ClawHub
Back to skill

Security audit

Cli Anything

Security checks for vulnerabilities and agentic risk

Overview

This skill is a plausible CLI helper, but it downloads mutable remote code and can install it with pip without enough scoping, review, or warnings.

Review this skill before installing if you are not comfortable with it cloning the latest upstream GitHub code into `~/.openclaw/cli-anything` and installing Python packages from generated or downloaded harnesses. Prefer a pinned, reviewed revision, inspect any `agent-harness` before running `/cli-install`, and use an isolated environment rather than your main user Python environment.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
scripts/main.py:61
Finding

Unpinned Remote Repository Content Can Be Installed and Executed

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The Chinese finding identifies the same core issue: the skill presents itself as an automatic CLI generator for arbitrary software, while the effective behavior is limited and instead adds repository management and local pip installation capabilities. That discrepancy can mislead operators and agents into invoking actions with broader trust than warranted, especially where code retrieval and installation are involved.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The Chinese finding identifies the same core issue: the skill presents itself as an automatic CLI generator for arbitrary software, while the effective behavior is limited and instead adds repository management and local pip installation capabilities. That discrepancy can mislead operators and agents into invoking actions with broader trust than warranted, especially where code retrieval and installation are involved.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description and usage guidance are presented entirely in Chinese, and the file does not indicate that the skill is region-specific or provide an explicit language/locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill advertises operations that imply shell execution and file access, including cloning repositories, installing packages, and building/refining CLIs, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent setting, missing scope boundaries increases the chance that an LLM-driven workflow invokes filesystem or shell actions without adequate policy controls or user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The install/build workflow describes generating or installing CLIs for third-party software without clearly warning that these actions may modify local projects, install packages, or create artifacts affecting the filesystem. In the context of an agent skill that targets arbitrary software, lack of side-effect disclosure can lead to unintended writes against valuable source trees or execution environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation states that first use of /cli-list will automatically clone the CLI-Anything repository, but it does not prominently warn that this causes network access and local filesystem changes. Silent or poorly disclosed auto-cloning is risky in agent environments because a seemingly read-only discovery command can unexpectedly fetch remote code and alter the host state.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This shell script presents usage and operational messages in Chinese, starting with the header usage text and continuing throughout the file. The policy scope for SQP-3 covers all file types, and there is no indication that the user can opt into this locale or switch languages.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest describes an operational skill that can generate AI-callable CLIs for arbitrary software. In this file, the build/refine paths only ensure the upstream CLI-Anything repository is present and then tell the user to run commands in a Claude Code or Codex environment, so the advertised core behavior is not actually implemented here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The top-level natural-language description is written only in Chinese and gives no indication that the skill supports user language choice. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
82% confidence
Finding

The helper executes external commands (git pull, git clone) via subprocess.run with arguments influenced by runtime state and without any trust validation of the target repository or additional safety controls. Although it does not use shell=True, this skill is specifically designed for agent use and automatically fetches and updates code from the network, which expands the attack surface and can expose the host to malicious repository content or unsafe git behaviors in a privileged agent environment.

Content

Scanner excerpt · scripts/cli_anything.py (reported line 21)May include surrounding context.

python
def run_command(cmd, cwd=None, capture=True):
    """执行命令"""
    print(f"🔧 执行: {' '.join(cmd)}")
    result = subprocess.run(
        cmd,
        cwd=cwd,
        capture_output=capture,

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes a capability to analyze software source code and automatically generate an AI-callable CLI. However, the core build_cli path does not inspect the target software, invoke a generator, or write any generated CLI artifacts; it just ensures the CLI-Anything repository exists and returns success if a codex-skill directory is present.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The user-facing argument help claims the build command supports a "软件路径或 GitHub 仓库 URL", which matches the manifest's broad promise of generating CLIs for arbitrary software by analyzing source code. In practice, build_cli immediately checks Path(software_path).exists() and aborts if the input is not a local path, so a GitHub URL is not actually supported.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/main.py (reported line 22)May include surrounding context.

python
"""确保 CLI-Anything 仓库已安装"""
    if not INSTALL_DIR.exists():
        print(f"📥 克隆 CLI-Anything 仓库...")
        subprocess.run(["git", "clone", CLI_ANYTHING_REPO, str(INSTALL_DIR)], check=True)
        print(f"✅ 已克隆到 {INSTALL_DIR}")
    else:
        print(f"📂 CLI-Anything 已安装: {INSTALL_DIR}")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

The code runs pip install -e . inside an agent-harness directory that comes from a cloned or generated external project. Package installation can execute arbitrary code via build backends, setup.py, dependency hooks, or install scripts, so this is effectively arbitrary code execution under the current user account. In this skill's context, the harness is specifically intended to be generated from untrusted software source, which makes the risk higher than a normal local install.

Content

Scanner excerpt · scripts/main.py (reported line 72)May include surrounding context.

python
print(f"   目录: {harness_dir}")
    
    # 安装到当前用户
    result = subprocess.run(
        ["pip", "install", "-e", "."],
        cwd=harness_dir,
        capture_output=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill performs an editable pip install of a cloned/generated harness without an explicit warning that installation may execute arbitrary Python packaging code. Because the harness may be produced from third-party repositories or generated artifacts, this creates a strong supply-chain and code-execution risk for the agent host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

Nearly all user-facing natural language in the skill file is Chinese, and there is no indication that users can select another language or that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The script automatically performs git clone/git pull from a remote repository into a trusted local path, introducing a supply-chain risk. In an agent skill context, fetching and updating code at runtime increases exposure to repository compromise, malicious upstream changes, or unexpected code being used in later steps, especially since the fetched content is presented as part of the skill workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file presents its primary descriptive text in Chinese (让任意软件都可以被 AI Agent 控制) without indicating that language choice is optional. This can violate language/locale policy when a skill assumes a specific language rather than offering the user a choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.