ClawHub
Back to skill

Security audit

Bebebebebe

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Orthogonal setup guide, but it grants broad install and account-action authority without enough scoping or confirmation guidance.

Review this skill before installing if you are comfortable giving Orthogonal and its installed skills access to paid APIs and connected accounts. Prefer pinned/local installs where possible, inspect any remote skill before adding it, use orth login instead of manual plaintext credential setup, protect or rotate API keys, and require explicit approval before any action that sends messages, modifies cloud data, creates GitHub objects, or deletes account content.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
skill.md:27
Finding

Unpinned Global CLI Installation Creates a Supply-Chain Execution Risk

Content
View full analysis

Vulnerability Details

File Location: skill.md, lines 27-29
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: High

Vulnerable Code

bash
npm install -g @orth/cli

Technical Analysis

The installation instructions retrieve the current release of @orth/cli from the npm registry without specifying an exact version, validating an integrity digest, or requiring a source review. The -g option installs the package globally, expanding its influence beyond an isolated project environment.

npm packages may execute lifecycle scripts during installation. Consequently, a compromised publisher account, registry response, or future malicious release could execute code with the privileges of the user running the installation command. A mutable package name does not guarantee that future users will receive the same code that was available when this Skill was audited.

The CLI is necessary for the documented Orthogonal functionality, but a mutable global installation grants more exposure than the minimum necessary. A local, version-pinned installation would reduce both the supply-chain risk and the scope of filesystem changes.

Attack Path

  1. An attacker compromises the npm publisher account, package release process, or another relevant supply-chain component for @orth/cli.
  2. The attacker publishes a malicious version under the legitimate package name.
  3. A user follows the documented command without specifying a trusted version.
  4. npm downloads the attacker-controlled release and runs any applicable lifecycle installation scripts.
  5. Malicious code executes with the installing user's privileges and the CLI is placed in a global executable location.
  6. The compromised CLI can subsequently intercept credentials, alter API requests, access user-readable files, or execute additional commands whenever it is invoked.

Impact Assessment

Successful exploitation cou ...[truncated 442 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the CLI to an exact, reviewed version, for example @orth/cli@X.Y.Z.
  • Publish and verify package integrity hashes or signed provenance before installation.
  • Prefer a project-local installation and invoke it through a controlled package script or an explicitly pinned package runner.
  • Avoid installation with administrator privileges.
  • Document whether npm lifecycle scripts are required. If they are not required, install with lifecycle scripts disabled.
  • Maintain a reviewed lockfile or another immutable dependency manifest.
  • Establish a version-update process that includes source review, changelog inspection, and security testing before changing the pinned release.

T08 · Insecure Dependencies

Error
Location
skill.md:43
Finding

Remote Skills Are Installed Without Version Pinning or Content Verification

Content
View full analysis

Vulnerability Details

File Location: skill.md, lines 43-48
Vulnerability Type: Mutable remote Skill dependencies
Risk Level: High

Vulnerable Code

bash
# Find and install skills from the Orthogonal library
orth skills add orthogonal/find-skill

# Find and call APIs from the Orthogonal marketplace
orth skills add orthogonal/find-api

Technical Analysis

The instructions install remote Skills by namespace and slug without an immutable version, content digest, publisher signature, displayed-source review, or explicit approval of the retrieved content. Because Skills can supply instructions that influence agent decisions and tool usage, installing mutable Skill content establishes a sensitive supply-chain boundary.

This project does not itself contain a malicious remote payload, and no direct payload URL is embedded. The vulnerability is that the reviewed document delegates future behavior to content whose exact version is not fixed. If a marketplace entry or publisher account is compromised, the same installation command could retrieve instructions different from those originally reviewed.

The ability to install Skills is consistent with the declared discovery functionality. However, automatically trusting mutable content exceeds the minimum privilege necessary because discovery can be separated from installation, and installation can require content inspection and user authorization.

Attack Path

  1. An attacker compromises a marketplace publisher account, Skill repository, publishing pipeline, or content-delivery mechanism.
  2. The attacker modifies orthogonal/find-skill or orthogonal/find-api while preserving the expected slug.
  3. A user or agent runs the documented orth skills add command.
  4. The CLI resolves the mutable slug and installs the altered Skill into the agent's Skill directory.
  5. The agent loads the newly installed instructions during a later task.
  6. The hostile ...[truncated 763 chars]
Remediation
View remediation

Remediation Suggestions

  • Require immutable Skill versions or cryptographic content digests in every installation command.
  • Verify publisher signatures and provenance before installation.
  • Display the complete Skill content, permissions, external endpoints, and requested tools before installation.
  • Require explicit user confirmation after review rather than allowing unattended installation.
  • Install new Skills in a restricted or quarantined environment before making them available to the primary agent.
  • Apply an allowlist for trusted publishers and requested capabilities.
  • Document revocation, rollback, and incident-response procedures for compromised Skills.
  • Separate search from installation so that discovering a Skill never implicitly authorizes its execution.

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:141
Finding

Manual Credential Setup Does Not Enforce Restrictive File Permissions

Content
View full analysis

Vulnerability Details

File Location: skill.md, lines 141-150
Vulnerability Type: Insecure plaintext credential provisioning
Risk Level: Medium

Vulnerable Code

markdown
Your API key is stored at `~/.config/orthogonal/credentials.json` after running `orth login`.

**Manual setup** (if needed):

1. Get your API key at https://orthogonal.com/dashboard/settings
2. Create the credentials file:

```bash
mkdir -p ~/.config/orthogonal
echo '{"apiKey":"orth_live_YOUR_KEY"}' > ~/.config/orthogonal/credentials.json
text

### Technical Analysis

Storing an API credential is necessary for authenticated Orthogonal operations and is consistent with the Skill's declared functionality. However, the manual setup command does not explicitly set restrictive permissions on either the directory or credential file.

The resulting permissions depend on the user's current `umask` and any pre-existing permissions on `~/.config/orthogonal`. In a permissively configured or multi-user environment, another local account or process may be able to read the API key. In addition, replacing the placeholder directly in the command places the secret in the shell command line and commonly records it in shell history.

The command writes the key as plaintext JSON. Although plaintext configuration files are common for CLI authentication, they must be protected through strict access modes and should be avoided when a platform credential store is available.

### Attack Path

1. A user replaces `orth_live_YOUR_KEY` with an active API key and executes the documented command.
2. The complete command, including the key, may be retained in shell history.
3. A permissive `umask` or pre-existing directory mode creates a credential file readable by unintended local users or processes.
4. An attacker with local access reads the shell history or `credentials.json`.
5. The attacker uses the exposed key to authenticate to Orthogonal and 
...[truncated 572 chars]
Remediation
View remediation

Remediation Suggestions

  • Prefer orth login with a hidden interactive prompt or an operating-system credential manager.
  • Create the directory with mode 700 and the file with mode 600.
  • Avoid placing secrets directly in command arguments or commands recorded in shell history.
  • A safer file-based setup should use a restrictive umask, such as umask 077, before creating the directory and file.
  • Validate and correct permissions when loading existing credentials, refusing to use files accessible by group or other users.
  • Document API-key rotation and immediate revocation procedures.
  • Scope API keys to only the services and actions required, where supported.
  • Warn users not to commit the credentials file, include it in backups without encryption, or paste its contents into agent conversations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

Documenting the exact location of a plaintext credential file identifies a sensitive secret source that an agent or malicious skill could target for exfiltration. In the context of agent skills, disclosing credential storage paths materially increases the risk of credential access attempts against locally stored API keys.

Content

Scanner excerpt · skill.md (reported line 141)May include surrounding context.

md
## Authentication

Your API key is stored at `~/.config/orthogonal/credentials.json` after running `orth login`.

**Manual setup** (if needed):

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The manual setup example writes the API key directly into a local JSON file, encouraging persistent plaintext storage of a live credential. If that file is readable by other local processes, backed up insecurely, or accessed by an agent, the key can be stolen and abused for unauthorized API calls.

Content

Scanner excerpt · skill.md (reported line 150)May include surrounding context.

bash
mkdir -p ~/.config/orthogonal
echo '{"apiKey":"orth_live_YOUR_KEY"}' > ~/.config/orthogonal/credentials.json

Or set the environment variable:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest frames the skill as setup for accessing premium APIs and skills, but the documented scope extends into OAuth-backed integrations that can act on behalf of the user across Gmail, Slack, Calendar, GitHub, Drive, and Sheets. That scope expansion increases the chance an agent will invoke high-privilege third-party actions under a seemingly generic setup skill, creating authority confusion and unsafe tool use.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.md (reported line 51)May include surrounding context.

orth skills add orthogonal/find-api

text

Skills are installed to your agent's skills directory (e.g. `~/.openclaw/skills/`, `~/.claude/skills/`, or wherever your agent reads skill files).

---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The authentication section tells users how to store API credentials locally and via environment variables, but does not warn against exposing secrets in shell history, logs, shared machines, or repository files. Missing secret-handling guidance increases the risk of accidental credential leakage and unauthorized API use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

The instructions explicitly create persistent local storage for authentication material, extending the lifetime of sensitive credentials beyond the active session. Persistent secrets increase exposure to later compromise by malware, other local users, backup leakage, or overprivileged agent behaviors.

Content

Scanner excerpt · skill.md (reported line 146)May include surrounding context.

Manual setup (if needed):

  1. Get your API key at https://orthogonal.com/dashboard/settings
  2. Create the credentials file:
bash
mkdir -p ~/.config/orthogonal

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill advertises and demonstrates high-impact actions such as sending email/messages, deleting events, and creating GitHub artifacts without clearly tying them to the stated setup purpose. In an agent context, bundling these capabilities into a general access-enablement skill can lead to overbroad invocation and unintended real-world actions on connected accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The instructions include concrete commands for sending Gmail and Slack messages and creating calendar events, but provide no warning to obtain explicit user approval before executing side-effecting actions. In an autonomous or semi-autonomous agent, this omission can cause unauthorized communications or account changes with immediate external impact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.