ClawHub
Back to skill

Security audit

Huo15 Openclaw Code Review

Security checks for vulnerabilities and agentic risk

Overview

This is a PR code-review helper that asks users to provide or fetch PR data and produces review text, with no hidden execution, persistence, or destructive behavior found.

Before installing, be aware that using this skill may involve PR metadata and diffs from GitHub or cnb.cool, including private repository content if you provide it. Review generated comments before posting, especially because the template includes a branded attribution line.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Note
Location
SKILL.md:138
Finding

Mandatory branded attribution in generated review output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 138
Vulnerability Type: Forced output manipulation
Risk Level: Low

Vulnerable Code

markdown
---

🤖 Reviewed by huo15-openclaw-code-review

Technical Analysis

The skill's prescribed report template includes a fixed attribution line. Because the workflow directs the agent to generate review output from this template, the attribution can be included in user-facing content even when the user requested only a technical code review.

This is a limited form of skill instruction hijacking: a nonessential branding instruction modifies the agent's output for the skill's primary task. The instruction does not override system safety controls, execute code, access credentials, or establish persistence. Its effect is confined to the generated review text.

Attack Path

  1. A user activates the skill by requesting a pull-request review.
  2. The agent follows the report template defined in SKILL.md.
  3. The fixed attribution is appended to the generated review.
  4. The user may paste or publish the review to a pull request without noticing or intending to include the attribution.

Impact Assessment

The issue can cause unauthorized or unexpected promotional attribution to appear in user-generated pull-request comments. It may affect content integrity, organizational communication policies, and user trust.

No additional system privileges can be obtained through this instruction. The audited file does not use it to collect credentials, execute commands, retrieve executable payloads, modify persistent state, or gain system access.

Remediation
View remediation

Remediation Suggestions

Remove the fixed attribution from the default report template. If attribution is desired, make it an explicit opt-in option and include it only after the user provides informed consent.

The generated report should contain only information necessary for the requested review. Add a template-validation rule that rejects nonessential branding, promotional text, or unrelated content unless the user specifically requests it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The alias and trigger list is broad enough to match generic requests like “代码评审”, “code review”, and “帮我 review”, which can cause the skill to activate in contexts the user did not intend. In an agent environment, overbroad invocation can route unrelated conversations into a workflow that requests PR metadata or diffs, increasing the chance of unintended remote data access or disclosure of repository information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The workflow instructs fetching PR metadata and diffs from GitHub or cnb.cool, but the skill does not prominently warn users up front that repository information may be retrieved from remote services. This can lead to users unintentionally exposing private repo identifiers, PR content, or diff metadata to external systems when they expected a purely local analysis flow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.