T05 · Unauthorized Access and Privilege Escalation
Error
- Location
skill.yaml:61- Finding
Unauthenticated webhook permits unrestricted browser navigation and SSRF
- Content
View full analysis
- Remediation
View remediation
Security audit
page-behavior-audit
Security checks for vulnerabilities and agentic risk
Overview
This skill broadly matches a page-auditing purpose, but it exposes high-impact browser and data-capture behavior with weak scoping and unsafe defaults.
Install only in a controlled environment. Do not expose the webhook to untrusted callers, restrict outbound and internal network access for the browser, avoid auditing authenticated or sensitive pages unless HAR and screenshot retention are acceptable, remove --no-sandbox before processing untrusted pages, pin installer versions, and avoid the optional sudo/system install unless you have reviewed the exact files being installed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
skill.yaml:51- Finding
Browser sandbox is disabled while processing attacker-selected web content
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
.claude/settings.local.json:1- Finding
Project configuration grants unrestricted Bash execution
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:5- Finding
Installation documentation executes an unpinned mutable package release
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.yaml:34- Finding
Policy signature verification is claimed but not implemented
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.yaml:111- Finding
HAR files are exported even when the caller disables HAR capture
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose is a page-behavior audit, but the detected behavior includes installation-like actions, directory creation, file writes, and invocation of privileged or system commands such as sudo, mkdir, cp, grep, and openclaw. A mismatch between declared and actual behavior is dangerous because it can mislead operators into approving a skill that performs broader system modification than expected.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill is described as a page auditing tool, but the README requires a
WECOM_WEBHOOK_URL, indicating outbound communication to a third-party endpoint not reflected in the stated behavior. This discrepancy undermines transparency and could enable exfiltration of scan results or metadata to an external service without users fully understanding that network egress is part of the skill's operation.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Usage
bash curl -X POST http://localhost:8080/api/audit/scan \ -H "Content-Type: application/json" \ -d '{"url": "https://example.com"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Usage
bash curl -X POST http://localhost:8080/api/audit/scan \ -H "Content-Type: application/json" \ -d '{"url": "https://example.com"}'
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill advertises webhook-triggered auditing, screenshots, HAR export, and CLI execution, which imply execution and file/network side effects, but it declares no explicit tool scope or permissions. That ambiguity can cause the host to grant broader-than-expected capabilities or prevent reviewers from understanding that shell/file/network actions are required, increasing the risk of unsafe execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Screenshots, HAR files, and audit logs can capture credentials, tokens, personal data, internal URLs, and page contents, and the skill description does not clearly warn users that this data is stored on disk. In a web-auditing context this is especially sensitive because the audited pages may be authenticated, internal, or otherwise confidential.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill sends critical findings to an external WeCom webhook but does not clearly warn users that audit-derived data may leave the local environment. External transmission raises confidentiality and compliance concerns, especially if alert payloads include URLs, page content, internal hostnames, or other sensitive evidence from scans.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh *) echo -e "${RED}Unknown option: $1${NC}" echo "Usage: $0 [--user|--system]" echo " --user : Install to user directory (default, no sudo required)" echo " --system : Install to system directory (requires sudo)" exit 1 ;;
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh *) echo -e "${RED}Unknown option: $1${NC}" echo "Usage: $0 [--user|--system]" echo " --user : Install to user directory (default, no sudo required)" echo " --system : Install to system directory (requires sudo)" exit 1 ;;
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh *) echo -e "${RED}Unknown option: $1${NC}" echo "Usage: $0 [--user|--system]" echo " --user : Install to user directory (default, no sudo required)" echo " --system : Install to system directory (requires sudo)" exit 1 ;;
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh *) echo -e "${RED}Unknown option: $1${NC}" echo "Usage: $0 [--user|--system]" echo " --user : Install to user directory (default, no sudo required)" echo " --system : Install to system directory (requires sudo)" exit 1 ;;
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh *) echo -e "${RED}Unknown option: $1${NC}" echo "Usage: $0 [--user|--system]" echo " --user : Install to user directory (default, no sudo required)" echo " --system : Install to system directory (requires sudo)" exit 1 ;;
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 72% confidence
- Finding
In system mode, the script copies a local skill.yaml into a privileged destination with sudo without validating the source file or constraining the destination beyond environment-derived paths. If an attacker can replace skill.yaml in the working directory or influence OPENCLAW_HOME before execution, they may cause installation of a malicious skill with elevated trust/persistence.
- Content
sh if [ "$MANUAL_INSTALL" = true ]; then echo "Installing skill manually..." if [ "$USE_SUDO" = true ]; then sudo cp skill.yaml "$SKILL_FILE" || { echo -e "${RED}Failed to copy skill.yaml${NC}" exit 1 }
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 75% confidence
- Finding
The fallback path again performs sudo cp of skill.yaml into the system skills directory after a CLI failure, with no integrity check on the source file and potential reliance on environment-controlled destination paths. This broadens the attack surface because privileged installation occurs even when the primary mechanism fails, making tampering with the local package or path selection more impactful.
- Content
sh openclaw skill install skill.yaml || { echo -e "${RED}Failed to install via CLI, trying manual install...${NC}" if [ "$USE_SUDO" = true ]; then sudo cp skill.yaml "$SKILL_FILE" else cp skill.yaml "$SKILL_FILE" fi
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh echo "" echo "Usage:" echo " 1. Via Webhook:" echo " curl -X POST http://localhost:8080/api/audit/scan \\" echo " -H 'Content-Type: application/json' \\" echo " -d '{\"url\": \"https://example.com\"}'" echo ""
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill exposes a POST webhook that accepts an arbitrary URL and then launches a browser to visit it, with no visible authentication, allowlisting, or trigger constraints in the manifest. That makes the skill effectively a remotely triggerable browsing/probing primitive, which can be abused for SSRF-like internal access, scanning, or driving the agent to collect artifacts from attacker-specified destinations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill presents itself as a hashed-policy/CSP-compliant page auditor, but it also captures full-page screenshots and HAR archives, which can collect sensitive page content, tokens in URLs, headers, and third-party network metadata unrelated to simple text-policy auditing. In this context, the extra collection and persistence materially expand data exposure and retention risk, especially because the target URL is attacker-controlled input via the webhook.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill includes an outbound webhook capability that can transmit aggregated audit results to an external WeCom endpoint, but that egress is not tightly scoped or justified by the basic auditing function. Since the report may include alert details, paths to artifacts, and potentially sensitive findings derived from arbitrary target pages, this creates an avoidable exfiltration channel if misconfigured or abused.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The post-install instructions direct users to configure
WECOM_WEBHOOK_URLwith a fixedqyapi.weixin.qq.comendpoint, which bakes in a specific communication platform and locale context. There is no indication that this locale-specific choice is optional, user-selectable, or justified as region-specific behavior.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 63% confidence
- Finding
The fixed template name "FRONTEND_BEHAVIOR_ALERT" suggests alerts may be sent in a predetermined language/locale, and the manifest provides no user opt-in or locale-selection mechanism. Because language/locale policy applies to all file types, a hardcoded notification format without documented choice can be a policy concern.
- Content
Static analysis
No suspicious patterns detected.