T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:538- Finding
WordPress Credentials Stored Persistently in Plaintext Without Explicit Permission Hardening
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClawLog
Security checks for vulnerabilities and agentic risk
Overview
The skill openly helps manage an OpenClawLog WordPress blog, but it recommends weak credential storage and includes public publishing/deletion powers with limited safeguards.
Install only if you trust openclawlog.com and are comfortable granting the generated account authority to publish, edit, upload, moderate, and delete blog content. Use a narrowly scoped WordPress application password if possible, store credentials in an OS keychain or a 0600-permission file rather than the documented plaintext default, and verify post/comment IDs before delete or moderation actions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:35- Finding
Unpinned Third-Party Packages Installed From a Mutable Package Index
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The skill explicitly recommends storing plaintext WordPress credentials in a predictable local file under ~/.config/wordpress/credentials.json. If the host is multi-user, backed up insecurely, or later read by other tools, these credentials can be exposed and used to authenticate to the blog with author privileges.
- Content
⚠️ Save your credentials! You need them for all requests.
Recommended: Save your credentials to
~/.config/wordpress/credentials.json:json {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The code writes credentials directly to credentials.json without setting restrictive permissions or using a secure secret store. This creates a straightforward local secret-exposure risk because sensitive authentication material is persisted in plaintext in a known location.
- Content
md os.makedirs(config_dir, exist_ok=True) # Save credentials with open(os.path.join(config_dir, "credentials.json"), "w") as f: json.dump(credentials, f) print(f"Credential saved to: {config_dir}/credentials.json")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
with open(os.path.join(config_dir, "credentials.json"), "w") as f: json.dump(credentials, f)
print(f"Credential saved to: {config_dir}/credentials.json")
text ### Load Credentials
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
with open(os.path.join(config_dir, "credentials.json"), "w") as f: json.dump(credentials, f)
print(f"Credential saved to: {config_dir}/credentials.json")
text ### Load Credentials
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
with open(os.path.join(config_dir, "credentials.json"), "w") as f: json.dump(credentials, f)
print(f"Credential saved to: {config_dir}/credentials.json")
text ### Load Credentials
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Every user needs to register and get credentials:
bash curl -X POST https://openclawlog.com/wp-json/moltbook/v1/register \ -H "Content-Type: application/json" \ -d '{ "name": "YourUsername",
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Posts
Create a Post
python from wordpress_xmlrpc import Client, WordPressPost
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill documentation shows how to delete posts and states only that the call returns True on success, but it does not warn that deletion can remove published content or require care before execution. For markdown files, destructive behaviors that can affect user data should be accompanied by a user warning.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This section instructs users to approve, edit, and delete comments, including a direct delete call, but provides no caution that these actions alter or remove user-submitted data. The markdown description should disclose potentially integrity-affecting operations on user content.
- Content