T09 · Insecure Skill Coding Practices
Error
- Location
index.en.ts:27- Finding
Approval State Collisions Across Distinct Sessions
- Content
View full analysis
- Remediation
View remediation
Security audit
Ssh Guard
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent SSH-approval purpose, but its approval logic is weak enough that approval can apply to the wrong command or session and sensitive command text can be logged.
Review carefully before installing. This plugin is intended to reduce SSH risk, but it should not be treated as a strong security boundary until approval keys use full session identity, approvals are bound to exact tool calls, command text is safely rendered, and sensitive logging is removed. Avoid session-wide approval and inline SSH credentials if you test it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
index.en.ts:180- Finding
One-Time Approval Is Not Bound to the Reviewed SSH Command
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
index.en.ts:220- Finding
SSH Enforcement Can Be Bypassed Through Alternate Command Representations
- Content
View full analysis
{ if (event.toolName !== "exec" && event.toolName !== "process") { return; } const params = event.params as Record; const command = typeof params.command === "string" ? params.command : ""; const isSshExec = event.toolName === "exec" && command.toLowerCase().includes("ssh"); ``` ```ts if (!isSshExec) { return; } ``` ### Technical Analysis The plugin only blocks an operation when all of the following conditions hold: 1. The tool is named exactly `exec`. 2. `params.command` is a string. 3. The raw string contains the contiguous substring `ssh`, ignoring case. Although the handler accepts the `process` tool at its initial gate, `isSshExec` is always false for `process`. Other execution-capable tools are ignored entirely. Raw substring inspection is not a reliable process-level security boundary. SSH can be invoked through a script, alias, wrapper binary, shell expansion, interpreter, renamed executable, indirect process invocation, or dynamically constructed command name without placing the contiguous `ssh` substring in the inspected command field. ### Attack Path 1. The attacker asks the agent to invoke a wrapper script or interpreter command whose raw tool-call text does not contain the contiguous string `ssh`. 2. The wrapper resolves or constructs the SSH executable at runtime. 3. The `before_tool_call` handler computes `isSshExec` as false. 4. The handler returns without blocking or creating approval state. 5. The child process invokes SSH and accesses the remote host without user approval. An equivalent bypass is possible if the runtime exposes SSH execution through `process` or another execution-capable tool not covered by th ...[truncated 402 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
index.en.ts:19- Finding
Untrusted Command Text Is Injected into Agent-Facing Instructions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
index.en.ts:100- Finding
Approval Messages Are Accepted Without Exact Challenge Matching
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
index.en.ts:270- Finding
SSH Command Contents and Potential Credentials Are Written to Logs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Based solely on the supplied code chunk, the implementation shown is just a module re-export. It does not demonstrate the behavior described in the declaration. While the real functionality may exist in the referenced file, that behavior is not present in the provided code, so the supplied chunk does not accurately represent the declared purpose.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Chinese: `index.zh-CN.ts`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Chinese: `index.zh-CN.ts`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Chinese: `index.zh-CN.ts`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Chinese: `index.zh-CN.ts`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - English: `index.en.ts`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - English: `index.en.ts`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - English: `index.en.ts`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - English: `index.en.ts`
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Preserve existing plugin entries and load paths. - Do not offer `main` as a valid choice for this plugin's DM setup flow. - Present `per-channel-peer` and `per-account-channel-peer` as the recommended DM setup choices for this plugin. - If `session.dmScope` is already `per-channel-peer` or `per-account-channel-peer`, do not ask the user to change it. - Explain that group sessions are unaffected because OpenClaw already routes groups as `agent:<agentId>:<channel>:group:<groupId>`. ## Default Config Shape
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description scopes the skill to intercepting SSH exec calls for approval. However, the handler is registered for both "exec" and "process" tool invocations, meaning the skill observes an additional tool category outside the stated scope even though only exec-based SSH commands are ultimately blocked.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This TypeScript file is a code file, so SQP-3 applies. The skill hard-codes Chinese-only approval text and later requires users to reply with specific Chinese phrases, which imposes a language constraint without opt-in or documented justification.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest describes a narrowly scoped SSH exec approval skill, but the implementation registers a before_tool_call hook for both "exec" and "process", and separately monitors all message_received events to parse user approval phrases. While message handling is an implementation detail of approvals, adding coverage for the generic process tool goes beyond the stated "SSH exec calls" scope because only exec invocations are actually classified as SSH-gated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The blockReason text instructs the agent to tell the user to reply with exactly one of several Chinese words or one exact Chinese sentence. Requiring exact Chinese input without offering alternatives or opt-in violates the language/locale policy for natural-language behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This second blocking prompt repeats the requirement that users respond with exact Chinese approval phrases. That is a user-facing natural-language restriction with no visible language choice or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
该文档写明“如果你想给中文用户使用中文审批提示，可以把插件入口改为
index.zh-CN.ts”，表明语言由部署者预先固定，而不是由最终用户选择。根据规则，强制特定语言且无用户 opt-in 的自然语言策略约束可构成语言/locale 策略问题。- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to default to English when the user does not specify a language. This imposes a language choice without opt-in, which matches the language/locale policy concern unless the skill offers a neutral choice first or clearly justifies the default.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This line directs the agent to choose English by default whenever language preference is unknown and context does not suggest otherwise. That is a natural-language policy issue because it forces a specific language absent explicit user opt-in.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The plugin propagates approval state from a parent session to spawned subagents, including session-wide SSH approval. This broadens the trust boundary beyond what the description discloses, so a subagent may inherit SSH execution capability that the user only intended for the parent agent, increasing the chance of unintended remote command execution.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The plugin logs approval keys, parent/child session linkage, and partial command content. Those logs can expose sensitive operational metadata or secrets embedded in SSH commands, which is unnecessary for the core approval function and increases data leakage risk if logs are accessible.
- Content
Static analysis
No suspicious patterns detected.