Security audit

Agile Workflow

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real workflow automation tool, but it includes persistent background execution and unsafe automatic cleanup or external execution paths that can affect unrelated OpenClaw data.

Review this skill carefully before installing. Use it only in an isolated OpenClaw environment, do not add the documented cron jobs or run long-lived daemons until persistence and cleanup are scoped, disable automatic report submission, and avoid exposing the dashboard unless it is bound to localhost and protected with authentication.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T06 · System Persistence

Warning

Location: SKILL.md:160
Finding: Persistent Scheduled Execution Through Crontab
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/workflow-monitor.js:19
Finding: Shell Command Injection Through the Project Directory Argument
Content: View full analysis
/tmp/scheduler-monitor.log 2>&1 &', (error, stdout) => { if (error) { log('Scheduler restart failed: ' + error.message, 'ERROR'); } else { log('Scheduler restarted', 'INFO'); } }); } function triggerTaskCheck() { log('Triggering task check...', 'INFO'); exec('cd /home/ubutu/.openclaw/workspace && node skills/agile-workflow/core/task-scheduler.js ' + PROJECT_DIR + ' check > /tmp/task-check.log 2>&1', (error, stdout) => { if (error) { log('Task check failed: ' + error.message, 'ERROR'); } }); } ``` ### Technical Analysis `PROJECT_DIR` can be supplied through either a command-line argument or the `OPENCLAW_PROJECT_DIR` environment variable. It is inserted into command strings without quoting, escaping, canonicalization, or validation. Node.js `exec()` invokes a shell. Shell metacharacters in `PROJECT_DIR`, including semicolons, command substitutions, redirections, and logical operators, are therefore interpreted as commands rather than as part of a filesystem path. Both vulnerable functions are reachable during normal monitoring. `triggerTaskCheck()` runs when pending tasks exist but no task is running. `restartScheduler()` runs when the monitor determines that no scheduler daemon is active. ### Attack Path 1. An attacker influences the ...[truncated 1022 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: core/self-healing-monitor.js:170
Finding: Automatic Deletion of Session Data Outside the Selected Project
Content: View full analysis
100) { this.log('Old session files exceed threshold: ' + oldSessions.count, 'WARN'); issues.push({ type: 'old_sessions', severity: 'low', details: oldSessions }); } ``` The issue is automatically remediated: ```js case 'old_sessions': this.log('Recommendation: clean session files older than seven days'); await this.cleanupOldSessions(); break; ``` Both enumeration and deletion use a global OpenClaw path rather than the selected project: ```js async checkOldSessions() { return new Promise((resolve) => { exec('find /home/ubutu/.openclaw/agents -name "*.jsonl" -mtime +7 | wc -l', (error, stdout) => { if (error) { resolve(null); return; } resolve({ count: parseInt(stdout.trim()) }); }); }); } async cleanupOldSessions() { this.log('Cleaning session files older than seven days...'); exec('find /home/ubutu/.openclaw/agents -name "*.jsonl" -mtime +7 -delete', () => { this.log('Session files older than seven days were cleaned'); }); } ``` ### Technical Analysis The self-healing component is instantiated by the default scheduler daemon and runs a long-term stability check every hour. If more than 100 JSONL files under the global OpenClaw agents directory are older than seven days, it deletes every matching file. The cleanup does not use `projectDir`, does not establish ownership by the current workflow, and does not request confirmation. Files belonging to unrelated agents or projects are therefore included. This violates least privilege: a project work ...[truncated 1118 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: dashboard/backend/server.js:308
Finding: Unauthenticated Network Exposure of Workflow Telemetry
Content: View full analysis
{ const data = collector.getCache(); res.json(data.overview || { error: 'No data available' }); }); app.get('/api/tasks', (req, res) => { const data = collector.getCache(); res.json(data.tasks || []); }); app.get('/api/agents', (req, res) => { const data = collector.getCache(); res.json(Object.values(data.agents || {})); }); app.get('/api/alerts', (req, res) => { const data = collector.getCache(); res.json(data.alerts || []); }); app.get('/api/metrics', (req, res) => { const data = collector.getCache(); res.json(data.metrics || { error: 'No data available' }); }); ``` WebSocket clients receive the cached state immediately: ```js io.on('connection', (socket) => { console.log(`Client connected: ${socket.id}`); socket.emit('init', collector.getCache()); const unsubscribe = collector.subscribe((data) => { socket.emit('update', data); }); }); ``` The server is started without a loopback-only host: ```js server.listen(CONFIG.port, () => { console.log(`API: http://localhost:${CONFIG.port}/api`); }); ``` ### Technical Analysis No authentication or authorization middleware protects the REST or WebSocket interfaces. Socket.IO accepts every origin through `origin: '*'`. Calling `server.listen(CONFIG.port)` without specifying a host normally binds the service to the unspecified address, making it reachable thro ...[truncated 1326 chars]
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/submit-report.js:16
Finding: Automatic Execution of an Unverified External Submission Script
Content: View full analysis
{ if (error) { console.error(`Submission failed: ${error.message}`); console.error(`stderr: ${stderr}`); process.exit(1); } console.log('Submission succeeded'); console.log(stdout); process.exit(0); }); } ``` Automatic submission is enabled unless explicitly disabled: ```js if (fs.existsSync(config.submitScript)) { const shouldSubmit = process.env.AUTO_SUBMIT !== 'false'; if (shouldSubmit) { submitReport(report); } } ``` ### Technical Analysis The Skill executes a fixed shell script located outside the audited package. That external script is not included in the project, so its contents, destination, ownership, integrity, and data-handling behavior cannot be verified. The only prerequisite is that a filesystem object exists at the configured path. No check confirms that it is a regular file, that it is owned by a trusted account, that its permissions are safe, or that its content matches an approved digest. Submission is opt-out rather than opt-in. Consequently, runnin ...[truncated 1148 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (451)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill description makes strong claims about being a safe, concurrency-safe, zero-pollution workflow engine, while the analyzed behavior reportedly includes undeclared file writes, process management, monitoring, repair, cleanup, background execution, and other operational actions. This mismatch is dangerous because users may grant trust and run the skill under false assumptions, enabling unintended state changes, persistence, or host-level actions.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: backups/20260315_215924/agile-workflow-engine-v5.js:588

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: backups/20260315_215924/health-check-v2.js:148

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: core/agent-manager.js:195

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: core/agent-process-pool.js:69

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: core/agent-supervisor.js:69

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: core/failure-handler.js:221

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: core/global-process-manager.js:54

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: core/health-check.js:80

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: core/log-monitor.js:390

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: core/self-healing-monitor.js:238

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: core/task-scheduler.js:230

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/analyze-and-cleanup.js:162

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/health-check.js:313

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/submit-report.js:164

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/workflow-monitor.js:86

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: core/cache-backend.js:47