Security audit

Skill From Memory

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it can turn private session or memory content into publishable skills and upload them with too little review or sanitization.

Install or use this only if you are comfortable with it reading the session or memory files you point it at. Treat all extracted output as sensitive, review the generated SKILL.md and scripts before publishing, avoid the one-step publish flow for private work, and use a clean output directory with safe skill names. Do not publish generated skills until secrets, personal data, internal paths, and prompt-injection text have been removed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: scripts/create-skill.sh:53
Finding: Untrusted conversation content can become published Agent instructions
Content: View full analysis
/dev/null | head -100 > "$OUTPUT_DIR/conversation.txt" || echo "Note: jq not available, using grep fallback" ``` ```bash # scripts/extract-from-history.sh:88-94 # Look for common skill patterns grep -E "(脚本|script|备份|backup|定时|cron|任务|task|自动化|automate)" "$OUTPUT_DIR/conversation.txt" | head -20 > "$OUTPUT_DIR/patterns.txt" || true if [ -s "$OUTPUT_DIR/patterns.txt" ]; then echo "Potential skill patterns found:" cat "$OUTPUT_DIR/patterns.txt" | head -10 fi ``` ```bash # scripts/extract-from-history.sh:106-131 # Generate summary echo "" echo "=== Summary ===" cat > "$OUTPUT_DIR/extraction-summary.md" << EOF # Extraction Summary ## Source - Session: $(basename "$SESSION_FILE") - Date: $(date) ## Extracted Files - conversation.txt - Full conversation text - patterns.txt - Identified skill patterns - code_hints.txt - Code/script references ## Next Steps 1. Review patterns.txt for skill ideas 2. Check code_hints.txt for reusable scripts 3. Run create-skill.sh to generate skill structure ## Suggested Skill Name $(basename "$OUTPUT_DIR") ## Suggested Description $(head -1 "$OUTPUT_DIR/patterns.txt" 2>/dev/null || echo "Based on conversation from $(basename "$SESSION_FILE")") EOF ``` ```bash # scripts/create-skill.sh:53-74 # Generate des ...[truncated 4008 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/create-skill.sh:31
Finding: Unvalidated skill name permits path traversal and file overwrite outside the intended output directory
Content: View full analysis
[options]" echo "" echo "Options:" echo " --description TEXT Skill description" echo " --type TYPE Skill type (workflow|tool|reference)" exit 1 fi if [ ! -d "$EXTRACTED_DIR" ]; then echo "Error: Extracted directory not found: $EXTRACTED_DIR" exit 1 fi # Create skill directory SKILL_DIR="./$SKILL_NAME" mkdir -p "$SKILL_DIR/scripts" ``` ```bash # scripts/create-skill.sh:63-98 # Create SKILL.md cat > "$SKILL_DIR/SKILL.md" << EOF --- name: $SKILL_NAME description: $DESCRIPTION --- # $(echo "$SKILL_NAME" | sed 's/-/ /g' | awk '{for(i=1;i<=NF;i++) $i=toupper(substr($i,1,1)) substr($i,2)} 1') ## Overview ${DESCRIPTION} ## Quick Start \`\`\`bash # Add usage example here ./scripts/main.sh \`\`\` ## Usage [Add detailed usage instructions based on extracted content] ## Scripts - \`scripts/main.sh\` - Main script EOF # Copy any extracted code blocks as starter scripts if [ -f "$EXTRACTED_DIR/code_blocks.txt" ] && [ -s "$EXTRACTED_DIR/code_blocks.txt" ]; then echo "" echo "=== Including Extracted Code ===" cp "$EXTRACTED_DIR/code_blocks.txt" "$SKILL_DIR/scripts/extracted-code.sh" chmod +x "$SKILL_DIR/scripts/extracted-code.sh" 2>/dev/null || true ``` ```bash # scripts/create-skill.sh:139-177 # Create placeholder main script cat > "$S ...[truncated 2411 chars]
Remediation: View remediation
&2 exit 1 fi ``` 2. Create generated Skills only beneath a dedicated, trusted output root. 3. Resolve both the output root and destination to canonical paths and verify that the destination remains a child of the output root. 4. Explicitly reject absolute paths, `.` components, `..` components, slashes, backslashes, and control characters. 5. Refuse existing or non-empty destinations unless the operator supplies a deliberate overwrite flag. 6. Generate into a newly created staging directory and atomically rename it after validation succeeds. 7. Check path components with `lstat` or equivalent and reject symbolic links where generated files will be written. 8. Apply the same validated canonical path in both `create-and-publish.sh` and `create-skill.sh` rather than independently reconstructing it. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/create-skill.sh:93
Finding: Arbitrary Markdown code blocks are converted into executable shell files and can be automatically published
Content: View full analysis
"$OUTPUT_DIR/code_blocks.txt" 2>/dev/null || true if [ -s "$OUTPUT_DIR/code_blocks.txt" ]; then echo "Code blocks found: $(wc -l < "$OUTPUT_DIR/code_blocks.txt") lines" fi ``` ```bash # scripts/create-skill.sh:93-100 # Copy any extracted code blocks as starter scripts if [ -f "$EXTRACTED_DIR/code_blocks.txt" ] && [ -s "$EXTRACTED_DIR/code_blocks.txt" ]; then echo "" echo "=== Including Extracted Code ===" cp "$EXTRACTED_DIR/code_blocks.txt" "$SKILL_DIR/scripts/extracted-code.sh" chmod +x "$SKILL_DIR/scripts/extracted-code.sh" 2>/dev/null || true echo "✓ Starter script created from extracted code" fi ``` ```bash # scripts/publish.sh:119-136 # Stage all files git add -A # Commit if git diff --cached --quiet; then echo "No changes to commit" else git commit -m "Release $SKILL_NAME v$VERSION" echo "✓ Changes committed" fi # Tag git tag -a "v$VERSION" -m "Release $SKILL_NAME v$VERSION" 2>/dev/null || echo "Tag v$VERSION already exists" # Push echo "Pushing to GitHub..." git push origin main 2>/dev/null || git push origin master 2>/dev/null || git push origin HEAD 2>/dev/null || echo "Push failed - may need manual intervention" git push origin --tags 2>/dev/null || true ``` ```bash # scripts/publish.sh:142-159 # Step 3: ClawHub Publish if ! $SKIP_CLAWHUB && [ -n "$CLAWHUB_SLUG" ]; then echo "=== Step 3: Publishing to ClawHub ===" # Check login if ! clawhub whoami &> /dev/null; then echo "Error: Not logged in to ClawHub. Run: clawhub login" exit 1 fi echo "Pu ...[truncated 2410 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/create-and-publish.sh:92
Finding: Predictable temporary directory permits local symlink and artifact-manipulation attacks
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The description presents a broader skill-authoring capability: transforming memory, conversation history, or completed tasks into publishable OpenClaw skills, plus publishing them. The provided code only covers the final publishing pipeline. It validates the presence of SKILL.md, checks optional tooling, initializes a git repository if needed, stages/commits/tags, pushes to GitHub, and publishes to ClawHub. There is no logic for reading memory, analyzing conversations, extracting lessons, generating skill content, or packaging solved problems into new skills. Publishing to GitHub and ClawHub is consistent with part of the declared purpose, but the primary declared creation/conversion behavior is absent. Therefore the description overstates what this code chunk actually does.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This workflow combines extraction from session history with immediate publication, creating a direct pipeline from potentially sensitive local data to public or third-party destinations. The lack of a review boundary, approval gate, or content filtering makes high-impact disclosure plausible and severe.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
- `SKILL.md` with frontmatter and instructions

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.
md
# Setup SSH key for GitHub ssh-keygen -t ed25519 -C "your@email.com" # Add ~/.ssh/id_ed25519.pub to GitHub Settings → SSH Keys # Login to ClawHub clawhub login

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents shell and network-capable operations such as running local scripts, pushing to GitHub, and publishing to ClawHub, but it does not declare any tool scope or permission boundaries. That omission increases the chance of overbroad execution and weakens reviewability, especially for a skill that reads local history and sends output to external services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill encourages extracting content from conversation history and memory files, both of which commonly contain secrets, personal data, tokens, internal URLs, or unpublished work, yet it provides no warning or sanitization requirement. In this context, the omission is dangerous because the skill's stated purpose is to transform that content into reusable artifacts that may later be shared or published.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructions normalize extracting from sensitive local sources and turning that material into skill content without any secret-scrubbing safeguards. Because session logs and memory files often contain credentials, proprietary workflows, or user data, this creates a realistic path to unintentional data exfiltration and long-lived leakage in published artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The 'full auto-create and publish' workflow can send generated content directly to GitHub and ClawHub without an explicit warning that external publication may occur. That makes accidental disclosure much more likely, because users may treat the command as a local transformation rather than a networked release action.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example shows publishing content derived from the latest session history, which is particularly risky because recent sessions are likely to include transient secrets, debugging output, internal paths, or sensitive prompts. Presenting this as a normal example without a manual review checkpoint encourages unsafe behavior in exactly the highest-risk source material.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This script extracts conversation history and writes it into plaintext files such as conversation.txt, patterns.txt, code_hints.txt, and extraction-summary.md without any warning, consent gate, redaction step, or output hardening. Conversation logs commonly contain secrets, personal data, internal code, and prior tool outputs, so exporting them by default increases the chance of unintended disclosure through local filesystem access, commits, sharing, or later publication as a skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: Lines L128 and L179-L183 use Chinese example requests and pattern phrases, which may imply a language-specific usage expectation. The file does not explicitly say the skill supports multiple languages or that Chinese-only examples are merely illustrative, so this can be read as a locale/language preference without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The pattern detection logic is explicitly limited to English and Chinese keywords in the grep expression, which embeds a language choice into skill behavior without offering opt-in or documenting that the skill is intended only for those languages. This can create a language-policy issue because other user locales are silently excluded.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.