Skill Trust Decision
agent-guardian
A legitimate AI assistant monitoring skill with undeclared privileged operations and dependency installations, but no evidence of malicious behavior.
Why this conclusion was reached
1/4 dimensions flagged Block
Declared vs actual capability
2 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
2 lower-risk artifacts were extracted and still need context.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Review
Dependencies and supply chain hygiene
2 dependency or supply-chain issues need attention.
What drove the risk score up
Undeclared privilege escalation +10
SKILL.md does not document that install.sh modifies system crontab, creates systemd services running as root, and installs packages via pip/apt
Unpinned package dependencies +5
pip3 install langdetect and apt-get install inotify-tools without version pinning could lead to unexpected behavior
Silent package installation +5
install.sh installs packages silently (2>/dev/null) without informing the user
apply-qqbot-patch.sh modifies bot source code +5
The patch script injects execSync calls and custom code blocks into gateway.ts/outbound.ts without prominent disclosure
Most important evidence
Medium Priv Escalation
Undeclared root-level system modifications
install.sh creates a systemd service running as User=root, modifies system crontab, and installs system packages without declaring these capabilities in SKILL.md
scripts/install.sh:67 Document all system-level modifications (crontab, systemd, apt/pip installs) in SKILL.md. Consider running the daemon as a non-root user.
Medium Doc Mismatch
Plugin source code modification not documented in SKILL.md
apply-qqbot-patch.sh injects custom code blocks with execSync calls into the QQ bot's gateway.ts and outbound.ts. SKILL.md mentions 'apply channel patches' but doesn't detail the execSync implications.
scripts/apply-qqbot-patch.sh:20 Explicitly document in SKILL.md that the patch modifies plugin source files and embeds the skill path in execSync calls.
Low Supply Chain
Unpinned package dependencies
install.sh installs langdetect (pip) and inotify-tools (apt) without version pinning, risking unexpected behavior from breaking changes
scripts/install.sh:46 Pin versions: pip3 install langdetect==1.0.9 and apt-get install inotify-tools (or specify version)
Low Doc Mismatch
Silent dependency installation
install.sh installs packages with 2>/dev/null redirection, suppressing output and potential error messages from the user
scripts/install.sh:47 Show installation progress to user, or at minimum log failures to a visible file
Low Sensitive Access
Hardcoded root paths in scripts
smart-status-report.sh and status-query-daemon.sh hardcode /root paths and PATH variables containing root-specific binaries
scripts/smart-status-report.sh:6 Use dynamic paths based on actual user context, not hardcoded /root
Declared capability vs actual capability
Filesystem Pass
Declared WRITE
→ Inferred WRITE
SKILL.md declares script execution which writes to /tmp/ and patch files Shell Block
Declared NONE
→ Inferred WRITE
install.sh:46-54 apt-get install, install.sh:60 crontab modification, install.sh:67 systemctl with User=root, install.sh:42 pip3 install Network Pass
Declared NONE
→ Inferred READ
smart-status-report.sh:58 openclaw message send, but this is the core messaging function documented in SKILL.md Environment Pass
Declared NONE
→ Inferred READ
supervisor.sh:77-82 reads memory/load via free/uptime; no credential harvesting observed Skill Invoke Block
Declared NONE
→ Inferred WRITE
apply-qqbot-patch.sh injects execSync calls into plugin source files Suspicious artifacts and egress
Medium External URL
https://clawhub.ai/user/fanxinyun1991 skill-card.md:7
Medium External URL
https://clawhub.ai/fanxinyun1991/agent-guardian skill-card.md:31
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| langdetect | latest | pip | No | Version not pinned - breaking changes could affect functionality |
| inotify-tools | latest | apt | No | System package, version not pinned |
File composition
15 files · 1256 lines
Shell 7 files · 567 linesMarkdown 4 files · 399 linesPython 3 files · 285 linesJSON 1 files · 5 lines
Files of concern · 4
scripts/install.sh Undeclared root-level system modifications · Unpinned package dependencies · Silent dependency installation
scripts/apply-qqbot-patch.sh Plugin source code modification not documented in SKILL.md
skill-card.md https://clawhub.ai/user/fanxinyun1991 · https://clawhub.ai/fanxinyun1991/agent-guardian
scripts/smart-status-report.sh Hardcoded root paths in scripts
Other files · msg-queue.py · SKILL.md · supervisor.sh · qqbot.md · lang-filter.py · generic.md +2
Security positives
No base64 encoding, eval(), or obfuscation patterns detected
No credential harvesting from ~/.ssh, ~/.aws, .env, or similar sensitive paths
No reverse shell, C2 communication, or external IP connections
No data exfiltration to external servers (status messages go through configured openclaw channel only)
skill-card.md properly documents known risks including persistent host components and /tmp state files
apply-qqbot-patch.sh creates backups of original files before patching
Scripts use trap for proper cleanup (supervisor.sh:18)
Lock file mechanism prevents duplicate supervisor runs (supervisor.sh:15-22)
All /tmp/ files are ephemeral state files, not persistent credential stores