Security audit

qg-skill-sync

Security checks for vulnerabilities and agentic risk

Overview

This skill is intended to sync team skills, but it creates an unattended remote update path that can change installed OpenClaw skills over time without strong validation or review.

Install only if you fully trust the configured Git repository and its maintainers, and understand that this can overwrite or delete synchronized local skills and keep updating them twice daily. Prefer manual sync or a pinned, reviewed repository revision, inspect diffs before activation, and make sure cron jobs and synchronized skill directories are removed if you uninstall.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/setup.sh:46
Finding: Unverified Remote Skills Are Automatically Retrieved and Activated
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:40
Finding: Recurring OpenClaw Jobs Establish Cross-Session Persistence
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup.sh:27
Finding: Shell Command Injection Through Executable Configuration File
Content: View full analysis
"$SYNC_HOME/config" <&2 exit 1 fi # 加载配置 # shellcheck source=/dev/null source "$CONFIG" ``` ### Technical Analysis `setup.sh` accepts the repository URL and Skill subdirectory as command-line arguments. Their values are written directly into a file that is later interpreted as shell code with `source`. The values are not safely serialized, quoted, or validated. An argument containing a newline can terminate the intended assignment and introduce an additional shell command. Shell syntax embedded in the resulting assignment may also be evaluated when the configuration is sourced. For example, a crafted second argument conceptually containing: ```text skills touch "$HOME/.qg-skill-sync/injected" ``` would produce configuration content equivalent to: ```bash SKILLS_SUBDIR=skills touch "$HOME/.qg-skill-sync/injected" ``` When `sync.sh` executes `source "$CONFIG"`, the injected command runs with the privileges of the synchronization process. The setup flow may encounter an earlier Git or path-related failure depending on the selected malicious value, but the unsafe executable configuration remains a direct injection primitive whenever a crafted configuration reaches the subsequent syn ...[truncated 1523 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs the agent to execute multiple shell commands, including setup scripts, sync scripts, and cron registration, but declares no tool scope or permission constraints. This increases the blast radius of accidental or malicious invocation because the agent may run filesystem- and network-capable commands without an explicit trust boundary or user-confirmed authorization model.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases cover broad intents like installing, updating, or syncing team skills, which can overlap with common user requests and cause the skill to activate unexpectedly. Because activation leads to shell execution, Git cloning, and persistent cron creation, an overbroad trigger materially raises the chance of unintended system changes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The phrase '立即同步' is highly generic and could match many unrelated requests, making accidental activation especially likely. In this skill, activation runs a local shell script that updates installed skills from a remote repository, so even a benign misfire can alter the agent's future behavior and supply chain state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script writes a persistent config file under the user's home directory, clones or updates a remote repository, and uses rsync -a --delete to mirror repository content into ~/.openclaw/skills without any confirmation, dry-run, backup, or explicit warning about deletion behavior. In this skill's context, that is security-relevant because a user is synchronizing code/content from a remote team repository into a local execution environment, so mistakes in SKILLS_SUBDIR, repository compromise, or unexpected repository contents can silently overwrite or remove local skills.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script runs rsync -a --delete, which can remove files from the destination and is therefore potentially destructive. Although the file has brief comments about syncing, there is no explicit warning, confirmation, or user-facing disclosure that destination files may be deleted during the operation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's natural-language comments and console output are entirely in Chinese, which imposes a specific language on users. There is no opt-in, language selection, or documented reason that the skill is intended only for a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Comments and the visible error/output text are written only in Chinese, which imposes a specific language choice on users without any opt-in or documented justification. Under the locale policy rule, this is a natural-language policy concern because the file does not offer an alternative language or explain a required locale context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This shell script's natural-language comments and console messages are entirely in Chinese, which imposes a specific language on users without any opt-in or indication that the skill is intended only for a Chinese-speaking environment. The stated policy requires flagging language or locale constraints unless they are optional or clearly justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.