ClawHub
Back to skill

Security audit

Group Deduplicate

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Redis-backed group cache, but it has unsafe executable-path handling and does not actually perform the real searches it claims to perform.

Review before installing. Treat this as a prototype or administrative tool, not a reliable real group-search skill. Only run it in a controlled workspace with a trusted memory-cache installation, a known-safe WORKSPACE value, and no sensitive environment variables exposed to child processes. Be aware that cached group names and related history can persist in Redis for up to 30 days and can be listed or modified by the included cache manager.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:54
Finding

Unpinned and Unverified External Dependency Installation

Content
View full analysis
/Users/x/.openclaw/workspace/skills/memory-cache/.env ``` 4. Install dependencies: ```bash pip3 install -r /Users/x/.openclaw/workspace/skills/memory-cache/requirements.txt ``` ``` ### Technical Analysis The documented installation process retrieves the `memory-cache` skill without specifying an immutable version, commit, package digest, signature, or other integrity constraint. It then directs users to install Python dependencies from a requirements file supplied by that separately retrieved component. The audited project does not include the referenced requirements file or a lock file. Consequently, the audit cannot verify the identities, versions, integrity, or installation behavior of those packages. The effective runtime behavior can change if the external skill or any transitive dependency is updated or compromised after this project has been reviewed. Python package installation can execute package build hooks and other installation-time logic. In addition, this project subsequently executes the external cache manager through Python, meaning malicious code in the downloaded component can also run during normal skill operation. ### Attack Path 1. An att ...[truncated 1739 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/search_groups.py:29
Finding

Environment-Controlled Execution of an External Python Script

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (27)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

  1. Configure Redis connection:

    bash
    echo "REDIS_URL=redis://localhost:6379/0" > /Users/x/.openclaw/workspace/skills/memory-cache/.env

  2. Install dependencies:

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/cache_manager.py (reported line 39)May include surrounding context.

python
'get', 
            cache_key
        ], capture_output=True, text=True, shell=False, 
        env={**os.environ, 'WORKSPACE': workspace})
        
        return result.returncode == 0 and result.stdout.strip() != ''
    except Exception:

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/cache_manager.py (reported line 63)May include surrounding context.

python
'get', 
            cache_key
        ], capture_output=True, text=True, shell=False, 
        env={**os.environ, 'WORKSPACE': workspace})
        
        return result.returncode == 0 and result.stdout.strip() != ''
    except Exception:

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/cache_manager.py (reported line 78)May include surrounding context.

python
'get', 
            cache_key
        ], capture_output=True, text=True, shell=False, 
        env={**os.environ, 'WORKSPACE': workspace})
        
        return result.returncode == 0 and result.stdout.strip() != ''
    except Exception:

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/cache_manager.py (reported line 93)May include surrounding context.

python
'get', 
            cache_key
        ], capture_output=True, text=True, shell=False, 
        env={**os.environ, 'WORKSPACE': workspace})
        
        return result.returncode == 0 and result.stdout.strip() != ''
    except Exception:

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/search_groups.py (reported line 38)May include surrounding context.

python
'get', 
            cache_key
        ], capture_output=True, text=True, shell=False, 
        env={**os.environ, 'WORKSPACE': workspace})
        
        return result.returncode == 0 and result.stdout.strip() != ''
    except Exception:

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/search_groups.py (reported line 65)May include surrounding context.

python
'get', 
            cache_key
        ], capture_output=True, text=True, shell=False, 
        env={**os.environ, 'WORKSPACE': workspace})
        
        return result.returncode == 0 and result.stdout.strip() != ''
    except Exception:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises and invokes shell commands, network searching, and use of an environment-backed Redis connection, but it does not declare any explicit tool scope or permissions boundary. In agent environments, missing scope declarations increase the chance that the skill runs with broader-than-expected capabilities, making unintended network access, shell execution, or environment exposure harder to govern and review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill stores discovered group identifiers and links in a Redis-backed cache for 30 days and notes that the cache survives restarts, but the description does not clearly warn users up front that their search results may persist beyond the current session. This creates a privacy and data-retention risk, especially because group names/links may reveal sensitive interests, communities, or contact surfaces tied to searches across WeChat, QQ, and industry groups.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/cache_manager.py (reported line 33)May include surrounding context.

python
"""Get value from memory-cache."""
    try:
        workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
        result = subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'get',

Tainted flow: 'workspace' from os.getenv (line 32, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
91% confidence
Finding

The path to the executed helper script is built from the WORKSPACE environment variable, which is attacker-controllable in many agent/runtime setups. An attacker who can influence WORKSPACE can redirect execution to a malicious cache_manager.py and gain arbitrary code execution in the skill's context.

Content

Scanner excerpt · scripts/cache_manager.py (reported line 33)May include surrounding context.

python
"""Get value from memory-cache."""
    try:
        workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
        result = subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'get',

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/cache_manager.py (reported line 62)May include surrounding context.

python
cmd.extend(['--ttl', str(ttl_seconds)])
    
    try:
        subprocess.run(cmd, check=True, shell=False,
        env={**os.environ, 'WORKSPACE': workspace})
        return True
    except Exception:

Tainted flow: 'cmd' from os.getenv (line 50, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
91% confidence
Finding

The set command executes a script whose path is constructed from WORKSPACE, creating the same arbitrary code execution risk. Because this function is reachable from CLI actions and normal cache writes, a poisoned environment can reliably trigger execution of attacker-supplied code.

Content

Scanner excerpt · scripts/cache_manager.py (reported line 62)May include surrounding context.

python
cmd.extend(['--ttl', str(ttl_seconds)])
    
    try:
        subprocess.run(cmd, check=True, shell=False,
        env={**os.environ, 'WORKSPACE': workspace})
        return True
    except Exception:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/cache_manager.py (reported line 72)May include surrounding context.

python
"""Delete key from memory-cache."""
    workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
    try:
        subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'delete',

Tainted flow: 'workspace' from os.getenv (line 32, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
91% confidence
Finding

This delete path repeats the same trust violation by executing a Python script from an environment-derived workspace path. If an adversary can set WORKSPACE, they can substitute a malicious helper and execute arbitrary code while appearing to perform cache deletion.

Content

Scanner excerpt · scripts/cache_manager.py (reported line 72)May include surrounding context.

python
"""Delete key from memory-cache."""
    workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
    try:
        subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'delete',

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/cache_manager.py (reported line 87)May include surrounding context.

python
"""Scan for keys matching pattern in memory-cache."""
    workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
    try:
        result = subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'scan',

Tainted flow: 'workspace' from os.getenv (line 32, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
91% confidence
Finding

The scan operation also invokes a helper script from a path controlled by WORKSPACE, so it exposes the same code execution primitive. The ability to trigger this through routine listing/statistics flows makes exploitation easier in a compromised runtime.

Content

Scanner excerpt · scripts/cache_manager.py (reported line 87)May include surrounding context.

python
"""Scan for keys matching pattern in memory-cache."""
    workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
    try:
        result = subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'scan',

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill manifest describes automatic deduplication, but this file exposes a broad administrative interface for listing, checking, inserting, deleting, cleaning, and inspecting cache contents. That expands capability beyond stated purpose and increases the risk of unauthorized data manipulation or operational misuse if the skill is invoked in broader contexts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The code can enumerate all cached group records and print names, normalized values, timestamps, and cache keys, which exceeds the minimal need to test whether a single group is a duplicate. In a multi-tenant or privacy-sensitive environment, this enables bulk disclosure of cached discovery history.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Manual insertion and deletion of cache entries lets callers alter deduplication state arbitrarily, allowing suppression of future discoveries or forced reprocessing of known groups. This is inconsistent with the stated automatic-only behavior and could be abused to manipulate workflow results.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
92% confidence
Finding

The script builds the path to an executable Python file from the untrusted WORKSPACE environment variable and then invokes it with subprocess.run. Even with shell=False, an attacker who can influence WORKSPACE can redirect execution to a malicious cache_manager.py, resulting in arbitrary code execution in the agent context.

Content

Scanner excerpt · scripts/search_groups.py (reported line 32)May include surrounding context.

python
try:
        workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
        result = subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'get',

Tainted flow: 'workspace' from os.getenv (line 52, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
97% confidence
Finding

The tainted flow is real: data from os.getenv('WORKSPACE') is used to construct the program path passed to subprocess.run. This is a code-execution primitive, not just data usage, so environment manipulation can cause execution of attacker-supplied code.

Content

Scanner excerpt · scripts/search_groups.py (reported line 32)May include surrounding context.

python
try:
        workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
        result = subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'get',

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
92% confidence
Finding

This subprocess invocation has the same issue: it executes a Python script whose path is constructed from the WORKSPACE environment variable. If WORKSPACE points to attacker-controlled content, the agent will run arbitrary Python code while attempting to cache results.

Content

Scanner excerpt · scripts/search_groups.py (reported line 53)May include surrounding context.

python
try:
        workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
        subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'set',

Tainted flow: 'workspace' from os.getenv (line 52, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
97% confidence
Finding

This is the same tainted path-to-execution issue in the cache set operation. The environment-derived workspace value directly controls which Python file gets executed, enabling arbitrary code execution if the environment is attacker-influenced.

Content

Scanner excerpt · scripts/search_groups.py (reported line 53)May include surrounding context.

python
try:
        workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
        subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'set',

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The function docstring says it will "Search groups using multi-search-engine skill," and the module/manifest describe discovering groups, but the implementation fabricates results from a query hash instead of invoking any search capability. This is an active contradiction between the code documentation/claimed behavior and what the function actually does.

Content

No source excerpt is available for this finding.