready patterns, yet elsewhere includes a logging example that performs shell-based logging with untrusted data. That contradiction is dangerous because readers may copy the pattern into real skills believing it is vetted, increasing the likelihood of command injection in production use.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The file provides direct publish commands and a one-command batch workflow that would make the skill live, but it does not include any explicit warning, confirmation step, or caution about the consequences of publishing. In a skill template or shared artifact, this increases the chance of accidental public release by users who copy-paste commands without realizing they are performing a live publication.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The watcher example describes automatic monitoring and backup behavior without clearly warning that file events can trigger reads and writes automatically. In a template context, this omission increases the chance that users deploy it against sensitive or broad directories without understanding the write side effects.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The API example omits warning that user-supplied endpoints, headers, and data may be transmitted to external services and that responses are cached to disk. This creates privacy, data handling, and credential exposure risks, especially in a reusable template likely to be copied into production-like skills.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The report generator can read local files, execute commands, collect system metrics, and write a report containing the gathered output, but the example does not warn about the sensitivity of that data flow. In a demo/template, this omission is dangerous because it encourages operators to aggregate secrets, environment details, or internal system information into a written artifact without safeguards.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The batch processor examples do not warn that transform mode can overwrite or create many target files in bulk. In a reusable template, lack of disclosure about mass file modification increases the risk of accidental data corruption or unintended writes across large file sets.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The Git hygiene example includes branch deletion and repository cleanup commands that can irreversibly modify repository state, yet it provides no warning, preview, backup advice, or confirmation step. In a template/reference skill, this can normalize unsafe patterns that downstream skill authors may copy directly into automation affecting real repositories.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The file organizer example performs bulk move operations on user files without any caution about data reorganization, overwrite risk, glob expansion surprises, or the need to preview changes. Because this is presented as a reusable example, users or authors may adopt it without adding safeguards, causing unintended modification or loss of user data layout.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The logging plugin records full options, results, and errors to disk, which can capture secrets, personal data, tokens, file contents, or stack traces. In an agent environment, those objects often include sensitive operational context, so indiscriminate persistence increases confidentiality and compliance risk even without active exploitation.

VirusTotal

No VirusTotal findings

Static analysis

No suspicious patterns detected.