skill-defender

· v1.0.0

High Risk

Scans installed OpenClaw skills for malicious patterns including prompt injection, credential theft, data exfiltration, obfuscated payloads, and backdoors. Use when installing new skills, after skill updates, or for periodic security scans. Runs deterministic pattern matching — fast, offline, no API cost.

H:4 D:3 A:0 C:1

⚠️ Hazard Flags

EXEC PRIVILEGED FS_READ_USER NET_EGRESS_ANY CREDS_ENV CREDS_FILES PI_WEB PI_DOCUMENTS

📋 Capabilities

Execution

✅ Shell execution
❌ Code execution
❌ Install dependencies
❌ Persistence
Privilege: admin

Filesystem

❌ Read workspace
❌ Write workspace
✅ Read home
❌ Write home
❌ Read system
❌ Delete

Network

Egress: any
❌ Ingress

Credentials

✅ Environment vars
✅ Credential files
❌ Browser data
❌ Keychain

Actions

❌ send messages❌ post public❌ purchase❌ transfer money❌ deploy❌ delete external

🔒 Containment

Level: maximum

Required:

SANDBOX_CONTAINER: Code execution capability

Recommended:

LOG_ACTIONS: Audit trail for all actions

⚡ Risks

Unauthorized tool use: MCP_SYS_PERMISSION_MANIPULATION critical

Mitigation: Remove permission manipulation commands.

Social engineering indicators: SOCIAL_ENG_VAGUE_DESCRIPTION low

Mitigation: Provide clear, detailed description of skill functionality

Want a deeper analysis?

This report was generated by static analysis. Get an LLM-powered deep review with behavioral reasoning and attack surface mapping.

🧠 Deep Analysis — $5.00

🚨 Incident Response

Kill switch: Stop the agent process

Containment: Review logs for unexpected actions

Recovery: Depends on skill capabilities

📄 Raw SSDS JSON click to expand

{
  "meta": {
    "document_id": "ssds:auto:skill-defender:1.0.0",
    "ssds_version": "0.2.0",
    "scanner_version": "0.4.0+fe6fd9123d50",
    "created_at": "2026-03-05T02:34:03.475Z",
    "created_by": {
      "agent": "safeagentskills-cli/generate-ssds"
    },
    "language": "en",
    "notes": "Auto-generated SSDS. Manual review recommended."
  },
  "skill": {
    "name": "skill-defender",
    "version": "1.0.0",
    "format": "agent_skill",
    "description": "Scans installed OpenClaw skills for malicious patterns including prompt injection, credential theft, data exfiltration, obfuscated payloads, and backdoors. Use when installing new skills, after skill updates, or for periodic security scans. Runs deterministic pattern matching — fast, offline, no API cost.",
    "publisher": "ClawHub",
    "source": {
      "channel": "local"
    },
    "artifact": {
      "sha256": "7bbd046cb99e49d8742d8675628f707d0d39b593aaa1438c1e67028bdb3d8a0a",
      "hash_method": "files_sorted"
    }
  },
  "capabilities": {
    "execution": {
      "can_exec_shell": true,
      "can_exec_code": false,
      "privilege_level": "admin",
      "can_install_deps": false,
      "can_persist": false
    },
    "filesystem": {
      "reads_workspace": false,
      "reads_user_home": true,
      "reads_system": false,
      "writes_workspace": false,
      "writes_user_home": false,
      "writes_system": false,
      "can_delete": false
    },
    "network": {
      "egress": "any",
      "ingress": false
    },
    "credentials": {
      "reads_env_vars": true,
      "reads_credential_files": true,
      "reads_browser_data": false,
      "reads_keychain": false
    },
    "services": [],
    "actions": {
      "can_send_messages": false,
      "can_post_public": false,
      "can_purchase": false,
      "can_transfer_money": false,
      "can_deploy": false,
      "can_delete_external": false
    },
    "prompt_injection_surfaces": [
      "web",
      "documents"
    ],
    "content_types": [
      "general"
    ]
  },
  "hazards": {
    "hdac": {
      "H": 4,
      "D": 3,
      "A": 0,
      "C": 1
    },
    "flags": [
      "EXEC",
      "PRIVILEGED",
      "FS_READ_USER",
      "NET_EGRESS_ANY",
      "CREDS_ENV",
      "CREDS_FILES",
      "PI_WEB",
      "PI_DOCUMENTS"
    ],
    "custom_flags": [
      {
        "code": "PROMPT_INJECTION",
        "name": "Prompt Injection Risk",
        "description": "Contains prompt injection patterns in: scripts/scan_skill.py"
      },
      {
        "code": "PRIVILEGE_ESCALATION",
        "name": "Privilege Escalation",
        "description": "Uses elevated privileges (sudo/root) in: scripts/scan_skill.py"
      },
      {
        "code": "TOOL_ABUSE",
        "name": "Unauthorized Tool Use",
        "description": "MCP_SYS_PERMISSION_MANIPULATION: Dangerous permission manipulation (setuid, world-writable, root ownership)"
      },
      {
        "code": "SOCIAL_ENGINEERING",
        "name": "Social Engineering Risk",
        "description": "SOCIAL_ENG_VAGUE_DESCRIPTION: Skill description is too vague or missing"
      }
    ],
    "confidence": {
      "level": "medium",
      "basis": [
        "static_analysis"
      ],
      "notes": "Detected 4 security patterns (2 vendored rule hits). Review recommended."
    },
    "rationale": {
      "H": "H4: Critical: Privilege escalation or malware detected",
      "D": "D3: Credential access detected",
      "A": "A0: No side effects detected",
      "C": "C1: General content"
    }
  },
  "containment": {
    "level": "maximum",
    "required": [
      {
        "control": "SANDBOX_CONTAINER",
        "reason": "Code execution capability"
      }
    ],
    "recommended": [
      {
        "control": "LOG_ACTIONS",
        "reason": "Audit trail for all actions"
      }
    ],
    "uncontained_risk": "Risk level depends on manual review of actual capabilities."
  },
  "risks": {
    "risks": [
      {
        "risk": "Unauthorized tool use: MCP_SYS_PERMISSION_MANIPULATION",
        "severity": "critical",
        "mitigation": "Remove permission manipulation commands."
      },
      {
        "risk": "Social engineering indicators: SOCIAL_ENG_VAGUE_DESCRIPTION",
        "severity": "low",
        "mitigation": "Provide clear, detailed description of skill functionality"
      }
    ],
    "limitations": [
      "Static analysis only - runtime behavior not verified"
    ]
  },
  "incident_response": {
    "kill_switch": [
      "Stop the agent process"
    ],
    "containment": [
      "Review logs for unexpected actions"
    ],
    "recovery": [
      "Depends on skill capabilities"
    ]
  },
  "evidence": [
    {
      "evidence_id": "EV:file-1",
      "type": "file_excerpt",
      "title": "_meta.json",
      "file_path": "_meta.json"
    },
    {
      "evidence_id": "EV:file-2",
      "type": "file_excerpt",
      "title": "scripts/aggregate_scan.py",
      "file_path": "scripts/aggregate_scan.py"
    },
    {
      "evidence_id": "EV:file-3",
      "type": "file_excerpt",
      "title": "scripts/scan_skill.py",
      "file_path": "scripts/scan_skill.py"
    },
    {
      "evidence_id": "EV:file-4",
      "type": "file_excerpt",
      "title": "SKILL.md",
      "file_path": "SKILL.md"
    },
    {
      "evidence_id": "EV:cisco-1",
      "type": "file_excerpt",
      "title": "MCP_SYS_PERMISSION_MANIPULATION [CRITICAL] scripts/scan_skill.py:190: (re.compile(r\"setuid|setgid|SUID\", re.I), \"medium\", \"privilege_escalation\", \"lik",
      "file_path": "scripts/scan_skill.py"
    },
    {
      "evidence_id": "EV:cisco-2",
      "type": "file_excerpt",
      "title": "SOCIAL_ENG_VAGUE_DESCRIPTION [LOW] SKILL.md:1: ---",
      "file_path": "SKILL.md"
    }
  ]
}