skill-cross-agent-v1.0.0.tar

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:07 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed SSH collaboration tool, but it handles remote access in ways that can expose passwords and give broad control over other machines.

Review carefully before installing. Use this only on machines you own or administer, avoid saving or typing SSH passwords on the command line, prefer SSH keys, and do not use it on untrusted networks. The exec, get, and put commands can read, write, or run code on remote systems as the SSH user, and the current scripts do not verify SSH host identity.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/config.sh:4

Finding

Plaintext SSH Credentials Stored with Unsafe Permissions and Exposed by Configuration Display

Content

View full analysis

> "$CONFIG_FILE" echo "✅ Default password set: ***" shift 2 ;; # ... if [ -f "$CONFIG_FILE" ]; then sort -u "$CONFIG_FILE" > "${CONFIG_FILE}.tmp" mv "${CONFIG_FILE}.tmp" "$CONFIG_FILE" fi ``` ### Technical Analysis The script writes the SSH password directly to `~/.config/openclaw/cross-agent.conf` without setting a restrictive `umask` or explicitly applying secure permissions to the directory and file. With a common `022` umask, the directory may be created as `0755` and the configuration file as `0644`, allowing other local users to read the stored password. The deduplication operation creates a second plaintext file, `${CONFIG_FILE}.tmp`, using the process's default permissions and then replaces the original configuration with that file. This can undo manually hardened permissions on the original file. The `show_config` function prints the complete configuration with `cat`, including every `default_pass` entry. Although password output is masked while setting the value, invoking `config --show` or completing a configuration operation can expose the actual password in terminal output, captured logs, or calling-process output. ### Attack Path 1. A user runs `config --default-pass` or saves credentials through the interactive wizard. 2. The password is written in plaintext to `~/.config/openclaw/cross-agent.conf`. 3. The file or its temporary replacement is c ...[truncated 802 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/exec.sh:20

Finding

SSH Host Authentication Disabled Across All Remote Operations

Content

View full analysis

&1 ``` Equivalent insecure options are used by the file-transfer, task-delivery, session-listing, and connection-test scripts: ```bash -o StrictHostKeyChecking=no \ -o UserKnownHostsFile=/dev/null ``` ### Technical Analysis `StrictHostKeyChecking=no` causes SSH to accept an unrecognized host key without requiring meaningful user verification. `UserKnownHostsFile=/dev/null` prevents accepted keys from being persisted and prevents future connections from detecting that a target's key has changed. These options remove the server-authentication protection normally supplied by SSH. Encryption alone does not establish that the client is communicating with the intended host. Because the scripts also use password-based authentication through `sshpass`, a successful machine-in-the-middle or host-impersonation attack can expose the user's SSH credentials to an attacker-controlled SSH service. The weakness affects every security-sensitive remote capability provided by the Skill: arbitrary command execution, Agent task submission, session enumeration, file upload, file download, and connection testing. ### Attack Path 1. A victim invokes a Skill operation against a target on the local network. 2. An attacker able to influence LAN traffic performs ARP spoofing, routing manipulation, DNS manipulation where applicable, or otherwise redirects the connection to an attacker-controlled SSH endpoint. 3. The endpoint presents an arbitrary SSH host key. 4. The Skill silently accepts t ...[truncated 857 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send.sh:22

Finding

Remote Shell Command Injection Through Agent Task Messages

Content

View full analysis

&1" 2>&1 || { ``` ### Technical Analysis The task message is incorporated into a command string that is interpreted by the remote login shell. The script attempts to secure the value with an ad hoc `sed` replacement for single quotes, but this is not a reliable shell-argument serialization mechanism. Shell quoting must preserve the entire message as one inert argument through both local command construction and remote shell parsing. If crafted input breaks the intended single-quoted context, subsequent shell operators can be interpreted as commands rather than message data. Newlines and complex quote sequences further increase the risk of parser ambiguity. The security boundary is especially important because task messages may originate from users, automation, external content, or Agent-generated text. Such content must not be treated as shell syntax. ### Attack Path 1. An attacker supplies or influences the message passed to `cross-agent send`. 2. The message contains a crafted quote sequence followed by remote shell syntax. 3. `send.sh` applies the incomplete `sed` transformation and interpolates the result into the remote command string. 4. The SSH server invokes the remote user's shell to parse that string. 5. The malicious syntax escapes the intended `openclaw agent -m` argument. 6. The injected command executes on the remote host with the privileges of `TARGET_USER`. ### Impact Assessment Successful exploitation permits arbitrary command execution un ...[truncated 454 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:17

Finding

SSH Passwords Exposed Through Documented Command-Line Arguments

Content

View full analysis

[username] [password]" example: "openclaw cross-agent test 192.168.3.54 admin 123456" ``` The documentation also recommends commands in the following forms: ```bash openclaw cross-agent send 192.168.3.54 'task message' admin 123456 openclaw cross-agent config --default-pass 123456 ``` The runtime scripts consume passwords as positional arguments, for example: ```bash TARGET_PASS="${3:-$(cat ~/.config/openclaw/cross-agent.conf 2>/dev/null | grep default_pass | cut -d= -f2)}" ``` ### Technical Analysis The documented interface encourages users to place SSH passwords directly in command-line arguments. Commands entered interactively are commonly retained in shell history. Arguments can also be recorded by terminal session capture, automation logs, debugging output, audit tooling, and process-monitoring facilities. While access to another user's process arguments may be restricted on some operating systems, command-line secrets remain an unsafe credential-transfer mechanism because their confidentiality depends on host configuration and invocation context. The use of `sshpass -p` continues the same pattern when invoking SSH. The value `123456` appears to be an example rather than a hardcoded production secret; the vulnerability is the interface and handling pattern, not the example value itself. ### Attack Path 1. A user follows the documentation and supplies an SSH password on the command line. 2. The shell stores the command in its history, or an automation/terminal logging system records it. 3. A local attacker, support operator, log reader, or compro ...[truncated 650 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (50)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Reading sensitive credentials from a local config file while using automated SSH login and disabling host key checks creates a high-risk credential exposure pattern. An attacker on the network could impersonate a host, capture credentials, and gain remote access, while local plaintext storage increases theft risk from the endpoint itself.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Reading sensitive credentials from a local config file while using automated SSH login and disabling host key checks creates a high-risk credential exposure pattern. An attacker on the network could impersonate a host, capture credentials, and gain remote access, while local plaintext storage increases theft risk from the endpoint itself.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Reading sensitive credentials from a local config file while using automated SSH login and disabling host key checks creates a high-risk credential exposure pattern. An attacker on the network could impersonate a host, capture credentials, and gain remote access, while local plaintext storage increases theft risk from the endpoint itself.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Reading sensitive credentials from a local config file while using automated SSH login and disabling host key checks creates a high-risk credential exposure pattern. An attacker on the network could impersonate a host, capture credentials, and gain remote access, while local plaintext storage increases theft risk from the endpoint itself.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Reading sensitive credentials from a local config file while using automated SSH login and disabling host key checks creates a high-risk credential exposure pattern. An attacker on the network could impersonate a host, capture credentials, and gain remote access, while local plaintext storage increases theft risk from the endpoint itself.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Reading sensitive credentials from a local config file while using automated SSH login and disabling host key checks creates a high-risk credential exposure pattern. An attacker on the network could impersonate a host, capture credentials, and gain remote access, while local plaintext storage increases theft risk from the endpoint itself.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

A general-purpose arbitrary remote command execution feature is significantly more dangerous than the stated goal of distributing tasks to another OpenClaw instance. It can be used to run destructive or persistence-establishing commands on any reachable host, turning the skill into a remote administration backdoor in practice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Arbitrary command execution is unjustified by the stated use case and creates a direct path to full remote system compromise, data destruction, and lateral movement. Because the skill targets LAN-connected systems, compromise of one workstation could quickly spread operational impact across peer machines.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The executed chained command combines 'apt update' and 'apt install' under sudo in one step, which reduces opportunities for review and makes privileged changes more opaque. In a skill designed for cross-machine SSH coordination, silently or conveniently installing multiple networking tools under elevation is more sensitive than in a typical standalone utility.

Content

Scanner excerpt · install.sh (reported line 31)May include surrounding context.

sh

read -p "是否自动安装? (y/n) " -n 1 -r
    echo
    if [[ $REPLY =~ ^[Yy]$ ]]; then
        sudo apt update && sudo apt install -y sshpass openssh-client netcat-openbsd iputils-ping
    else
        exit 1
    fi

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script stores a user-supplied SSH password directly in a plaintext config file under the user's home directory. In the context of a cross-machine agent orchestration skill, this is especially risky because compromise of the local account, backups, logs, or misconfigured file permissions can expose credentials that enable lateral movement to other OpenClaw instances over SSH.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The SCP command disables SSH host key verification with StrictHostKeyChecking=no and UserKnownHostsFile=/dev/null, which removes protection against man-in-the-middle attacks. An attacker on the local network can impersonate the target host, capture credentials or transferred data, and return malicious content while the script silently trusts the connection.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · install.sh (reported line 26)May include surrounding context.

sh

echo "📋 步骤 1/5: 检查依赖..."
if ! command -v sshpass > /dev/null 2>&1; then
    echo "  ⚠️ 未安装 sshpass，正在安装..."
    sudo apt update && sudo apt install -y sshpass
else
    echo "  ✅ sshpass 已安装"
fi

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/wizard.sh (reported line 20)May include surrounding context.

sh

echo "📋 步骤 1/5: 检查依赖..."
if ! command -v sshpass > /dev/null 2>&1; then
    echo "  ⚠️ 未安装 sshpass，正在安装..."
    sudo apt update && sudo apt install -y sshpass
else
    echo "  ✅ sshpass 已安装"
fi

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script collects an SSH password and offers to save it as a default configuration via config.sh without any warning about how or where the credential will be stored. In a cross-machine agent skill, persisted SSH credentials can enable lateral movement, credential theft, or reuse across hosts if stored in plaintext or weakly protected.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

方法二: 手动复制到 OpenClaw skills 目录

bash

# 创建 skills 目录（如果不存在）
mkdir -p ~/.openclaw/skills

# 复制 skill
cp -r ~/Desktop/skill-cross-agent ~/.openclaw/skills/

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 40)May include surrounding context.

⚙️ 安装依赖

bash

sudo apt update
sudo apt install -y sshpass openssh-client netcat-openbsd iputils-ping

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 74% confidence

Finding

The README instructs users to install sshpass, which facilitates non-interactive password-based SSH authentication and is commonly associated with insecure credential handling. In the context of a tool that tests SSH credentials and coordinates across hosts, normalizing sshpass increases the chance of plaintext password use, credential leakage, and automation of unauthorized access attempts.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

bash

sudo apt update
sudo apt install -y sshpass openssh-client netcat-openbsd iputils-ping

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly promotes network scanning, SSH credential testing, task dispatch, and file retrieval against other hosts, but provides no authorization, scope, or safety guidance. In a cross-agent skill that operates over SSH on a LAN, this omission increases the likelihood of misuse for unauthorized access attempts or disruptive internal reconnaissance.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 104)May include surrounding context.

命令找不到

bash

# 检查文件是否存在
ls -la ~/.openclaw/skills/cross-agent/

# 检查执行权限
chmod +x ~/.openclaw/skills/cross-agent/*.sh

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

This troubleshooting step again directs installation of sshpass, reinforcing insecure password-based SSH automation. Given the skill's stated purpose of scanning hosts and testing SSH access, this dependency materially increases the capability for credential spraying or mishandled secrets on internal networks.

Content

Scanner excerpt · README.md (reported line 113)May include surrounding context.

依赖缺失

bash

sudo apt install -y sshpass openssh-client netcat-openbsd

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation normalizes passing passwords on the command line and using remote execution and file transfer features without warning users about credential leakage, shell history exposure, remote side effects, or data sensitivity. This omission increases the likelihood of unsafe use and accidental disclosure in logs, process listings, or screenshots.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

General file upload/download expands the skill from collaboration into broad remote data movement, which can enable exfiltration or unauthorized staging of tools and payloads. In the context of a collaboration skill, this is more dangerous because the documentation does not frame it as a high-risk administrative capability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This shell skill advertises sending tasks, transferring files, and executing commands on target machines, which are safety-critical operations affecting user data and remote systems. In this file, there is no confirmation prompt and no warning text in the help output disclosing the risks or reminding users to verify targets before running these commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The example commands encourage users to pass SSH usernames and passwords directly on the command line, which can expose credentials through shell history, process listings, terminal logs, and monitoring tools. Even though this file is only help text, normalizing this pattern materially increases the chance of credential disclosure during real-world use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script's user-facing text, prompts, and usage instructions are presented in Chinese throughout, including the confirmation prompt at L28. This imposes a specific language on all users without opt-in or justification, which matches the locale/language policy violation criteria.

Content

No source excerpt is available for this finding.