Mrc Monitor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:49 AM UTC
• Version: 1.0.0

Overview

This skill mostly does what it says, but it reads more order data than needed, keeps local logs of user/order identifiers, and starts background polling with broad triggers.

Install only if you are comfortable with the skill contacting the listed Firebase project, sending notifications through the local openclaw CLI, and leaving local logs of channel IDs and order tokens. Prefer a revised version that queries only requested tokens, removes the embedded Firebase key from source, narrows command triggers, limits background runtime with a clear stop path, and redacts or expires logs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/monitor.py:107

Finding

Collection-Wide Firestore Reads Exceed Least-Privilege Requirements

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/monitor.py:14

Finding

Firebase API Key Is Hardcoded in the Skill Source

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/monitor.py:37

Finding

Messaging Identifiers and Order Activity Are Persisted in Plaintext Logs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared behavior understates what the skill actually does: it launches background processes, writes logs, uses channel identifiers, and relies on external service details. This mismatch can mislead reviewers and users about the real trust boundary, causing unapproved data exposure, persistence, or message-sending behavior to be deployed unnoticed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill uses shell execution and network access but does not declare any explicit tool scope or permissions. This weakens sandboxing and review controls, making it easier for the skill to invoke subprocesses and external services without clear operator approval or policy enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to extract all numbers from any user message creates an overly broad trigger that can activate on unrelated numeric content. An attacker or ordinary user could unintentionally start monitoring arbitrary tokens, causing unsolicited background jobs, unnecessary network polling, and possible information disclosure about order status.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Including a generic word like 'check' as a trigger without tight scope makes accidental or adversarial invocation more likely. In conversational contexts, normal messages containing 'check' plus a number could cause unintended Firebase queries or monitoring actions against arbitrary tokens.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

A hardcoded Firebase API key is embedded directly in source code, which is a credential-management weakness even if the data is only order status. Exposed keys are easy to extract, can be reused outside the intended workflow, and may enable unauthorized querying, quota abuse, or future access expansion if backend rules are misconfigured.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill invokes an external messaging CLI that is not explicitly declared in the manifested behavior, creating an undeclared capability boundary. Even if used for legitimate notifications, hidden subprocess-based messaging can bypass normal platform controls, surprise operators, and expand the attack surface if the environment's openclaw binary or message permissions are broader than expected.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/monitor.py (reported line 89)May include surrounding context.

python

'--target', channel_id,
                   '--message', text]

            result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)

            if result.returncode != 0:
                logger.error(f"❌ CLI error: {result.stderr}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The code fetches order records from a remote Firestore API, which is a network operation involving user/system data, but there is no confirmation prompt or nearby warning explaining that the skill will contact an external service and retrieve order information. The module docstring only says it monitors tokens and does not disclose the external data access behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The script invokes the external openclaw CLI via subprocess.run to send messages, but there is no explicit warning or comment to the user that an external command will be executed to deliver notifications. While the helper docstring names the message tool, it does not function as a user-facing disclosure of subprocess execution or outbound messaging.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.