ClawHub
Back to skill

Security audit

Update Scout

Security checks for vulnerabilities and agentic risk

Overview

Scout is mainly a disclosed update advisor, but it needs review because it can run configured local commands, inspect installed skills, and unnecessarily attach a GitHub token to a remote reference fetch.

Review this before installing. Use only trusted watchlist entries, because command detectors run local programs. Avoid running the skill health review over private or sensitive skill directories unless you intend to expose their structure and SKILL.md contents to the report. Prefer an unset or fine-grained GitHub token, and treat fetched best-practices content as untrusted reference text rather than instructions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/review_skills.py:44
Finding

GitHub Token Sent Unnecessarily to a Public Raw-Content Endpoint

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
scripts/review_skills.py:33
Finding

Mutable Remote Instructions Are Placed in Agent-Consumable Output Without Integrity Controls

Content
View full analysis
Remediation
View remediation
/skills/skill-creator/SKILL.md ``` - Verify the downloaded content against a hardcoded, reviewed SHA-256 digest before including or processing it. - Prefer extracting a small, strictly defined set of structured rules rather than returning the entire remote Markdown document. - Mark the field explicitly as untrusted reference data and instruct downstream consumers never to treat its contents as system or developer instructions. - Escape or isolate the content from the Agent instruction channel. If possible, present only derived factual metadata instead of raw text. - Consider removing `best_practices_content` from JSON output entirely, because the current structural checks do not use it. - Fail closed when integrity validation fails, and report that the external reference is unavailable rather than exposing unverified content. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

This mismatch is more severe because the detected behavior appears to inspect local skill directories and fetch unrelated best-practices content instead of performing the promised software-release monitoring workflow. A skill presented as an update advisor but capable of scanning local content and reaching out to external URLs can cause users to authorize unexpected data access under false pretenses.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This mismatch is more severe because the detected behavior appears to inspect local skill directories and fetch unrelated best-practices content instead of performing the promised software-release monitoring workflow. A skill presented as an update advisor but capable of scanning local content and reaching out to external URLs can cause users to authorize unexpected data access under false pretenses.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The watchlist design allows arbitrary local commands to be executed for version detection, giving a configuration file the ability to run code on the host. In a skill whose purpose is update monitoring, this is broader than necessary and becomes especially dangerous if an agent, plugin, or attacker can modify the watchlist or supply tool entries.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documentation invokes local scripts, reads and writes files under the user's home directory, uses shell commands, and appears to perform network-backed GitHub checks, but the manifest declares no explicit tool scope or permissions. In an agent environment, missing scope boundaries increases the chance that the skill can access or modify resources beyond what a user expects, especially since it also includes post-approval installation and service actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The top-level description says the skill never installs anything without explicit approval and frames it as recommendation-oriented, but the workflow also includes installation, config validation, service restarts, and health changes after approval. Even with approval, combining advisory and operational behaviors in one skill raises the risk of users granting broader execution than intended and blurs the trust boundary between analysis and system modification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest frames the skill as tracking releases, reviewing notes, and posting recommendations before approval, which implies primarily read-oriented monitoring behavior. This file goes beyond passive checking by creating directories and writing a config file on first run, which is a meaningful side effect not reflected in the manifest description.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The command used for version detection comes from the watchlist config and may be supplied as an arbitrary string or argv list, then executed locally with subprocess.run. Although shell=True is not used, this still permits arbitrary program execution on the host if the config is malicious or tampered with, which exceeds the minimally necessary behavior for an update-checking skill.

Content

Scanner excerpt · scripts/check_updates.py (reported line 76)May include surrounding context.

python
if not cmd:
        return None
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        output = (result.stdout + result.stderr).strip()
        match = re.search(r'\b(\d+\.\d+[\.\d-]*)\b', output)
        # Return match or None — never return garbage like the first word

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The manifest focuses on checking for available updates and reviewing release information, especially for GitHub-released tools. Querying local npm and pip installations via subprocesses expands the skill into package-manager-specific host inspection, which is not clearly stated in the description.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_updates.py (reported line 89)May include surrounding context.

python
def detect_version_npm(package: str) -> Optional[str]:
    try:
        result = subprocess.run(
            ["npm", "list", "-g", "--depth=0", package],
            capture_output=True, text=True, timeout=10
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_updates.py (reported line 101)May include surrounding context.

python
def detect_version_pip(package: str) -> Optional[str]:
    try:
        result = subprocess.run(
            ["pip", "show", package],
            capture_output=True, text=True, timeout=10
        )

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This script introduces a local skill-auditing capability that scans installed skills and reports on their contents, which is outside the declared update-tracking and release-review purpose of the scout skill. Even though it does not execute inspected files, the added local inspection surface can expose metadata and file structure from arbitrary skill directories and expands the skill's authority beyond user expectations.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/review_skills.py (reported line 35)May include surrounding context.

python
# Optional: fetch latest skill-creator SKILL.md for context when presenting findings
SKILL_CREATOR_RAW_URL = (
    "https://raw.githubusercontent.com/openclaw/openclaw/main/"
    "skills/skill-creator/SKILL.md"
)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code enumerates and recursively inspects arbitrary local skill directories via a user-supplied --skills-dir and rglob/iterdir logic, which is not justified by the advertised release-monitoring functionality. This creates an unintended local discovery capability that can inventory installed skills and associated documentation, potentially revealing sensitive workspace structure or enabling broader reconnaissance by the agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code reads the GITHUB_TOKEN environment variable and, when present, attaches it as a Bearer token to outbound HTTP requests. Although the function docstring notes authenticated requests, there is no user-facing warning, confirmation, or logging that credentials may be sent over the network.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/check_updates.py (reported line 139)May include surrounding context.

python
"per_page": 30,
        "labels": labels,
    })
    url = f"https://api.github.com/repos/{repo}/issues?{params}"
    try:
        return github_request(url)
    except urllib.error.HTTPError as e:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/verify_release.py (reported line 43)May include surrounding context.

python
"per_page": 30,
        "labels": labels,
    })
    url = f"https://api.github.com/repos/{repo}/issues?{params}"
    try:
        return github_request(url)
    except urllib.error.HTTPError as e:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/verify_release.py (reported line 62)May include surrounding context.

python
"per_page": 30,
        "labels": labels,
    })
    url = f"https://api.github.com/repos/{repo}/issues?{params}"
    try:
        return github_request(url)
    except urllib.error.HTTPError as e:

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The stated purpose is software update tracking, release-note review, and regression checking for watched tools. The "Skill Health Review" section introduces a different function: reviewing skills against OpenClaw best practices. That is a distinct auditing capability not reflected in the manifest description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.