ClawHub
Back to skill

Security audit

OS Activity

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly aligned with OS-activity personalization, but it exposes detailed local activity and process data without enough privacy controls or scoping.

Install only if you are comfortable letting the skill inspect and show local activity metadata, including file paths, directory history, installed applications, and full running-process command lines. Avoid using it on machines where command-line arguments, paths, or recent-file history may reveal credentials, customer data, private projects, or regulated information unless the skill is updated to add consent, scoping, and redaction.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/processes.py:25
Finding

Unredacted Process Command Lines May Disclose Secrets

Content
View full analysis

Vulnerability Details

File Location: scripts/processes.py, lines 25-77
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: Medium

Technical Analysis

The process query collects complete command-line arguments, executable paths, and current working directories for every process visible to osquery. These values are then written directly to standard output without filtering or redaction.

python
def processes():
    query = "SELECT pid, name, parent, path, start_time, cmdline, cwd, user_time, system_time, percent_processor_time FROM processes ORDER BY pid;"
python
cmdline = process.get("cmdline", "")
python
print(f"{pid}|{name}|{parent}|{path}|{start_time}|{cmdline}|{cwd}|{user_time}|{system_time}|{percent_processor_time}")

Command-line arguments commonly contain sensitive values, including API tokens, database connection strings, passwords, private repository URLs, session identifiers, and temporary credentials. Current working directories and executable paths can additionally reveal usernames, project names, customer names, and internal filesystem structure.

Although process inspection is related to the skill's declared activity-reporting functionality, collecting and returning complete command lines exceeds the minimum information required to identify running programs. There is no allowlist, explicit opt-in for sensitive fields, output sanitization, or warning before the data is exposed to the calling agent and any associated logs.

Attack Path

  1. A user or another agent starts a process with a secret in its arguments, such as --token, --password, or a credential-bearing URL.
  2. The skill invokes scripts/processes.py.
  3. The script runs the bundled osqueryi binary and requests the process's complete cmdline and cwd.
  4. The returned values are printed without redaction.
  5. The calling agent, conversation transcript, telemetry system, or ot ...[truncated 651 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove cmdline and cwd from the default query and output. Return only minimally necessary fields such as PID and process name.
  • Require an explicit command-line option or separate user confirmation before collecting detailed process metadata.
  • If command lines must be supported, redact values associated with sensitive argument names such as password, passwd, token, secret, api-key, authorization, and credential.
  • Redact credentials embedded in URLs and connection strings, including user-information components and sensitive query parameters.
  • Consider returning an argument count or executable name instead of raw arguments.
  • Display a clear warning that detailed process information may contain credentials and should not be persisted in conversation history or logs.
  • Apply data-retention controls to downstream agent output and telemetry.
  • Add tests covering common secret formats to ensure they never appear in default output.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/recent_files.py:25
Finding

Broad File and Directory Activity Is Exposed Without Privacy Filtering

Content
View full analysis

Vulnerability Details

File Location: scripts/recent_files.py, lines 25-70; scripts/recent_dirs.py, lines 31-75
Vulnerability Type: Excessive collection and plaintext disclosure of personal activity metadata
Risk Level: Medium

Technical Analysis

The recent-file script requests up to 100 file records and emits filenames and full paths directly:

python
def recent_files():
    query = "SELECT filename, path, type, mtime FROM recent_files ORDER BY mtime DESC LIMIT 100;"
python
print("Filename|Path|Type|Last Edited Time")
python
print(f"{filename}|{path}|{file_type}|{mtime_str}")

The directory script performs an even broader query against Windows shellbag history, retrieving up to 1,000 historical directory-access records:

python
def recent_dirs():
    query = "SELECT source, path, accessed_time, created_time, modified_time FROM shellbags ORDER BY accessed_time DESC LIMIT 1000;"
python
print("Path|Source|Last Accessed Time|Last Modified Time|Created Time")
python
print(f"{source}|{path}|{accessed_time}|{modified_time}|{created_time}")

Full paths can reveal usernames, confidential project names, customer identities, medical or financial document names, mounted shares, internal infrastructure names, and private directory organization. Shellbag records can also disclose directories that no longer exist and therefore represent historical activity beyond the immediate task.

The scripts do not constrain collection to a user-selected directory, exclude sensitive locations, redact identifying path components, or request confirmation before returning the records to the agent. The output is plaintext and may consequently be stored in conversation history, logs, or telemetry.

Attack Path

  1. The user has recently accessed files or directories whose names or paths contain private information.
  2. The skill runs recent_files.py or, on Wind ...[truncated 888 chars]
Remediation
View remediation

Remediation Suggestions

  • Require explicit user confirmation before collecting file or directory activity.
  • Default to a small result set and allow the user to select the relevant time range and root directory.
  • Exclude sensitive locations by default, including credential stores, SSH directories, browser profiles, keychains, password-manager data, and application-secret directories.
  • Redact the home-directory prefix, usernames, network-share names, and other identifying path components before returning results.
  • Return generalized categories or basenames rather than complete paths unless full paths are explicitly requested.
  • Treat historical shellbag collection as a separate high-sensitivity operation and clearly explain that it may reveal directories that have been deleted.
  • Avoid writing results to persistent logs or telemetry, and document appropriate retention controls for agent transcripts.
  • Add configurable allowlists and denylists so users can control which directories may be inspected.
  • Escape or serialize output safely rather than using an unescaped delimiter format, since filenames can contain delimiter characters or control sequences.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description says it learns OS activity, but the documented commands also enumerate installed programs and software inventory, which is broader and more privacy-sensitive than ordinary activity observation. This is dangerous because software inventories and install paths can reveal sensitive information about the user, environment, employer tooling, or security products, while the skill does not transparently declare this expanded data access or corresponding permissions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill description says it learns OS activity, but the documented commands also enumerate installed programs and software inventory, which is broader and more privacy-sensitive than ordinary activity observation. This is dangerous because software inventories and install paths can reveal sensitive information about the user, environment, employer tooling, or security products, while the skill does not transparently declare this expanded data access or corresponding permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly states that the skill reads and learns from a user's operating system activity to personalize answers, but it does not disclose privacy risks, data scope, retention, consent requirements, or safeguards. For a skill centered on collecting OS activity, omission of user-facing privacy warnings materially increases the chance of uninformed collection of sensitive behavioral data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares no explicit tool scope or permissions even though its documented behavior includes executing Python scripts, inspecting the filesystem, and installing osquery, which implies shell, file, and likely network access. This is dangerous because users and policy systems cannot accurately understand or constrain what the skill is allowed to do, increasing the chance of overbroad execution and silent collection of local system data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly advertises collecting recent edited files and running programs but does not warn that these outputs may contain sensitive local information such as filenames, directory names, project names, or application usage patterns. In this context, the omission increases privacy risk because the skill is specifically built to inspect user activity, so informed consent and data-minimization expectations are especially important.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The installation and usage instructions tell users to run scripts that install osquery and enumerate files, directories, installed programs, and processes, but they provide no warning that these actions may expose sensitive local data or alter the system. This is dangerous because users are encouraged to execute broad system-inspection and installation commands without understanding the privacy implications or the operational risks of adding third-party software.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest describes a personalization skill that learns from operating system activity, which implies observing or analyzing local activity data. This file instead performs installer behavior: fetching archives from GitHub, extracting them, and placing executables under the user's .openclaw tools directory. Installing a monitoring binary may support the skill, but the actual behavior is materially broader than the description claims.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code makes outbound network requests to GitHub releases and writes extracted binaries into a tools directory, which is a software installation capability. A manifest that only says the skill learns OS activity does not, by itself, justify package downloading and installer-like filesystem modification as part of the skill's scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The Windows installer unconditionally deletes the existing target directory with shutil.rmtree before copying the new files. If the directory contains user modifications, prior binaries, or symlink-manipulated content, this can lead to data loss or unintended deletion without warning, which is especially risky in an installer that manages local executables.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

On Linux and macOS, the installer searches for the osqueryd daemon binary, copies it into the target directory, and renames it to osqueryi. This can misrepresent the installed executable's behavior and trust assumptions, causing downstream code or users to invoke a daemon-capable binary as though it were the interactive client, which may expand collection or execution capabilities unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script enumerates all running processes and prints full command lines and current working directories, which can expose sensitive information such as credentials passed via CLI arguments, internal file paths, project names, usernames, or access tokens. In the context of a personalization skill that learns OS activity, this broad collection and disclosure is more dangerous because it appears designed to gather behavioral/system telemetry from the user's machine.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest describes personalizing based on operating system activity, which implies observing or analyzing user/system activity over time. This code performs a one-time inventory query of installed programs via osquery and outputs software metadata, which is a different capability from learning activity.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/processes.py (reported line 28)May include surrounding context.

python
def programs():
    query = "SELECT name, version, install_location, publisher FROM programs ORDER BY name;"
    try:
        result = subprocess.run(
            [str(OSQUERY), "--json", query],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/programs.py (reported line 27)May include surrounding context.

python
def programs():
    query = "SELECT name, version, install_location, publisher FROM programs ORDER BY name;"
    try:
        result = subprocess.run(
            [str(OSQUERY), "--json", query],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/recent_dirs.py (reported line 34)May include surrounding context.

python
def programs():
    query = "SELECT name, version, install_location, publisher FROM programs ORDER BY name;"
    try:
        result = subprocess.run(
            [str(OSQUERY), "--json", query],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/recent_files.py (reported line 28)May include surrounding context.

python
def programs():
    query = "SELECT name, version, install_location, publisher FROM programs ORDER BY name;"
    try:
        result = subprocess.run(
            [str(OSQUERY), "--json", query],
            capture_output=True,
            text=True,

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
69% confidence
Finding

The documentation says 'Find what programs have installed on the operating system,' which describes installation events/history rather than present state. The code queries the osquery 'programs' table for current installed software metadata, not what programs performed installations or when installation activity occurred.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.