Security audit

full scale openclaw skill auditor

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent audit workflow, but it needs Review because it automatically creates branded social posts and runs an unverified sibling script outside the skill package.

Review before installing. This skill is suitable only if you want an audit tool that clones public GitHub repositories and writes local audit artifacts. Treat the automatic social-post feature and hard-coded Fenz.AI mention as opt-in editorial content, and do not run it unless the external ../post-generator dependency is present from a trusted source and verified. Avoid auditing untrusted repositories with symlinks until file containment and size limits are fixed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:128
Finding: Mandatory Promotional Content Injection into Audit Output
Content: View full analysis
/audit-report.md` 2. Read `../post-generator/references/writing-guide-en.md` and `../post-generator/assets/post-template-twitter-en.md` 3. Generate 2-3 English post variations following the guide 4. Read `../post-generator/references/writing-guide-zh.md` and `../post-generator/assets/post-template-twitter-zh.md` 5. Generate 2-3 Chinese post variations (NOT translations — independently crafted) 6. Save `posts-en.md` and `posts-zh.md` in the audit output directory 7. Log post generation step to `process-log.md` Quality rules: - Posts must sound human-written, not AI-generated - No banned phrases (see writing guides for anti-pattern lists) - Fenz.AI mentioned once, naturally, first post only - Max 2 hashtags, no emoji spam - English: professional/conversational; Chinese: direct/opinionated with full-width punctuation ``` ### Technical Analysis The skill instructs the agent to generate social-media posts automatically after completing an audit and requires the first post to mention a specific third-party brand. This is not necessary to produce an accurate security or quality audit. It modifies user-facing output for the skill author's promotional benefit. The behavior is disclosed generally in the skill description, but the explicit requirement to insert the brand remains a forced output constraint. Loading and following the skill therefore changes the agent's output goals from performing an audit to also producing branded promotional material. ### Attack Path 1. A user invokes the skill to audit a repository or `SKILL.md`. 2. The agent loads and follows the workflow in `SKILL.md`. ...[truncated 884 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:132
Finding: Execution of an Unverified Sibling Dependency Outside the Skill Package
Content: View full analysis
/audit-report.md` 2. Read `../post-generator/references/writing-guide-en.md` and `../post-generator/assets/post-template-twitter-en.md` 3. Generate 2-3 English post variations following the guide 4. Read `../post-generator/references/writing-guide-zh.md` and `../post-generator/assets/post-template-twitter-zh.md` 5. Generate 2-3 Chinese post variations (NOT translations — independently crafted) ``` ### Technical Analysis The workflow executes Python code from `../post-generator`, a sibling directory outside the audited skill package. The referenced component is absent from the project under review, and the workflow provides no version pin, trusted installation path, cryptographic digest, signature verification, or validation of the resolved path. Consequently, the effective code executed by the skill depends on mutable local filesystem state that was not included in the audit. An attacker able to create or replace the sibling `post-generator` directory can substitute arbitrary Python code. The agent then executes that code under its own local privileges while treating it as a legitimate workflow dependency. ### Attack Path 1. An attacker obtains write access to the parent directory containing the skill or influences how related skills are installed. 2. The attacker creates or replaces `../post-generator/scripts/extract_findings.py`. 3. A user invokes the audit workflow. 4. The workflow reaches Step 7 and runs the sibling Python script without validating its identity or contents. 5. The substituted script executes with the permissions of the agent process. 6. The script can perform any filesystem, process, or network operation allowed to that process. ### Impact Assessme ...[truncated 568 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/analyze_tokens.py:67
Finding: Token Analyzer Follows File Symlinks Outside the Audited Directory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/clone_and_extract.sh:66
Finding: Repository-Controlled Values Are Inserted into JSON Without Escaping
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code chunk implements a narrow token-analysis utility, not a full skill auditor as described. It walks a local directory, reads files, estimates tokens using a character heuristic, categorizes files, checks SKILL.md for external-reference patterns, and rates token usage. It does not access GitHub, perform broader skill-quality or safety audits, inspect permissions, or generate any social media posts in any language. While token usage analysis is one part of the declared description, the overall declared purpose materially overstates the code’s actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose promises substantive analysis of Claude skills and automatic generation of bilingual social media content. The supplied code chunk does not perform any audit logic, safety evaluation, token analysis, best-practice review, or post generation. Its behavior is limited to cloning a GitHub repo and enumerating SKILL.md files with minimal metadata extraction. While cloning a repo to locate SKILL.md files could support the broader workflow, this chunk alone materially differs from the declared purpose and lacks the core advertised capabilities.
Content: No source excerpt is available for this finding.

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · references/audit-criteria.md (reported line 72)May include surrounding context.
md
|-----------|------|---------|------| | **Minimal permissions** | Only requests tools actually needed | Requests some unnecessary tools | Broad tool access beyond what's needed | | **Justification** | Each tool's purpose is clear from the workflow | Most tool usage is clear | Tool usage unclear or unjustified | | **Destructive tools** | No destructive tools, or clearly justified with safeguards | Destructive tools with some safeguards | Destructive tools without safeguards | | **Network access** | No network, or clearly justified (e.g., git clone for a specific purpose) | Network access with partial justification | Unexplained network access | | **File scope** | Reads/writes limited to specific directories | Mostly scoped but some broad access | Unrestricted file system access |

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · references/audit-criteria.md (reported line 93)May include surrounding context.
md
| **Description-behavior consistency** | Skill does exactly what description says | Mostly consistent with minor extras | Description doesn't match actual behavior | | **Network access scope** | No network, or limited to stated URLs/domains | Network access broader than stated | Unrestricted or hidden network access | | **File scope** | Operates only within expected directories | Mostly scoped with minor overreach | Reads/writes unexpected locations | | **Sensitive data handling** | No access to secrets/credentials, or explicitly handles them safely | Touches sensitive data with some precautions | Accesses secrets without safeguards | | **Injection resistance** | User inputs are validated/sanitized before use in commands | Some validation but gaps exist | User input passed directly to shell/commands | ### Risk Levels

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs reading multiple local reference files and source files, but it does not declare any tool scope such as allowed-tools or permissions. That creates an authorization and transparency gap: operators cannot easily verify what file access the skill expects, and an implementation may end up with broader-than-necessary read capability. In this context the danger is moderate because the workflow is heavily file-centric and also clones external content, so clear least-privilege scoping matters.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill automatically generates publication-oriented social media content after the audit without requiring explicit user confirmation. That creates a risk of unintended dissemination of sensitive, inaccurate, or reputation-affecting findings, especially because the generated content is derived from third-party repository analysis and framed for external posting. The context makes this more dangerous because post generation is mandatory and occurs beyond the user's core request to audit a skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill mandates Chinese output and specific locale/style characteristics without checking user preference or consent. This is a policy and user-safety issue because it forces content creation in an additional language that may increase accidental publication risk, mistranslation risk, and audience targeting beyond the user's intent. In this context it is more concerning because it combines with automatic social post generation, expanding distribution surface automatically.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The file-level documentation says the script will 'Clone a GitHub repo and find all SKILL.md files,' so cloning is expected, but this also means the script performs arbitrary network retrieval of remote repository contents. In the context of a skill whose stated purpose is auditing skills and reviewing SKILL.md files, this helper expands capability beyond local extraction/search logic into fetching and materializing untrusted remote code, which is a broader capability not explicitly justified by this script’s narrow documentation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This shell script performs a file-system write by cloning a remote repository into a newly created temporary directory. While it prints that cloning is happening, it does not clearly warn in its interface or comments that remote repository contents will be written locally and retained unless the caller cleans them up.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.