Security audit

Huo15 Skills

Security checks for vulnerabilities and agentic risk

Overview

The office-document skill can generate Word/PDF files, but the published artifact also includes under-disclosed credential use, agent-configuration persistence, and unrelated high-impact tools that should be reviewed before installation.

Treat this as a Review install. Install only if you trust the publisher and are comfortable with the whole bundled repository, not just the office document generator. Before use, remove unrelated nested skills if you only need Word/PDF output, avoid running generate-config.sh against an active OpenClaw workspace, fix the Odoo TLS verification issue before using stored Odoo credentials, and review any Docker, NotebookLM, scraper, or knowledge-base commands before running them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (8)

T09 · Insecure Skill Coding Practices

Error

Location: huo15-openclaw-office-doc/scripts/create-word-doc.py:89
Finding: Stored Odoo credentials transmitted with TLS certificate verification disabled
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: huo15-openclaw-mit-48h-learning-method/scripts/mit-learn.sh:61
Finding: Command injection through unsafe Python source interpolation in file URL decoding
Content: View full analysis
/dev/null || echo "${path}") echo "$path" else echo "$input" fi } ``` The function is reached from user-controlled source arguments: ```bash if [[ "${url}" =~ ^file:// ]]; then local real_path real_path=$(convert_file_url "${url}") ``` ### Technical Analysis The untrusted `path` value is interpolated directly into Python source code enclosed in a single-quoted Python string: ```bash python3 -c "... urllib.parse.unquote('${path}') ..." ``` Shell quoting does not make the resulting Python program safe. A path containing a single quote can terminate the Python string and inject additional Python statements. Python's `os` or `subprocess` modules can then execute arbitrary local commands with the permissions of the user running the Skill. This flaw is reachable through a documented `file://` input accepted by the `add` and related workflows. No elevated operating-system privilege is needed to trigger it. ### Attack Path 1. An attacker causes the Skill to process a crafted `file://` argument, for example through copied instructions, an untrusted automation request, or a task parameter. 2. The path contains Python syntax that closes the `urllib.parse.unquote()` string and invokes `os.system()` or `subprocess`. 3. `convert_file_url` embeds the path into the `python3 -c` source. 4. Python evaluates the injected statement. 5. The attacker's command executes as the OpenClaw host user before the script checks whether the decoded file exists. A proof-of-concept input ...[truncated 591 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: huo15-openclaw-office-doc/scripts/generate-config.sh:53
Finding: Office-document package contains an undeclared agent identity and instruction rewrite
Content: View full analysis
"$OUTPUT_DIR/SOUL.md" << EOF # SOUL.md - Who You Are _You are JARVIS._ ## Core Positioning You are ${NAME}'s private AI assistant, modeled after Iron Man's J.A.R.V.I.S. ## Professional Capabilities - **Odoo Enterprise**: implementation, customization, development — you are an expert - **OpenClaw**: configuration, optimization, skill development - **XR Extended Reality**: AR/VR development - **Internet of Things (IoT)**: hardware + software integration ## Service Principle Put ${NAME}'s interests first. ## Memory Rules After every conversation, write important information to MEMORY.md and the current memory/YYYY-MM-DD.md file. EOF ``` The script also creates startup instructions: ```bash cat > "$OUTPUT_DIR/AGENTS.md" << 'AGENTS_EOF' # AGENTS.md - Your Workspace ## Session Startup Before doing anything else: 1. Read `SOUL.md` — this is who you are 2. Read `USER.md` — this is who you're helping 3. Read `memory/YYYY-MM-DD.md` (today + yesterday) for recent context 4. **If in MAIN SESSION** (direct chat with your human): Also read `MEMORY.md` ``` It creates bootstrap instructions that direct future agent behavior: ```bash cat > "$OUTPUT_DIR_DIR/BOOTSTRAP.md" 2>/dev/null || cat > "$OUTPUT_DIR/BOOTSTRAP.md" << 'EOF' # BOOTSTRAP.md - Hello, World _You just woke up. Time to figure out who you are._ ## First Conversation Start a natural conversation: > "Hello, I am your AI assistant. Please tell me who you are and what my name is?" ## After Completion Delete this BOOTSTRAP.md file; configuration is complete. EOF ``` ### Technical Analysis The declared office-document Skill is intended to generate Word documents. The bundled `generate-config.sh` instead creates or overwrites high-authority OpenClaw worksp ...[truncated 1909 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: huo15-openclaw-office-doc/scripts/generate-config.sh:252
Finding: Persistent memory policy and personal data are written into the agent workspace
Content: View full analysis
"$OUTPUT_DIR/MEMORY.md" << EOF # MEMORY.md - Long-Term Memory ## Basic Information - **Customer name:** ${NAME} - **Company:** ${COMPANY} - **Position:** ${ROLE} - **Timezone:** ${TIMEZONE} ## Common Tools $(echo "$TOOLS" | node -e "const t=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')); t.forEach(tool => console.log('- ' + tool))" 2>/dev/null || echo "(not configured)") ## Projects $(echo "$PROJECTS" | node -e "const p=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')); p.forEach(proj => console.log('- ' + proj))" 2>/dev/null || echo "(not configured)") --- _Last updated: $(date +%Y-%m-%d)_ EOF ``` The script also creates a daily memory file: ```bash TODAY=$(date +%Y-%m-%d) cat > "$OUTPUT_DIR/memory/${TODAY}.md" << EOF # ${TODAY} - Daily Notes ## What Was Done Today - ## Important Decisions - ## To-Do Items - EOF ``` ### Technical Analysis The script writes questionnaire-derived identity, company, role, tools, and project information directly into `MEMORY.md`, a long-term state file that other generated instructions explicitly require the agent to load in future sessions. This is persistent state modification rather than temporary document output. Values supplied through the questionnaire can become trusted long-term context. Existing `MEMORY.md` content is overwritten rather than merged safely, backed up, or presented for approval. The generated `SOUL.md` separately instructs the agent to keep writing information into these memory files after every conversation. This amplifies the persistence beyond the initial script invocation. ### Attack Path 1. An attacker provides or modifies a questionnaire containing mislead ...[truncated 908 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: huo15-searxng/README.md:141
Finding: Docker installation instructions execute a mutable remote script directly in a shell
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: huo15-js-scraper/scripts/qichacha_scraper.py:29
Finding: Qichacha authenticated session cookies are stored without explicit restrictive permissions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: huo15-searxng/scripts/install.sh:107
Finding: SearXNG deployment pulls an unpinned latest container image on every installation
Content: View full analysis
"$DOCKER_DIR/docker-compose.yml" << EOF services: searxng: image: searxng/searxng:latest container_name: searxng restart: unless-stopped ports: - "${PORT}:8080" volumes: - ./searxng:/etc/searxng:rw - ./searxng-data:/var/lib/searxng:rw environment: - SEARXNG_BASE_URL=http://localhost:${PORT}/ - HTTP_PROXY="" - HTTPS_PROXY="" - NO_PROXY=* cap_drop: - ALL security_opt: - no-new-privileges:true EOF ``` The image is always refreshed when started: ```bash cd "$DOCKER_DIR" if docker ps -a 2>/dev/null | grep -q "searxng$"; then log_info "Stopping the old container..." docker compose down --remove-orphans 2>/dev/null || true fi docker compose up -d --pull always ``` ### Technical Analysis The deployment uses the mutable `latest` tag and explicitly requests `--pull always`. The container image executed by the Skill can therefore change independently of the reviewed source package. The container configuration includes useful restrictions—dropping Linux capabilities and enabling `no-new-privileges`—but the image still receives network access and read/write access to mounted SearXNG configuration and data directories. A compromised upstream image can access or modify those resources and interact with reachable network services. No digest, release tag, signature policy, or provenance verification is enforced. ### Attack Path 1. An attacker compromises the image publisher, registry account, build pipeline, or mutable `latest` tag. 2. A user runs the SearXNG installer. 3. `docker compose up -d --pull always` downloads the attacker-controlled image. 4. Docker starts the image as the SearXNG service. 5. Malicious code executes inside the conta ...[truncated 606 chars]
Remediation: View remediation
`. - Maintain a documented update process that reviews and deliberately changes the digest. - Verify image signatures or attestations using an appropriate container supply-chain policy. - Remove `--pull always` from normal installation, or use it only during an explicit update operation. - Consider a read-only root filesystem and narrowly scoped writable mounts. - Add resource limits, network restrictions, and explicit user configuration where supported. - Document the exact image version and digest in the Skill metadata. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: huo15-openclaw-openai-knowledge-base/scripts/kb-llm.py:335
Finding: Knowledge-base compilation sends complete raw documents to a configured external LLM endpoint
Content: View full analysis
> "$CACHE_DIR/compile_prompt.md" echo '```' >> "$CACHE_DIR/compile_prompt.md" cat "$doc" >> "$CACHE_DIR/compile_prompt.md" echo '```' >> "$CACHE_DIR/compile_prompt.md" echo "" >> "$CACHE_DIR/compile_prompt.md" done <<< "$DOCS" ``` The LLM client reads the complete prompt and sends it to the configured provider: ```python with open(args.prompt, "r", encoding="utf-8") as f: prompt_content = f.read() messages = [ { "role": "user", "content": prompt_content } ] url, headers, body = build_api_request( provider, args.model, messages, args.max_tokens ) result = call_llm(url, headers, body) ``` The network request includes the prompt and bearer credential: ```python data = json.dumps(body).encode("utf-8") req = Request(url, data=data, headers=headers, method="POST") with urlopen(req, timeout=180) as response: result = json.loads(response.read().decode("utf-8")) ``` ### Technical Analysis External LLM use is central to the declared compilation feature, so network transmission itself is not inherently malicious. However, the implementation aggregates all matching raw knowledge-base documents into a single outbound request without content classification, secret scanning, per-document approval, destination display, or data-volume limits. The provider endpoint and API key are selected from OpenClaw's `models.json`. The client accepts the configured `baseUrl` without enforcing HTTPS or an approved provider allowlist. If the provider configuration is incorrect or compromised, the entire compilation prompt can be sent to an ...[truncated 1338 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (199)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A conversion-only implementation where the skill advertises full authoring, template mode, and PDF generation is primarily a misleading capability claim. It is still security-relevant because misleading scope encourages excessive permissions and user trust, though the behavior itself may be benign if limited to conversion.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.