T09 · Insecure Skill Coding Practices
Error
- Location
migrate.py:278- Finding
ZIP Path Traversal Can Write Files Outside the Extraction Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
Quick Resurrection
Security checks for vulnerabilities and agentic risk
Overview
This migration skill is mostly aligned with its stated purpose, but it handles highly sensitive agent data and can make persistent system changes with several under-scoped safety controls.
Install only if you fully trust the migration package source and are comfortable moving private memory, tool configuration, skills, agent identities, and scheduled tasks. Use dry-run first, inspect the ZIP contents manually, prefer --no-cron and --no-restart for the first run, encrypt the archive during transfer, and avoid importing packages from other users or untrusted agents.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
migrate.py:380- Finding
Package-Controlled Workspace Paths Permit Arbitrary Destination Writes
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
migrate.py:139- Finding
Shallow-Copy Merge Can Hide Changes from the Security Diff
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
migrate.py:770- Finding
Cron Review Truncates Payloads That Are Subsequently Installed in Full
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
pack.py:210- Finding
Sensitive Agent Data Is Collected into an Unencrypted ZIP Archive
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
migrate.py:76- Finding
Critical Configuration Backup Silently Fails Before Migration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (34)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
This is the same core issue as the AST4 finding at line 43: a generic wrapper forwards attacker-influenced strings into subprocess.run with shell=True. In a migration tool that processes externally supplied packages and modifies local agent configuration, such a primitive materially increases the risk of command execution if invoked now or in future changes.
- Content
python def run_cmd(cmd): """执行命令，返回 (stdout, returncode)。仅用于只读操作。""" result = subprocess.run(cmd, shell=True, capture_output=True, text=True) return result.stdout.strip(), result.returncode # =============================================
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python def info(msg): print(f"{BLUE}[i]{NC} {msg}") def run_cmd(cmd): result = subprocess.run(cmd, shell=True, capture_output=True, text=True) return result.stdout.strip(), result.returncode # =============================================
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README uses a convenience/trust framing ('one-click move package') and then escalates to privileged actions by the agent, including modifying configuration and restarting infrastructure. In agent ecosystems, this kind of packaging can normalize unsafe trust in bundled instructions and reduce scrutiny of sensitive actions, making social-engineering-assisted compromise more likely.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generated README instructs users to hand the package to an agent so the agent can perform migration actions including merging configuration, restoring files, creating cron tasks, and restarting services. That encourages delegation of high-privilege state-changing actions based on package contents, which is dangerous because the package can carry sensitive config and executable migration logic that may be tampered with or insufficiently reviewed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document instructs users to package and transfer highly sensitive agent materials including MEMORY.md, USER.md, TOOLS.md, identity files, and configuration into a portable archive, but it does not prominently warn that this may expose personal data, internal secrets, agent IDs, and operational history when moved or stored insecurely. In the context of an agent migration skill, this omission is especially risky because the process is designed for bulk export and redistribution, making accidental over-sharing or unsafe handling more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The migration instructions describe actions that modify the target system—copying files into agent workspaces, updating configuration, creating cron tasks, and restarting the Gateway—without a prominent user-facing warning about these side effects or the need for confirmation and review. In this skill context, that is more dangerous because users are encouraged to run a one-click migration script from an imported package, increasing the chance of unintended persistence, service disruption, or unsafe changes on the new environment.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The primary skill description is written in Chinese and presents the behavior and confirmation flow only in that language. This creates a locale/language policy concern because the file does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include broad, everyday expressions such as '我要搬家' and '换电脑了', which can plausibly occur in normal conversation outside an explicit request to run a high-impact migration skill. Because this skill can package sensitive files, modify configuration, create cron jobs, and restart services, unintended activation materially increases the chance of prompting risky operations at the wrong time.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file claims to be a generic example/template, but the embedded task is a concrete autonomous self-iteration routine with persistent write and push actions. That mismatch is dangerous because downstream tooling or reviewers may treat the file as harmless scaffolding while it actually provisions operational behavior that can mutate project state on a schedule.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The task message is broad and underspecified: it directs the agent to read memory and team artifacts, update a file, and push changes, but provides no scope limits, safety exclusions, approval checkpoints, or constraints on what may be changed. Overbroad autonomous instructions increase the chance of prompt-influenced behavior, unintended data access, and unsupervised repository modifications, especially when executed on a recurring schedule.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The scheduled payload explicitly instructs the agent to read internal memory and team skill artifacts, modify MEMORY.md, and then commit and push changes autonomously. In a file described as a generic cron template, embedding repository-writing and remote-push behavior creates an unjustified autonomous state-changing workflow that could propagate unintended, unsafe, or attacker-influenced changes without human review.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrase “我要搬家” is a common natural-language expression that could appear in ordinary conversation, yet the README implies it directly launches a packaging operation. That creates a risk of unintended execution of stateful export behavior without a clearly scoped command format or confirmation step.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The migration example “这是搬家包，帮我搬家” is similarly ambiguous and may be triggered by ordinary user phrasing while initiating a sensitive restore/import workflow. Because migration changes system state and may import configuration from an archive, ambiguous invocation increases the chance of accidental or socially engineered execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README describes decompression, agent handling choices, config merging, and cron restoration, all of which affect system state, but it does not present an explicit warning about the risks or require informed user consent. In a migration context, this can lead users to approve changes without understanding that scheduled tasks, configurations, or agent behavior may be modified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s top-level description, user-facing prompts, and operational text are entirely in Chinese, indicating the skill is designed to operate in a fixed language. There is no visible option for the user to choose another language or any documented justification for a Chinese-only locale restriction, which matches the language/locale policy violation criteria.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The function is documented as a safe read-only helper, but in reality it executes arbitrary shell commands. This mismatch is security-relevant because misleading documentation encourages unsafe reuse and can cause reviewers or maintainers to trust a dangerous primitive that enables command execution.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 98% confidence
- Finding
The helper run_cmd executes an arbitrary string with shell=True, which allows shell metacharacters, command chaining, and environment expansion. Even if currently described as 'read-only', this primitive becomes dangerous if any package content, user input, or future code path ever reaches it, because it enables command injection and arbitrary command execution.
- Content
python def run_cmd(cmd): """执行命令，返回 (stdout, returncode)。仅用于只读操作。""" result = subprocess.run(cmd, shell=True, capture_output=True, text=True) return result.stdout.strip(), result.returncode # =============================================
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 81% confidence
- Finding
Although this call does not use shell=True, it passes untrusted job definitions from cron_jobs.json directly into the privileged openclaw task-creation interface. In the context of a migration package treated as adversarial, this can install attacker-controlled scheduled tasks that persist and execute later, making the package a vehicle for persistence or unintended automation.
- Content
python job_copy["sessionTarget"] = "isolated" job_json = json.dumps(job_copy, ensure_ascii=False) result = subprocess.run( ["openclaw", "tasks", "add", "--job", job_json], capture_output=True, text=True )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def restart_gateway(): """重启 Gateway（用户已在审查步骤确认）""" info("重启 Gateway...") result = subprocess.run( ["openclaw", "gateway", "restart"], capture_output=True, text=True )
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The human-readable description and note are written only in Chinese, which imposes a specific language on operators reading or maintaining this manifest. There is no indication of user opt-in, alternative locale support, or a documented reason that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script's docstring, console output, and generated README instruct the user entirely in Chinese, including the prescribed invocation phrase for the agent. Because no language choice, opt-in, or justification for the locale restriction is provided, this is a natural-language locale policy violation under the specified rule.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def info(msg): print(f"{BLUE}[i]{NC} {msg}") def run_cmd(cmd): result = subprocess.run(cmd, shell=True, capture_output=True, text=True) return result.stdout.strip(), result.returncode # =============================================
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script automatically discovers the active workspace from user configuration and then packages identity, memory, team, skill, and cron-related data without any consent prompt, preview, or sensitivity review. In this context, those files may contain secrets, internal instructions, personal data, filesystem layout, and operational configuration, so silent bulk export meaningfully increases data-exfiltration risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This block copies core workspace files such as SOUL.md, MEMORY.md, IDENTITY.md, USER.md, and related memory content into an export archive without warning or review. Those files are likely to hold sensitive agent state, user data, and operational context, making unintended disclosure plausible when the archive is shared or handed to another agent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script recursively copies entire skill directories, which can include executable code, prompts, configuration, credentials, and embedded data. Because the copy is broad and silent, it can export far more than a user expects, increasing the chance of leaking sensitive logic or secrets to the destination package.
- Content