skill-cross-agent-v1.0.0.tar

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:07 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed SSH collaboration tool, but it handles remote access in ways that can expose passwords and give broad control over other machines.

Review carefully before installing. Use this only on machines you own or administer, avoid saving or typing SSH passwords on the command line, prefer SSH keys, and do not use it on untrusted networks. The exec, get, and put commands can read, write, or run code on remote systems as the SSH user, and the current scripts do not verify SSH host identity.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/config.sh:4
• Finding: Plaintext SSH Credentials Stored with Unsafe Permissions and Exposed by Configuration Display<![CDATA[ ## Vulnerability Details **File Location**: `scripts/config.sh:4-14, 28-30, 62-65` **Vulnerability Type**: Plaintext credential storage and disclosure **Risk Level**: High ### Vulnerable Code ```bash CONFIG_DIR="${HOME}/.config/openclaw" CONFIG_FILE="${CONFIG_DIR}/cross-agent.conf" # Ensure the configuration directory exists mkdir -p "$CONFIG_DIR" show_config() { echo "📋 Current configuration:" if [ -f "$CONFIG_FILE" ]; then cat "$CONFIG_FILE" else echo " (No configuration)" fi } # ... --default-pass) echo "default_pass=$2" >> "$CONFIG_FILE" echo "✅ Default password set: ***" shift 2 ;; # ... if [ -f "$CONFIG_FILE" ]; then sort -u "$CONFIG_FILE" > "${CONFIG_FILE}.tmp" mv "${CONFIG_FILE}.tmp" "$CONFIG_FILE" fi ``` ### Technical Analysis The script writes the SSH password directly to `~/.config/openclaw/cross-agent.conf` without setting a restrictive `umask` or explicitly applying secure permissions to the directory and file. With a common `022` umask, the directory may be created as `0755` and the configuration file as `0644`, allowing other local users to read the stored password. The deduplication operation creates a second plaintext file, `${CONFIG_FILE}.tmp`, using the process's default permissions and then replaces the original configuration with that file. This can undo manually hardened permissions on the original file. The `show_config` function prints the complete configuration with `cat`, including every `default_pass` entry. Although password output is masked while setting the value, invoking `config --show` or completing a configuration operation can expose the actual password in terminal output, captured logs, or calling-process output. ### Attack Path 1. A user runs `config --default-pass` or saves credentials through the interactive wizard. 2. The password is written in plaintext to `~/.config/openclaw/cross-agent.conf`. 3. The file or its temporary replacement is c ...[truncated 802 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Set `umask 077` before creating any credential-bearing directory or file. - Create the configuration directory with `mkdir -p -m 700 "$CONFIG_DIR"`. - Create and maintain the configuration file with mode `0600`. - Apply mode `0600` to temporary files and use `mktemp` in the protected directory. - Preserve or explicitly restore restrictive permissions after replacing the configuration file. - Never print `default_pass`; redact it when displaying configuration. - Prefer SSH public-key authentication or a platform credential manager instead of persistent plaintext passwords. - Validate that `$2` exists before processing options that require values. - Consider separating non-sensitive defaults from credentials so ordinary configuration display cannot expose secrets. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/exec.sh:20
• Finding: SSH Host Authentication Disabled Across All Remote Operations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/exec.sh:20-23`; also present in `scripts/get.sh:29-32`, `scripts/put.sh:30-33`, `scripts/send.sh:25-29`, `scripts/sessions.sh:19-23`, and `scripts/test.sh:35-39, 49-52` **Vulnerability Type**: Missing SSH server identity verification **Risk Level**: High ### Vulnerable Code ```bash sshpass -p "$TARGET_PASS" ssh \ -o StrictHostKeyChecking=no \ -o UserKnownHostsFile=/dev/null \ "${TARGET_USER}@${TARGET_IP}" "$COMMAND" 2>&1 ``` Equivalent insecure options are used by the file-transfer, task-delivery, session-listing, and connection-test scripts: ```bash -o StrictHostKeyChecking=no \ -o UserKnownHostsFile=/dev/null ``` ### Technical Analysis `StrictHostKeyChecking=no` causes SSH to accept an unrecognized host key without requiring meaningful user verification. `UserKnownHostsFile=/dev/null` prevents accepted keys from being persisted and prevents future connections from detecting that a target's key has changed. These options remove the server-authentication protection normally supplied by SSH. Encryption alone does not establish that the client is communicating with the intended host. Because the scripts also use password-based authentication through `sshpass`, a successful machine-in-the-middle or host-impersonation attack can expose the user's SSH credentials to an attacker-controlled SSH service. The weakness affects every security-sensitive remote capability provided by the Skill: arbitrary command execution, Agent task submission, session enumeration, file upload, file download, and connection testing. ### Attack Path 1. A victim invokes a Skill operation against a target on the local network. 2. An attacker able to influence LAN traffic performs ARP spoofing, routing manipulation, DNS manipulation where applicable, or otherwise redirects the connection to an attacker-controlled SSH endpoint. 3. The endpoint presents an arbitrary SSH host key. 4. The Skill silently accepts t ...[truncated 857 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `StrictHostKeyChecking=no` and `UserKnownHostsFile=/dev/null`. - Use a persistent, dedicated `known_hosts` file with restrictive permissions. - Require explicit fingerprint verification during first use. - Reject changed host keys instead of silently accepting them. - Allow administrators to provision trusted host keys before unattended operation. - Prefer SSH public-key authentication and protect private keys with an agent or hardware-backed key store. - Consider using `StrictHostKeyChecking=accept-new` only when an explicit trust-on-first-use policy is acceptable; it must still persist keys and reject subsequent changes. - Provide a documented command for securely rotating a known host key rather than disabling verification. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send.sh:22
• Finding: Remote Shell Command Injection Through Agent Task Messages<![CDATA[ ## Vulnerability Details **File Location**: `scripts/send.sh:22-29` **Vulnerability Type**: Remote shell command injection **Risk Level**: High ### Vulnerable Code ```bash # Escape special characters in the message ESCAPED_MSG=$(echo "$MESSAGE" | sed "s/'/'\\''/g") sshpass -p "$TARGET_PASS" ssh \ -o StrictHostKeyChecking=no \ -o UserKnownHostsFile=/dev/null \ "${TARGET_USER}@${TARGET_IP}" \ "export PATH=\$HOME/.npm-global/bin:\$PATH && openclaw agent -m '${ESCAPED_MSG}' 2>&1" 2>&1 || { ``` ### Technical Analysis The task message is incorporated into a command string that is interpreted by the remote login shell. The script attempts to secure the value with an ad hoc `sed` replacement for single quotes, but this is not a reliable shell-argument serialization mechanism. Shell quoting must preserve the entire message as one inert argument through both local command construction and remote shell parsing. If crafted input breaks the intended single-quoted context, subsequent shell operators can be interpreted as commands rather than message data. Newlines and complex quote sequences further increase the risk of parser ambiguity. The security boundary is especially important because task messages may originate from users, automation, external content, or Agent-generated text. Such content must not be treated as shell syntax. ### Attack Path 1. An attacker supplies or influences the message passed to `cross-agent send`. 2. The message contains a crafted quote sequence followed by remote shell syntax. 3. `send.sh` applies the incomplete `sed` transformation and interpolates the result into the remote command string. 4. The SSH server invokes the remote user's shell to parse that string. 5. The malicious syntax escapes the intended `openclaw agent -m` argument. 6. The injected command executes on the remote host with the privileges of `TARGET_USER`. ### Impact Assessment Successful exploitation permits arbitrary command execution un ...[truncated 454 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not concatenate message data into a remote shell command. - Use a fixed remote helper that reads the message from standard input, ensuring the content is processed exclusively as data. - Alternatively, transmit the message using a structured protocol or safely encoded representation and decode it inside a fixed, non-dynamic remote command. - If a shell command is unavoidable, serialize every dynamic argument with a proven shell-escaping routine rather than an ad hoc `sed` replacement. - Avoid `echo` for arbitrary input; use `printf '%s'`. - Validate message size and reject embedded NUL data or unsupported encodings. - Add regression tests covering single quotes, backslashes, command substitutions, semicolons, pipes, redirections, and embedded newlines. - Keep the remote SSH account minimally privileged and prohibit passwordless privilege escalation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:17
• Finding: SSH Passwords Exposed Through Documented Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-20`; additional examples appear at `SKILL.md:22-50, 68-90` and `README.md:65-66` **Vulnerability Type**: Sensitive information exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```yaml test: description: "Test SSH connection to the target machine" usage: "openclaw cross-agent test <IP> [username] [password]" example: "openclaw cross-agent test 192.168.3.54 admin 123456" ``` The documentation also recommends commands in the following forms: ```bash openclaw cross-agent send 192.168.3.54 'task message' admin 123456 openclaw cross-agent config --default-pass 123456 ``` The runtime scripts consume passwords as positional arguments, for example: ```bash TARGET_PASS="${3:-$(cat ~/.config/openclaw/cross-agent.conf 2>/dev/null | grep default_pass | cut -d= -f2)}" ``` ### Technical Analysis The documented interface encourages users to place SSH passwords directly in command-line arguments. Commands entered interactively are commonly retained in shell history. Arguments can also be recorded by terminal session capture, automation logs, debugging output, audit tooling, and process-monitoring facilities. While access to another user's process arguments may be restricted on some operating systems, command-line secrets remain an unsafe credential-transfer mechanism because their confidentiality depends on host configuration and invocation context. The use of `sshpass -p` continues the same pattern when invoking SSH. The value `123456` appears to be an example rather than a hardcoded production secret; the vulnerability is the interface and handling pattern, not the example value itself. ### Attack Path 1. A user follows the documentation and supplies an SSH password on the command line. 2. The shell stores the command in its history, or an automation/terminal logging system records it. 3. A local attacker, support operator, log reader, or compro ...[truncated 650 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove password parameters from documented command syntax. - Prompt for passwords interactively with silent input, such as `read -r -s`, only when password authentication is unavoidable. - Pass credentials through a protected file descriptor or operating-system credential manager rather than process arguments. - Prefer SSH public-key authentication managed through `ssh-agent` or hardware-backed keys. - Avoid `sshpass -p`; if legacy compatibility is necessary, use its protected file-descriptor mechanism and tightly control the supplying process. - Update all examples and help text to avoid realistic plaintext passwords. - Warn users to rotate any password previously exposed in shell history or logs. - Ensure CI systems and wrappers do not echo secret input. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (50)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Reading sensitive credentials from a local config file while using automated SSH login and disabling host key checks creates a high-risk credential exposure pattern. An attacker on the network could impersonate a host, capture credentials, and gain remote access, while local plaintext storage increases theft risk from the endpoint itself.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Reading sensitive credentials from a local config file while using automated SSH login and disabling host key checks creates a high-risk credential exposure pattern. An attacker on the network could impersonate a host, capture credentials, and gain remote access, while local plaintext storage increases theft risk from the endpoint itself.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Reading sensitive credentials from a local config file while using automated SSH login and disabling host key checks creates a high-risk credential exposure pattern. An attacker on the network could impersonate a host, capture credentials, and gain remote access, while local plaintext storage increases theft risk from the endpoint itself.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Reading sensitive credentials from a local config file while using automated SSH login and disabling host key checks creates a high-risk credential exposure pattern. An attacker on the network could impersonate a host, capture credentials, and gain remote access, while local plaintext storage increases theft risk from the endpoint itself.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Reading sensitive credentials from a local config file while using automated SSH login and disabling host key checks creates a high-risk credential exposure pattern. An attacker on the network could impersonate a host, capture credentials, and gain remote access, while local plaintext storage increases theft risk from the endpoint itself.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Reading sensitive credentials from a local config file while using automated SSH login and disabling host key checks creates a high-risk credential exposure pattern. An attacker on the network could impersonate a host, capture credentials, and gain remote access, while local plaintext storage increases theft risk from the endpoint itself.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: A general-purpose arbitrary remote command execution feature is significantly more dangerous than the stated goal of distributing tasks to another OpenClaw instance. It can be used to run destructive or persistence-establishing commands on any reachable host, turning the skill into a remote administration backdoor in practice.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Arbitrary command execution is unjustified by the stated use case and creates a direct path to full remote system compromise, data destruction, and lateral movement. Because the skill targets LAN-connected systems, compromise of one workstation could quickly spread operational impact across peer machines.

Chaining Abuse

High

• Category: Tool Misuse

Content

read -p "是否自动安装? (y/n) " -n 1 -r
    echo
    if [[ $REPLY =~ ^[Yy]$ ]]; then
        sudo apt update && sudo apt install -y sshpass openssh-client netcat-openbsd iputils-ping
    else
        exit 1
    fi

• Confidence: 91% confidence
• Finding: The executed chained command combines 'apt update' and 'apt install' under sudo in one step, which reduces opportunities for review and makes privileged changes more opaque. In a skill designed for cross-machine SSH coordination, silently or conveniently installing multiple networking tools under elevation is more sensitive than in a typical standalone utility.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script stores a user-supplied SSH password directly in a plaintext config file under the user's home directory. In the context of a cross-machine agent orchestration skill, this is especially risky because compromise of the local account, backups, logs, or misconfigured file permissions can expose credentials that enable lateral movement to other OpenClaw instances over SSH.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The SCP command disables SSH host key verification with StrictHostKeyChecking=no and UserKnownHostsFile=/dev/null, which removes protection against man-in-the-middle attacks. An attacker on the local network can impersonate the target host, capture credentials or transferred data, and return malicious content while the script silently trusts the connection.

Chaining Abuse

High

• Category: Tool Misuse

Content

echo "📋 步骤 1/5: 检查依赖..."
if ! command -v sshpass > /dev/null 2>&1; then
    echo "  ⚠️ 未安装 sshpass，正在安装..."
    sudo apt update && sudo apt install -y sshpass
else
    echo "  ✅ sshpass 已安装"
fi

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

echo "📋 步骤 1/5: 检查依赖..."
if ! command -v sshpass > /dev/null 2>&1; then
    echo "  ⚠️ 未安装 sshpass，正在安装..."
    sudo apt update && sudo apt install -y sshpass
else
    echo "  ✅ sshpass 已安装"
fi

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The script collects an SSH password and offers to save it as a default configuration via config.sh without any warning about how or where the credential will be stored. In a cross-machine agent skill, persisted SSH credentials can enable lateral movement, credential theft, or reuse across hosts if stored in plaintext or weakly protected.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 方法二: 手动复制到 OpenClaw skills 目录
```bash
# 创建 skills 目录（如果不存在）
mkdir -p ~/.openclaw/skills

# 复制 skill
cp -r ~/Desktop/skill-cross-agent ~/.openclaw/skills/

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## ⚙️ 安装依赖

```bash
sudo apt update
sudo apt install -y sshpass openssh-client netcat-openbsd iputils-ping
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
sudo apt update
sudo apt install -y sshpass openssh-client netcat-openbsd iputils-ping
```

---

• Confidence: 74% confidence
• Finding: The README instructs users to install sshpass, which facilitates non-interactive password-based SSH authentication and is commonly associated with insecure credential handling. In the context of a tool that tests SSH credentials and coordinates across hosts, normalizing sshpass increases the chance of plaintext password use, credential leakage, and automation of unauthorized access attempts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README explicitly promotes network scanning, SSH credential testing, task dispatch, and file retrieval against other hosts, but provides no authorization, scope, or safety guidance. In a cross-agent skill that operates over SSH on a LAN, this omission increases the likelihood of misuse for unauthorized access attempts or disruptive internal reconnaissance.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

### 命令找不到
```bash
# 检查文件是否存在
ls -la ~/.openclaw/skills/cross-agent/

# 检查执行权限
chmod +x ~/.openclaw/skills/cross-agent/*.sh

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 依赖缺失
```bash
sudo apt install -y sshpass openssh-client netcat-openbsd
```

---

• Confidence: 72% confidence
• Finding: This troubleshooting step again directs installation of sshpass, reinforcing insecure password-based SSH automation. Given the skill's stated purpose of scanning hosts and testing SSH access, this dependency materially increases the capability for credential spraying or mishandled secrets on internal networks.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation normalizes passing passwords on the command line and using remote execution and file transfer features without warning users about credential leakage, shell history exposure, remote side effects, or data sensitivity. This omission increases the likelihood of unsafe use and accidental disclosure in logs, process listings, or screenshots.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: General file upload/download expands the skill from collaboration into broad remote data movement, which can enable exfiltration or unauthorized staging of tools and payloads. In the context of a collaboration skill, this is more dangerous because the documentation does not frame it as a high-risk administrative capability.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This shell skill advertises sending tasks, transferring files, and executing commands on target machines, which are safety-critical operations affecting user data and remote systems. In this file, there is no confirmation prompt and no warning text in the help output disclosing the risks or reminding users to verify targets before running these commands.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The example commands encourage users to pass SSH usernames and passwords directly on the command line, which can expose credentials through shell history, process listings, terminal logs, and monitoring tools. Even though this file is only help text, normalizing this pattern materially increases the chance of credential disclosure during real-world use.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The script's user-facing text, prompts, and usage instructions are presented in Chinese throughout, including the confirmation prompt at L28. This imposes a specific language on all users without opt-in or justification, which matches the locale/language policy violation criteria.