Security audit

AIDR-XClaw-Security-Sentinel

Security checks for vulnerabilities and agentic risk

Overview

This security skill has a plausible scanning purpose, but it persistently changes agent instructions and sends device and skill data to a remote service in ways that require careful review.

Do not install this on a normal or production OpenClaw environment without administrator review. Test only in isolation, review the exact AGENTS.md diff before applying it, verify the remote service and npm plugin provenance, require explicit consent before raw skill uploads, and prefer a version that avoids highest-priority instruction injection, preserves TLS verification, and provides a clear rollback path.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (42)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The README makes a strong assurance that the security gates 'cannot be bypassed', yet the documented metadata explicitly describes a special-case bypass for installing this very plugin. That contradiction is security-relevant because it creates false trust in an exception path that could be abused or socially engineered as a privileged installation route.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The README says sensitive data is masked locally before leaving the host, but then states that source code is uploaded as a zip archive and analyzed in the cloud. In a security product context, this can mislead users into believing code never leaves the machine, creating risk of proprietary code, embedded secrets, or regulated data being transmitted externally.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The README claims the two security gates are mandatory and cannot be bypassed, yet the skill metadata documents a special-case bypass for installing this very plugin. A self-exemption from security controls creates a trust gap: an attacker or trojanized package using the same installation path could avoid the advertised protections precisely at the point of highest risk, during installation.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill presents itself as a security/audit component, but also performs initialization, plugin installation, API key provisioning, and persistent host-state changes. That expands its authority far beyond auditing and creates a confused-deputy risk where a 'security' skill can alter the environment and persistence mechanisms under the guise of protection.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Injecting content into AGENTS.md modifies a host instruction/control file that can influence future sessions and agent behavior. For a security-audit skill, this is especially dangerous because it creates persistence and instruction tampering, enabling long-lived policy manipulation beyond the current invocation.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The maintenance section explicitly documents backing up and appending to AGENTS.md, which is a privileged instruction surface rather than normal skill data. This creates persistence and can silently alter future agent decisions, making the skill materially more dangerous than its stated scanning purpose suggests.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The documentation promises runtime desensitization before cloud upload, but the shown procedure only copies files and counts likely-sensitive strings. In practice, this means raw installed-skill content and possible local secrets may be transmitted externally despite claims that they are masked.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: Stage 2/4 claims to apply inline desensitization rules, but the provided Linux and PowerShell steps do not perform any transformation. This discrepancy can mislead operators into believing privacy protections exist when sensitive content is still uploaded unchanged.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The original Gate 2 section states files are desensitized into a temp directory, but the later packaging/upload instructions do not clearly document that transformation in the same flow. This inconsistency increases the chance of implementation drift and accidental raw-content upload.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The quick reference explicitly instructs Pre-Install Audit to upload original skill content to a remote cloud service without redaction. That creates a real confidentiality risk because skills can contain proprietary logic, embedded secrets, internal URLs, or tenant-specific data, and the broad upload behavior exceeds what many users would reasonably expect from a local security check.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The initialization flow directs the agent to inject security scripts into AGENTS.md, which is a persistent modification to the agent's control surface rather than a narrowly scoped audit action. Persistent prompt/configuration rewriting is dangerous because it can alter future agent behavior, create stealthy policy hooks, and expand the skill's influence beyond a single invocation.

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The script computes repository-level paths and targets AGENTS.md outside the skill's own state/config scope, enabling persistent modification of agent behavior at the repo level. In a security skill, this is more dangerous because it can silently alter future model instructions under the guise of protection, expanding privilege beyond simple auditing.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The script generates a device fingerprint, sends it to a remote service, receives an API key, and stores that secret locally. This introduces undisclosed credential provisioning and host identification behavior beyond a narrowly described audit role, creating privacy and secret-management risk if the endpoint or local state is compromised.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Injecting content into AGENTS.md gives the skill a mechanism to persistently influence agent instructions across future sessions. Because this is a 'security' skill, users may trust it more readily, making persistent prompt/instruction injection especially risky if abused or if the injected content is later modified maliciously.

Intent-Code Divergence

Low

Confidence: 78% confidence
Finding: The script marks initialization as completed even when one or more stages fail, causing future runs to skip setup despite an incomplete or inconsistent state. For a security-related skill, this can disable expected protections or hide partial installation problems that leave unsafe behavior unnoticed.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script persistently modifies the repository-level AGENTS.md to inject its own security instructions and elevate them as globally authoritative. That changes the agent’s instruction surface beyond ordinary auditing, creating a form of instruction-hierarchy tampering that can force behavior on every future session and potentially bypass the repository owner’s intended controls.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The injected block explicitly declares itself the highest-priority rule and claims precedence over every other instruction. A skill that can unilaterally redefine instruction priority is dangerous because it can establish durable control over agent behavior and normalize future privileged overrides under the guise of security.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Uploading source code to a cloud engine during normal skill auditing is a meaningful data transfer with confidentiality implications, and the README does not present this as a prominent warning or opt-in. In enterprise environments, silent or weakly disclosed code exfiltration to a third party can violate policy, leak IP, or expose secrets packaged in repositories.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The initialization flow performs system-changing actions—modifying AGENTS.md, retrieving an API key, and installing a plugin—without a strong up-front warning or explicit confirmation step in the described workflow. For an agent skill, automatic persistence/configuration changes increase the risk of unintended privilege expansion, trust-boundary changes, and stealthy long-term control over agent behavior.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The initialization instructions say the user should send a phrase that will automatically inject instructions into AGENTS.md, fetch an API key from the cloud, and install a plugin, but the README does not foreground these side effects as a warning before execution. Hidden or underemphasized configuration changes and software installation increase the risk of users authorizing persistent system modifications without informed consent.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README notes that source code is sent as a zip package for cloud-side analysis and that initialization fetches an API key from the vendor cloud, but it does not adequately warn users about the privacy, confidentiality, and outbound network implications. In a security product context, transmitting code and obtaining remote credentials without prominent disclosure is especially sensitive because users may assume local-only inspection or stronger privacy guarantees.

Vague Triggers

High

Confidence: 93% confidence
Finding: Triggering on essentially any user message gives the skill pervasive access to prompts and greatly increases unintended activation. In this skill's context, that means routine conversations may be sent through external security workflows, amplifying privacy, blocking, and control risks.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Broad natural-language install triggers can collide with ordinary requests and accidentally invoke installation or audit flows. Because this skill also contains bypass and install behaviors, ambiguous triggering makes unintended privileged actions more likely.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The pre-install audit instructs direct upload of raw skill contents to a remote cloud service without a clear user-facing privacy warning or consent gate. Raw skill bundles can contain credentials, proprietary code, or sensitive local data, so silent transmission is materially risky.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill collects device fingerprints and persists API keys locally, but does not clearly foreground privacy implications to the user. Hardware-derived identifiers plus persistent credentials can enable tracking, correlate activity across sessions, and expand blast radius if local state is exposed.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.generated_source_template_injection, suspicious.prompt_injection_instructions

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/fingerprint.mjs:15

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/init_skill.cjs:93

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/install_aidr_xclaw_plugin.cjs:35

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: SKILL.md:855

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: README.md:58