ClawHub
Back to skill

Security audit

easy-code-review

Security checks for vulnerabilities and agentic risk

Overview

This code-review skill is mostly coherent, but its documentation and permissions create review-worthy risk around unverified CI installation and unnecessary write/process authority.

Install only if you are comfortable granting repository read and git inspection access, and avoid copying the CI curl-to-shell or unpinned global npm examples without pinning and verifying the installer. Treat file.write as overbroad for the current implementation and prefer a version that removes it or clearly scopes report-writing behavior.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:240
Finding

Unverified Remote Script Is Executed Directly in CI

Content
View full analysis

Vulnerability Details

File Location: README.md:240-243
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

yaml
- name: Setup OpenClaw
  run: |
    # Install OpenClaw
    curl -fsSL https://get.openclaw.ai | sh

Technical Analysis

The documented CI workflow downloads a mutable script from https://get.openclaw.ai and passes the response directly to a shell. It does not pin a release, store the script for inspection, verify a cryptographic digest or publisher signature, or otherwise authenticate the exact payload that will execute.

HTTPS protects the connection in transit but does not protect against compromise of the remote server, domain, DNS infrastructure, publishing account, or build pipeline. Because the executable content can change after the Skill has been reviewed, the command creates a remote code-execution channel controlled by the external endpoint.

This behavior is not necessary for the Skill's core Git-change analysis. A versioned and cryptographically verified installation mechanism can provide the required tool without executing mutable network content blindly.

Attack Path

  1. An attacker compromises the get.openclaw.ai server, its deployment pipeline, DNS configuration, or another component capable of changing the response.
  2. The attacker replaces the legitimate installer with a malicious shell payload.
  3. A user copies the documented workflow, or an existing CI job runs it.
  4. curl retrieves the attacker-controlled response.
  5. The pipe sends the response directly to sh without inspection or integrity verification.
  6. The payload executes with the CI runner's privileges and can access resources made available to that job.

Impact Assessment

Successful exploitation provides arbitrary command execution in the CI runner. Depending on workflow configuration, the payload could read or modify checked-out source code, alter build outputs, tamper with gen ...[truncated 360 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | sh pipeline from the documented workflow.
  2. Install an exact, reviewed OpenClaw release from an authenticated official source.
  3. Download the artifact separately and verify a pinned SHA-256 digest or trusted publisher signature before execution.
  4. Fail the workflow immediately if verification does not succeed.
  5. Pin CI actions and installation artifacts to immutable versions or commit digests.
  6. Apply explicit minimum workflow-token permissions and avoid exposing secrets to jobs triggered by untrusted pull requests.
  7. Prefer ephemeral, isolated runners; do not run unverified installation logic on persistent or privileged self-hosted runners.

T08 · Insecure Dependencies

Warning
Location
README.md:150
Finding

Unpinned npm CLI Is Installed Globally

Content
View full analysis

Vulnerability Details

File Location: README.md:150-152
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
# Install ClawHub CLI
npm install -g clawhub-cli

Technical Analysis

The installation command resolves the current package version from the npm registry rather than selecting an exact, reviewed release. It also installs the package globally. npm packages may execute lifecycle scripts during installation, so a compromised future release or compromised publisher account could execute code immediately.

No version pin, lockfile, integrity value, provenance check, or publisher-verification procedure is provided. Consequently, users following the same documentation at different times may execute materially different package contents.

Attack Path

  1. An attacker compromises the package publisher, registry account, or package distribution process.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user follows the installation instructions without specifying a version.
  4. npm resolves and downloads the attacker-controlled latest release.
  5. Malicious lifecycle code executes during installation, or malicious CLI behavior executes when the installed command is used.
  6. Global installation makes the compromised executable available system-wide within the user's command environment.

Impact Assessment

Installation-time code can execute with the privileges of the user running npm. It may read files accessible to that account, access environment variables and developer credentials, modify user-level configuration, or install altered tooling.

If the command is run with elevated privileges, the impact may become system-wide. A global package can also affect unrelated projects that subsequently invoke the same CLI.

Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to an exact, audited version rather than installing the latest release.
  2. Document the authoritative package repository and verified publisher identity.
  3. Validate npm provenance and package integrity before installation.
  4. Prefer a project-local, lockfile-controlled dependency or a signed, versioned official binary over a global installation.
  5. Review package lifecycle scripts and use --ignore-scripts where installation scripts are unnecessary.
  6. Avoid elevated installation privileges and execute the tool in a restricted development or CI environment.

T05 · Unauthorized Access and Privilege Escalation

Note
Location
SKILL.md:5
Finding

Skill Declares Unnecessary File-Write Permission

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:5-9
Additional Location: skill.json:23-28
Vulnerability Type: Excessive permission declaration
Risk Level: Low

Vulnerable Code

yaml
permissions:
  - file.read
  - file.write
  - git.read

The same capability is declared in skill.json:

json
"permissions": [
  "file.read",
  "file.write",
  "git.read"
]

Technical Analysis

The packaged analyzer reads Git change metadata by invoking fixed git show and git diff commands and writes its report to standard output. The audited Python implementation contains no project-file write operation. Therefore, file.write exceeds the minimum privileges required by the implemented review functionality.

An excessive permission is not itself evidence that the Skill currently modifies files. It nevertheless expands the impact of any future instruction compromise, dependency compromise, or malicious update by making repository modification available to Skill behavior that only needs read access.

Attack Path

  1. A user installs or activates the Skill with its declared permissions.
  2. The platform grants file.write even though the current analyzer does not require it.
  3. The Skill's instructions, implementation, or a future dependency is subsequently compromised.
  4. Attacker-controlled behavior uses the already granted write capability.
  5. Accessible source files, configuration, or generated artifacts are modified under the user's authorization context.

Impact Assessment

The unnecessary capability could permit modification or deletion of files within the platform-defined writable scope. Potential effects include source-code tampering, configuration alteration, review-result manipulation, or corruption of repository contents.

The practical scope depends on how OpenClaw maps file.write to filesystem paths. The existing analyzer itself was not found to exercise this permission.

Remediation
View remediation

Remediation Suggestions

  1. Remove file.write from both SKILL.md and skill.json.
  2. Retain only the read and Git capabilities required to inspect changes.
  3. If report persistence is introduced later, request explicit user approval and narrowly scope write access to a designated report path.
  4. Keep permission declarations synchronized across all manifests and add a release check that rejects unnecessary capability expansion.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The CI example downloads and executes a remote script via curl piped directly to sh, which prevents inspection and trusts the remote endpoint completely at execution time. If the server, DNS, TLS chain, or distribution path is compromised, arbitrary code will run in the CI environment with repository and secret access.

Content

Scanner excerpt · README.md (reported line 243)May include surrounding context.

md
- name: Setup OpenClaw
        run: |
          # 安装OpenClaw
          curl -fsSL https://get.openclaw.ai | sh
      
      - name: Run Code Review
        run: |

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The shell pipe creates an unsafe command chain where untrusted network content flows directly into command execution. In CI/CD context this is especially dangerous because it can convert a documentation example into a supply-chain compromise path affecting builds, artifacts, and potentially deployment credentials.

Content

Scanner excerpt · README.md (reported line 243)May include surrounding context.

md
- name: Setup OpenClaw
        run: |
          # 安装OpenClaw
          curl -fsSL https://get.openclaw.ai | sh
      
      - name: Run Code Review
        run: |

Lp1

High
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares only file.read, file.write, and git.read, but the implementation directly invokes an external executable via subprocess, which is an undeclared shell/process-execution capability. In agent environments, permission mismatches are dangerous because they bypass operator expectations and may permit broader command execution than the manifest advertises.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/analyze_changes.py (reported line 63)May include surrounding context.

python
'tsconfig.json', 'tsconfig.*.json',
        '.eslintrc', '.eslintrc.*', '.prettierrc', '.prettierrc.*',
        'webpack.config.js', 'webpack.*.js', 'vite.config.*',
        '.env', '.env.*', 'config.*',
        'Dockerfile', 'docker-compose.*',
        '.gitignore', '.dockerignore'
    }

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

README 的使用示例使用了“帮我review一下最近的git commit”“审核这段代码修改”等自然语言表述，但没有给出明确的触发边界、限定上下文或排除示例。这类短语在日常协助场景中也很常见，容易让技能被过宽匹配触发。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README declares file.write permission but does not clearly explain to users that the skill may modify local files or under what circumstances writes occur. In a code-review skill, write access is broader than expected for read-only analysis, so users may install it without understanding the modification risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases are broad enough that ordinary discussion about reviewing code could activate the skill unintentionally. In combination with elevated permissions like file.read, file.write, and git.read, accidental activation can expose repository contents, initiate scans the user did not intend, or perform writes if later behavior uses that permission.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation states the skill depends on command execution even though the manifest does not declare such permission. This creates an unsafe trust boundary: operators may assume the skill only reads files and git state, while its instructions encourage a more powerful execution model that could later be wired in or socially induced by the host agent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file title and content are entirely in Chinese and present the review guidance as the default operating mode for the AI code review assistant, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This Python file contains natural-language descriptions and CLI output entirely in Chinese, including the module docstring and later argument/help text and report labels. Because the skill does not offer any user opt-in or alternative locale, it imposes a specific language on users, which matches the policy violation criteria for language or locale constraints.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_changes.py (reported line 98)May include surrounding context.

python
# 获取工作区变更
                cmd = ['git', 'diff', '--numstat']
            
            result = subprocess.run(
                cmd,
                cwd=self.repo_path,
                capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_changes.py (reported line 114)May include surrounding context.

python
# 获取工作区变更
                cmd = ['git', 'diff', '--numstat']
            
            result = subprocess.run(
                cmd,
                cwd=self.repo_path,
                capture_output=True,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The argparse description/help strings and all printed analysis-report labels are hard-coded in Chinese. This creates a mandatory locale for interaction and output without giving the user a choice, which is a natural-language policy violation under the stated rules.

Content

No source excerpt is available for this finding.

Lp4

Low
Category
MCP Least Privilege
Confidence
65% confidence
Finding

Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.

Content

No source excerpt is available for this finding.

Lp4

Low
Category
MCP Least Privilege
Confidence
65% confidence
Finding

Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.

Content

No source excerpt is available for this finding.

Lp4

Low
Category
MCP Least Privilege
Confidence
65% confidence
Finding

Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

For a code review assistant, file.write exceeds the stated need of reading changes and producing a report in chat or structured output. Unnecessary write access increases the blast radius if the skill is misused, compromised, or triggered unexpectedly, allowing repository files or review artifacts to be altered instead of merely inspected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description at L04 is written only in Chinese, which indicates a language-specific presentation without any visible opt-in or explanation that the skill is intended only for Chinese-speaking users. Under the policy rule, forcing a specific language without user choice or justification is a natural-language locale concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.