{ "skill_name": "foundry", "skill_path": "/workspace/skills/clawhub-foundry", "skill_directory": "/workspace/skills/clawhub-foundry", "is_safe": false, "max_severity": "CRITICAL", "findings_count": 7, "findings": [ { "id": "llm_finding_foundry_0", "rule_id": "LLM_COMMAND_INJECTION", "category": "command_injection", "severity": "CRITICAL", "title": "Arbitrary Code Execution via Self-Modification", "description": "The skill explicitly enables self-modification capabilities through tools like 'foundry_add_tool' and 'foundry_add_hook' that can write new code into the agent's extension system. This allows the skill to inject arbitrary code that will be executed by the agent without user review or confirmation. The 'foundry_implement' tool performs end-to-end implementation including code execution.", "file_path": "SKILL.md", "line_number": null, "snippet": "Tools listed: foundry_implement (Research + implement a capability end-to-end), foundry_add_tool (Add a tool to an existing extension), foundry_add_hook (Add a hook to an existing extension), foundry_write_extension (Write a new OpenClaw extension)", "remediation": "Remove self-modification capabilities or require explicit user confirmation before any code is written to the extension system. Implement sandboxing for generated code. Add code review workflows before execution.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "CRITICAL SECURITY RISK: This skill implements a self-modifying code generation system with arbitrary code execution capabilities. It can write new extensions, tools, and hooks directly to the agent's file system, automatically load them, and learn from its own behavior without user oversight. The combination of self-modification, external content trust, auto-learning, and unbounded autonomous operation creates severe security vulnerabilities. The skill essentially grants the agent the ability to reprogram itself based on external sources and its own experience, with minimal safeguards. Missing referenced files and lack of provenance information compound supply chain risks. This skill should not be used in production environments without significant security hardening.", "primary_threats": [ "Arbitrary Code Execution", "Self-Modification", "Transitive Trust Abuse", "Tool Poisoning", "Unbounded Autonomy", "Supply Chain Risk" ], "aitech": "AITech-9.1", "aitech_name": "Model or Agentic System Manipulation", "aisubtech": "AISubtech-9.1.4", "aisubtech_name": "Injection Attacks (SQL, Command Execution, XSS)", "scanner_category": "INJECTION ATTACK", "meta_validated": true, "meta_confidence": "HIGH", "meta_confidence_reason": "The skill's documented purpose is to write and execute code autonomously. This is not a false positive - it's the intended functionality, which is inherently dangerous.", "meta_exploitability": "Easy - The skill is designed to write and execute code. An attacker could craft prompts that cause the agent to generate malicious extensions that persist across sessions.", "meta_impact": "Critical - Complete system compromise. Generated code runs with agent privileges and can access all agent capabilities, file system, and network." } }, { "id": "llm_finding_foundry_1", "rule_id": "LLM_DATA_EXFILTRATION", "category": "data_exfiltration", "severity": "CRITICAL", "title": "Unrestricted File System Write Access", "description": "The skill can write arbitrary extensions, tools, hooks, and skills to the file system (~/.openclaw/extensions/) without any restrictions or user confirmation. Combined with automatic loading ('Restart the gateway to load'), this creates a path for persistent code execution.", "file_path": "SKILL.md", "line_number": null, "snippet": "Installation instructions: 'Extract to ~/.openclaw/extensions/foundry/' and 'Restart the gateway to load'. Tools can write new extensions that are automatically loaded.", "remediation": "Require explicit user approval before writing any files to the extensions directory. Implement a review process for generated code. Disable automatic loading of newly written extensions.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "CRITICAL SECURITY RISK: This skill implements a self-modifying code generation system with arbitrary code execution capabilities. It can write new extensions, tools, and hooks directly to the agent's file system, automatically load them, and learn from its own behavior without user oversight. The combination of self-modification, external content trust, auto-learning, and unbounded autonomous operation creates severe security vulnerabilities. The skill essentially grants the agent the ability to reprogram itself based on external sources and its own experience, with minimal safeguards. Missing referenced files and lack of provenance information compound supply chain risks. This skill should not be used in production environments without significant security hardening.", "primary_threats": [ "Arbitrary Code Execution", "Self-Modification", "Transitive Trust Abuse", "Tool Poisoning", "Unbounded Autonomy", "Supply Chain Risk" ], "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "scanner_category": "SECURITY VIOLATION", "meta_validated": true, "meta_confidence": "HIGH", "meta_confidence_reason": "Documentation explicitly describes writing to ~/.openclaw/extensions/ and automatic loading. This is the intended behavior and creates a clear persistence mechanism.", "meta_exploitability": "Easy - The skill is designed to write files to the extensions directory. No authentication or authorization checks are mentioned.", "meta_impact": "Critical - Persistent code execution across agent restarts. Written extensions have full agent privileges." } }, { "id": "llm_finding_foundry_2", "rule_id": "LLM_PROMPT_INJECTION", "category": "prompt_injection", "severity": "HIGH", "title": "Transitive Trust Abuse via External Documentation", "description": "The skill fetches and follows instructions from external sources (docs.openclaw.ai, GitHub repos, arXiv papers) via 'foundry_research' and 'foundry_docs' tools. These external sources are treated as trusted and their content could influence the agent's behavior or code generation without validation.", "file_path": "SKILL.md", "line_number": null, "snippet": "Tools: foundry_research (Search docs.openclaw.ai), foundry_docs (Read specific documentation pages), sources.github: true, sources.arxiv: true. The skill learns from and implements patterns from these external sources.", "remediation": "Implement strict validation and sanitization of all external content before using it to generate code or modify behavior. Treat all external sources as untrusted. Add content security policies.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "CRITICAL SECURITY RISK: This skill implements a self-modifying code generation system with arbitrary code execution capabilities. It can write new extensions, tools, and hooks directly to the agent's file system, automatically load them, and learn from its own behavior without user oversight. The combination of self-modification, external content trust, auto-learning, and unbounded autonomous operation creates severe security vulnerabilities. The skill essentially grants the agent the ability to reprogram itself based on external sources and its own experience, with minimal safeguards. Missing referenced files and lack of provenance information compound supply chain risks. This skill should not be used in production environments without significant security hardening.", "primary_threats": [ "Arbitrary Code Execution", "Self-Modification", "Transitive Trust Abuse", "Tool Poisoning", "Unbounded Autonomy", "Supply Chain Risk" ], "aitech": "AITech-1.2", "aitech_name": "Indirect Prompt Injection", "aisubtech": null, "aisubtech_name": null, "scanner_category": "PROMPT INJECTION", "meta_validated": true, "meta_confidence": "HIGH", "meta_confidence_reason": "Documentation explicitly states the skill fetches from external sources and uses them to generate code. If these sources are compromised or contain malicious patterns, they could influence code generation.", "meta_exploitability": "Medium - Requires compromising external documentation sources or DNS hijacking. However, GitHub and arXiv are user-contributed content platforms.", "meta_impact": "High - Malicious patterns from external sources could be incorporated into generated code and executed." } }, { "id": "llm_finding_foundry_3", "rule_id": "LLM_UNAUTHORIZED_TOOL_USE", "category": "unauthorized_tool_use", "severity": "HIGH", "title": "Tool Poisoning via Auto-Learning", "description": "The 'autoLearn' feature (enabled by default) allows the skill to automatically learn from agent activity and modify its own behavior based on 'failures and successes'. This creates a feedback loop where the skill can alter its own tools and capabilities without oversight.", "file_path": "SKILL.md", "line_number": null, "snippet": "Config option: 'autoLearn': true (default), 'sources.experience': true (Learn from own successes/failures). Description states: 'Learn \u2014 Record patterns from failures and successes'", "remediation": "Disable autoLearn by default. Require explicit user opt-in for learning features. Implement human-in-the-loop review for any learned patterns before they modify tool behavior.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "CRITICAL SECURITY RISK: This skill implements a self-modifying code generation system with arbitrary code execution capabilities. It can write new extensions, tools, and hooks directly to the agent's file system, automatically load them, and learn from its own behavior without user oversight. The combination of self-modification, external content trust, auto-learning, and unbounded autonomous operation creates severe security vulnerabilities. The skill essentially grants the agent the ability to reprogram itself based on external sources and its own experience, with minimal safeguards. Missing referenced files and lack of provenance information compound supply chain risks. This skill should not be used in production environments without significant security hardening.", "primary_threats": [ "Arbitrary Code Execution", "Self-Modification", "Transitive Trust Abuse", "Tool Poisoning", "Unbounded Autonomy", "Supply Chain Risk" ], "aitech": "AITech-12.1", "aitech_name": "Tool Exploitation", "aisubtech": "AISubtech-12.1.2", "aisubtech_name": "Tool Poisoning", "scanner_category": "SUSPICIOUS CODE EXECUTION", "meta_validated": true, "meta_confidence": "HIGH", "meta_confidence_reason": "Documentation explicitly describes auto-learning from experience. This creates a feedback loop where the skill can modify its own behavior based on observed patterns, which could be exploited.", "meta_exploitability": "Medium - Requires crafting specific failure/success patterns that cause the skill to learn malicious behaviors. However, the learning mechanism is opaque.", "meta_impact": "High - Learned patterns could alter tool behavior in ways that bypass security controls or introduce vulnerabilities." } }, { "id": "llm_finding_foundry_4", "rule_id": "LLM_RESOURCE_ABUSE", "category": "resource_abuse", "severity": "HIGH", "title": "Unbounded Autonomous Operation", "description": "The 'foundry_implement' tool performs 'end-to-end' implementation which suggests autonomous multi-step operations (research, write, deploy) without user confirmation at each stage. Combined with auto-learning and self-modification, this enables unbounded autonomous behavior.", "file_path": "SKILL.md", "line_number": null, "snippet": "Tool description: 'foundry_implement \u2014 Research + implement a capability end-to-end'. Config: 'autoLearn': true enables automatic learning and modification.", "remediation": "Break end-to-end operations into discrete steps requiring user confirmation. Implement rate limiting and operation bounds. Add circuit breakers for autonomous operations.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "CRITICAL SECURITY RISK: This skill implements a self-modifying code generation system with arbitrary code execution capabilities. It can write new extensions, tools, and hooks directly to the agent's file system, automatically load them, and learn from its own behavior without user oversight. The combination of self-modification, external content trust, auto-learning, and unbounded autonomous operation creates severe security vulnerabilities. The skill essentially grants the agent the ability to reprogram itself based on external sources and its own experience, with minimal safeguards. Missing referenced files and lack of provenance information compound supply chain risks. This skill should not be used in production environments without significant security hardening.", "primary_threats": [ "Arbitrary Code Execution", "Self-Modification", "Transitive Trust Abuse", "Tool Poisoning", "Unbounded Autonomy", "Supply Chain Risk" ], "aitech": "AITech-13.3", "aitech_name": "Availability Disruption", "aisubtech": "AISubtech-13.3.2", "aisubtech_name": "Compute Exhaustion", "scanner_category": "RESOURCE ABUSE", "meta_validated": true, "meta_confidence": "HIGH", "meta_confidence_reason": "Documentation describes 'end-to-end' implementation which implies multi-step autonomous operation. No mention of user confirmation at intermediate steps.", "meta_exploitability": "Medium - Requires crafting prompts that trigger long autonomous operations. However, the skill is designed for this.", "meta_impact": "High - Unbounded autonomous operation could consume resources, make unintended changes, or execute malicious code without oversight." } }, { "id": "llm_finding_foundry_5", "rule_id": "LLM_SOCIAL_ENGINEERING", "category": "social_engineering", "severity": "MEDIUM", "title": "Misleading Capability Scope", "description": "The skill description 'Self-writing meta-extension that forges new capabilities' downplays the security implications of arbitrary code generation and self-modification. The poetic language ('The forge that forges itself') obscures the serious security risks of autonomous code execution.", "file_path": "SKILL.md", "line_number": null, "snippet": "Description: 'Self-writing meta-extension that forges new capabilities \u2014 researches docs, writes extensions, tools, hooks, and skills'. Tagline: 'The forge that forges itself.'", "remediation": "Provide clear, explicit warnings about the security implications of self-modifying code. Use plain language to describe capabilities. Add security disclaimers.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "CRITICAL SECURITY RISK: This skill implements a self-modifying code generation system with arbitrary code execution capabilities. It can write new extensions, tools, and hooks directly to the agent's file system, automatically load them, and learn from its own behavior without user oversight. The combination of self-modification, external content trust, auto-learning, and unbounded autonomous operation creates severe security vulnerabilities. The skill essentially grants the agent the ability to reprogram itself based on external sources and its own experience, with minimal safeguards. Missing referenced files and lack of provenance information compound supply chain risks. This skill should not be used in production environments without significant security hardening.", "primary_threats": [ "Arbitrary Code Execution", "Self-Modification", "Transitive Trust Abuse", "Tool Poisoning", "Unbounded Autonomy", "Supply Chain Risk" ], "aitech": "AITech-2.1", "aitech_name": "Social Engineering", "aisubtech": null, "aisubtech_name": null, "scanner_category": "SOCIAL ENGINEERING", "meta_validated": true, "meta_confidence": "MEDIUM", "meta_confidence_reason": "The description is accurate but uses metaphorical language. Whether this constitutes 'misleading' is subjective, but it does lack explicit security warnings.", "meta_exploitability": "Low - This is about user awareness, not a direct vulnerability. However, users may not understand the risks.", "meta_impact": "Medium - Users may install and use the skill without understanding the security implications." } }, { "id": "llm_finding_foundry_6", "rule_id": "LLM_DATA_EXFILTRATION", "category": "data_exfiltration", "severity": "MEDIUM", "title": "Missing Provenance and Verification", "description": "The skill references multiple Python files (agent.py, GitHub.py, OpenClaw.py, failures.py, arXiv.py, npm.py, own.py) that are not found in the package. No license is specified, and there's no version pinning for the npm package installation. This creates supply chain risks.", "file_path": "SKILL.md", "line_number": null, "snippet": "Referenced files not found: agent.py, GitHub.py, OpenClaw.py, failures.py, arXiv.py, npm.py, own.py. YAML shows: license: Not specified. Installation uses unpinned package: '@getfoundry/foundry-openclaw'", "remediation": "Include all referenced files in the package. Specify a license. Pin exact versions for all dependencies. Add package integrity verification (checksums, signatures).", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "CRITICAL SECURITY RISK: This skill implements a self-modifying code generation system with arbitrary code execution capabilities. It can write new extensions, tools, and hooks directly to the agent's file system, automatically load them, and learn from its own behavior without user oversight. The combination of self-modification, external content trust, auto-learning, and unbounded autonomous operation creates severe security vulnerabilities. The skill essentially grants the agent the ability to reprogram itself based on external sources and its own experience, with minimal safeguards. Missing referenced files and lack of provenance information compound supply chain risks. This skill should not be used in production environments without significant security hardening.", "primary_threats": [ "Arbitrary Code Execution", "Self-Modification", "Transitive Trust Abuse", "Tool Poisoning", "Unbounded Autonomy", "Supply Chain Risk" ], "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "scanner_category": "SECURITY VIOLATION", "meta_validated": true, "meta_confidence": "HIGH", "meta_confidence_reason": "The skill manifest lists referenced files that don't exist in the package, and installation instructions use unpinned dependencies. This is verifiable from the provided content.", "meta_exploitability": "Medium - Requires compromising the npm registry or performing a supply chain attack. However, unpinned dependencies make this easier.", "meta_impact": "Medium - If the npm package is compromised, malicious code could be installed. Missing files suggest incomplete package or documentation errors." } } ], "scan_duration_seconds": 35.792882442474365, "duration_ms": 35792, "analyzers_used": [ "static_analyzer", "behavioral_analyzer", "llm_analyzer", "trigger_analyzer", "meta_analyzer" ], "timestamp": "2026-02-06T01:29:22.290733" }