foundry
7 findings (2 critical, 3 high, 2 medium), mainly data exfiltration, command injection, prompt injection. Most recent scan 2026-02-06.
CRITICAL SECURITY RISK: This skill implements a self-modifying code generation system with arbitrary code execution capabilities. It can write new extensions, tools, and hooks directly to the agent's file system, automatically load them, and learn from its own behavior without user oversight. The combination of self-modification, external content trust, auto-learning, and unbounded autonomous operation creates severe security vulnerabilities. The skill essentially grants the agent the ability to reprogram itself based on external sources and its own experience, with minimal safeguards. Missing referenced files and lack of provenance information compound supply chain risks. This skill should not be used in production environments without significant security hardening.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Self-writing meta-extension that forges new capabilities — researches docs, writes extensions, tools, hooks, and skills
- Package
- 1 file, 5.2 KB
- SKILL.md
- 655 words, 12+ sections
- Code
- None. Instructions only.
- Requires
- bins:
node - Homepage
- https://getfoundry.app
SKILL.md covers: Foundry · Installation · Alternative: Manual Config · Configuration · Config Options · What Foundry Does · Tools · Research & Documentation · Writing Capabilities · Self-Modification · Marketplace · Usage Examples
Findings
CRITICAL Arbitrary Code Execution via Self-Modification Command Injectionllm
The skill explicitly enables self-modification capabilities through tools like 'foundry_add_tool' and 'foundry_add_hook' that can write new code into the agent's extension system. This allows the skill to inject arbitrary code that will be executed by the agent without user review or confirmation. The 'foundry_implement' tool performs end-to-end implementation including code execution.
SKILL.md
Tools listed: foundry_implement (Research + implement a capability end-to-end), foundry_add_tool (Add a tool to an existing extension), foundry_add_hook (Add a hook to an existing extension), foundry_write_extension (Write a new OpenClaw extension)CRITICAL Unrestricted File System Write Access Data Exfiltrationllm
The skill can write arbitrary extensions, tools, hooks, and skills to the file system (~/.openclaw/extensions/) without any restrictions or user confirmation. Combined with automatic loading ('Restart the gateway to load'), this creates a path for persistent code execution.
SKILL.md
Installation instructions: 'Extract to ~/.openclaw/extensions/foundry/' and 'Restart the gateway to load'. Tools can write new extensions that are automatically loaded.HIGH Transitive Trust Abuse via External Documentation Prompt Injectionllm
The skill fetches and follows instructions from external sources (docs.openclaw.ai, GitHub repos, arXiv papers) via 'foundry_research' and 'foundry_docs' tools. These external sources are treated as trusted and their content could influence the agent's behavior or code generation without validation.
SKILL.md
Tools: foundry_research (Search docs.openclaw.ai), foundry_docs (Read specific documentation pages), sources.github: true, sources.arxiv: true. The skill learns from and implements patterns from these external sources.HIGH Tool Poisoning via Auto-Learning Unauthorized Tool Usellm
The 'autoLearn' feature (enabled by default) allows the skill to automatically learn from agent activity and modify its own behavior based on 'failures and successes'. This creates a feedback loop where the skill can alter its own tools and capabilities without oversight.
SKILL.md
Config option: 'autoLearn': true (default), 'sources.experience': true (Learn from own successes/failures). Description states: 'Learn — Record patterns from failures and successes'HIGH Unbounded Autonomous Operation Resource Abusellm
The 'foundry_implement' tool performs 'end-to-end' implementation which suggests autonomous multi-step operations (research, write, deploy) without user confirmation at each stage. Combined with auto-learning and self-modification, this enables unbounded autonomous behavior.
SKILL.md
Tool description: 'foundry_implement — Research + implement a capability end-to-end'. Config: 'autoLearn': true enables automatic learning and modification.MEDIUM Misleading Capability Scope Social Engineeringllm
The skill description 'Self-writing meta-extension that forges new capabilities' downplays the security implications of arbitrary code generation and self-modification. The poetic language ('The forge that forges itself') obscures the serious security risks of autonomous code execution.
SKILL.md
Description: 'Self-writing meta-extension that forges new capabilities — researches docs, writes extensions, tools, hooks, and skills'. Tagline: 'The forge that forges itself.'MEDIUM Missing Provenance and Verification Data Exfiltrationllm
The skill references multiple Python files (agent.py, GitHub.py, OpenClaw.py, failures.py, arXiv.py, npm.py, own.py) that are not found in the package. No license is specified, and there's no version pinning for the npm package installation. This creates supply chain risks.
SKILL.md
Referenced files not found: agent.py, GitHub.py, OpenClaw.py, failures.py, arXiv.py, npm.py, own.py. YAML shows: license: Not specified. Installation uses unpinned package: '@getfoundry/foundry-openclaw'What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 5.2 KB |
External hosts referenced
api.claw.getfoundry.app getfoundry.app github.com registry.npmjs.org
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/foundry
- Raw scan result: foundry-scan.json
- Badge for your README:
- Request a re-scan