T09 · Insecure Skill Coding Practices
Error
- Location
scripts/add-job.sh:36- Finding
Python Code Injection Through Job Fields and Database Path
- Content
View full analysis
- Remediation
View remediation
Security audit
Construction PM
Security checks for vulnerabilities and agentic risk
Overview
This construction project-management skill is coherent in purpose, but its shell scripts can turn job fields, email text, or workspace paths into executable Python code.
Review this skill before installing. Its local job database behavior is disclosed and useful, but do not run the current scripts on untrusted emails, externally supplied job fields, or unusual DATA_DIR/OPENCLAW_WORKSPACE paths until the Python invocation is rewritten to pass values as data rather than source code.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/parse-email.sh:19- Finding
Arbitrary Python Execution Through Untrusted Email Content
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pipeline.sh:25- Finding
Python Code Injection Through Pipeline Filters and Workspace Path
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/briefing.sh:15- Finding
Python Code Injection Through Briefing Threshold or Database Path
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/permit-check.sh:15- Finding
Python Code Injection Through Permit Threshold or Database Path
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/init.sh:19- Finding
Python Code Injection Through Initialization Data Path
- Content
View full analysis
/dev/null; then python3 -c " import json, datetime with open('$DATA_DIR/jobs.json', 'r+') as f: d = json.load(f) d['metadata']['created'] = datetime.date.today().isoformat() f.seek(0); json.dump(d, f, indent=2); f.truncate() " fi ``` The existing-database branch repeats the same unsafe pattern: ```bash python3 -c " import json with open('$DATA_DIR/jobs.json') as f: d = json.load(f) jobs = d.get('jobs', []) print(f' {len(jobs)} jobs tracked') " ``` ### Technical Analysis `DATA_DIR` is derived from the `DATA_DIR` or `OPENCLAW_WORKSPACE` environment variable and is inserted directly into single-quoted Python literals inside a shell-expanded `python3 -c` string. A path containing a single quote, newline, and Python syntax can close the path literal and introduce executable statements. Shell quoting around directory operations does not sanitize the value for use as Python source. This path requires influence over environment-derived configuration rather than ordinary job data, but it remains exploitable in wrappers, automation, or Agent environments that construct workspace paths from externally influenced values. ### Attack Path 1. An attacker causes an automated invocation to use a crafted `DATA_DIR` or `OPENCLAW_WORKSPACE` value. 2. `init.sh` creates or locates the database using that value. 3. The value is embedded in the `python3 -c` source without Python escaping. 4. The crafted path closes the single-quoted literal and adds a Python statement. 5. Python executes the injected statement with the invoking Agent's privileges. ### Impact Assessment Exploitation permits arbitrary code execution in the security context of the process running initialization. The attacker may acc ...[truncated 141 chars]- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises shell-based workflows that initialize a database and write job/briefing data to the filesystem, but the manifest does not declare any tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and increases the chance an agent can perform file writes without an explicit, reviewable declaration of that capability.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code performs a direct write to the persistent jobs.json database, which can modify or overwrite user data. Although the script prints a success message afterward, there is no prior warning, confirmation, or inline disclosure that running the command will rewrite the database file.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill description defines multiple broad, loosely bounded use cases such as tracking jobs, generating briefings, parsing emails, and monitoring pipeline status, which increases the chance an agent will invoke the skill in contexts where it has not been narrowly justified. In practice, overly broad activation criteria can expose project, financial, and email-derived data to unintended processing paths and make risky script execution more likely without clear user intent.
- Content