ClawHub
Back to skill

Security audit

Group Deduplicate

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malware, but it claims to search real groups while the included search code returns fabricated deterministic results, so users should review it before trusting outputs.

Install only if you understand this appears to be a prototype or demo: it caches data as documented, but it does not perform real group search. Do not rely on its returned groups as real discoveries unless the publisher replaces the mock search implementation and pins or validates the memory-cache helper path.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"""Get value from memory-cache."""
    try:
        workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
        result = subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'get',
Confidence
93% confidence
Finding
This subprocess call executes a Python script located via the WORKSPACE environment variable, so an attacker who can influence WORKSPACE or the filesystem under that path can redirect execution to arbitrary code. Although shell=False prevents shell injection, it does not prevent unsafe execution of attacker-chosen local scripts.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
cmd.extend(['--ttl', str(ttl_seconds)])
    
    try:
        subprocess.run(cmd, check=True, shell=False,
        env={**os.environ, 'WORKSPACE': workspace})
        return True
    except Exception:
Confidence
92% confidence
Finding
This command launches another Python script using a path built from WORKSPACE, creating a code-execution primitive if that environment variable or referenced directory is attacker-controlled. The use of json.dumps on value is not the issue; the dangerous part is trusting an external path for executable code.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"""Delete key from memory-cache."""
    workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
    try:
        subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'delete',
Confidence
92% confidence
Finding
This delete operation also executes a script whose path is controlled by WORKSPACE, so the cache-delete feature can be abused to run arbitrary local code rather than just delete cache keys. The pattern repeats across multiple functions, increasing the attack surface.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"""Scan for keys matching pattern in memory-cache."""
    workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
    try:
        result = subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'scan',
Confidence
93% confidence
Finding
This scan operation invokes a local Python script using a path derived from WORKSPACE, enabling arbitrary code execution if the environment or workspace contents are manipulated. Because scan may be called during listing and cleanup workflows, a malicious path could be triggered through routine operations.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
try:
        workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
        result = subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'get',
Confidence
91% confidence
Finding
This subprocess invocation executes a Python script from a path derived from the WORKSPACE environment variable. Although shell=False prevents shell metacharacter injection, an attacker who can control WORKSPACE can redirect execution to an attacker-controlled cache_manager.py, resulting in arbitrary code execution in the agent context.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
try:
        workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
        subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'set',
Confidence
92% confidence
Finding
This subprocess call has the same trust-boundary issue: it runs a Python file whose location is controlled by WORKSPACE. If that environment variable is poisoned, the script will execute arbitrary attacker-supplied code while attempting to write cache entries, which is especially risky because this path is reached on normal successful operation.

Tainted flow: 'workspace' from os.getenv (line 32, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
"""Get value from memory-cache."""
    try:
        workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
        result = subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'get',
Confidence
96% confidence
Finding
The finding correctly identifies a tainted flow from os.getenv('WORKSPACE') into subprocess.run, which can lead to arbitrary code execution by selecting a different script path. This is especially risky because the variable is inherited from the process environment without validation.

Tainted flow: 'cmd' from os.getenv (line 50, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
cmd.extend(['--ttl', str(ttl_seconds)])
    
    try:
        subprocess.run(cmd, check=True, shell=False,
        env={**os.environ, 'WORKSPACE': workspace})
        return True
    except Exception:
Confidence
95% confidence
Finding
The command array passed to subprocess.run contains a script path derived from WORKSPACE, so the tainted environment value reaches code execution. This is a real vulnerability even with shell=False because the interpreter still executes whichever script path is supplied.

Tainted flow: 'workspace' from os.getenv (line 32, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
"""Delete key from memory-cache."""
    workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
    try:
        subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'delete',
Confidence
95% confidence
Finding
This is another true tainted-data-to-execution path: WORKSPACE influences the script path provided to python3 for execution. An attacker able to modify the environment or place files in a chosen workspace could hijack deletion requests into arbitrary script execution.

Tainted flow: 'workspace' from os.getenv (line 32, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
"""Scan for keys matching pattern in memory-cache."""
    workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
    try:
        result = subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'scan',
Confidence
96% confidence
Finding
The scan helper again trusts WORKSPACE when selecting a Python script to run, creating a direct tainted flow to code execution. In an agent/skill environment, inherited environment state may be easier to influence, making this more dangerous than a purely local utility would be.

Tainted flow: 'workspace' from os.getenv (line 52, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
try:
        workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
        result = subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'get',
Confidence
96% confidence
Finding
The tainted flow is real: WORKSPACE comes from os.getenv and is interpolated into the path of a program that is then executed. This is a classic untrusted-input-to-code-execution boundary; control of the environment allows substitution of the executed script and therefore arbitrary code execution.

Tainted flow: 'workspace' from os.getenv (line 52, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
try:
        workspace = os.getenv('WORKSPACE', '/Users/x/.openclaw/workspace')
        subprocess.run([
            'python3', 
            f'{workspace}/skills/memory-cache/scripts/cache_manager.py', 
            'set',
Confidence
96% confidence
Finding
This is the same tainted execution path in the cache write operation. Because cache writes occur for every newly found group, a poisoned WORKSPACE can reliably trigger execution of malicious code during ordinary use of the skill.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill documentation exposes operational capabilities requiring environment access, network access, and shell execution, but it does not declare corresponding permissions. This creates a transparency and governance gap: users or orchestrators may invoke a skill with broader capabilities than expected, increasing the risk of unintended command execution, outbound requests, or secret exposure via environment variables.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose is narrowly framed as external group search with deduplication, but the described behavior includes broader cache administration functions and, per the finding, the search behavior may be mock/deterministic rather than real. This mismatch is dangerous because operators may trust the skill to perform one bounded task while it can inspect, modify, or delete cached data and misrepresent the provenance or reality of returned results.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill executes another local Python script through subprocess using a path influenced by WORKSPACE, which is not clearly necessary for simple deduplication and materially expands capability into arbitrary local code loading. In this skill context, hidden execution of external scripts is more dangerous because users expect cache bookkeeping, not delegated code execution based on environment state.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill automatically persists discovered group identifiers and links in Redis for 30 days, but the description does not prominently warn users about this retention behavior. This can lead to unintentional storage of potentially sensitive community metadata, creating privacy, compliance, and data-governance risks if users assume searches are ephemeral.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill description does not clearly warn that searches may trigger outbound requests to third-party search engines and temporary use of session cookies. This is risky because users may unknowingly transmit queries, metadata, or authenticated browsing context to external services, which can expose internal research activity or user-associated session state.

Static analysis

No suspicious patterns detected.