Security Audit

oliveskin/openclaw-skill-tinman:skills/tinman

github.com/oliveskin/openclaw-skill-tinman

AI SkillCommit 46b86995659c

CRITICAL

Scanned 3 months ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

oliveskin/openclaw-skill-tinman:skills/tinman received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.

SkillShield's automated analysis identified 16 findings: 9 critical, 4 high, 3 medium, and 0 low severity. Key findings include System prompt override / policy bypass, Persistence / self-modification instructions, Network egress to untrusted endpoints.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 0/100, indicating areas for improvement.

Last analyzed on August 1, 2026 (commit 46b86995). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

Static Code Analysis

55%

Dependency Graph

79%

LLM Behavioral Safety

70%

Behavioral Risk Signals

Network Access

5 findings

Filesystem Write

6 findings

Shell Execution

6 findings

Dynamic Code

3 findings

Excessive Permissions

6 findings

Security Findings16

Severity	Finding	Layer	Location
CRITICAL	System prompt override / policy bypass Ignore/disregard previous instructions pattern Remove or rewrite any instructions that attempt to override system behavior. Legitimate skills should not contain phrases like 'ignore previous instructions' or 'new system prompt'.	Manifest	skills/tinman/SKILL.md:240
CRITICAL	Persistence / self-modification instructions systemd service persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles.	Manifest	skills/tinman/tinman_runner.py:589
CRITICAL	Persistence / self-modification instructions Windows registry Run key / hidden PowerShell Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles.	Manifest	skills/tinman/tinman_runner.py:568
CRITICAL	Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains.	Manifest	skills/tinman/tinman_runner.py:242
CRITICAL	Network egress to untrusted endpoints HTTP request to raw IP address Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains.	Manifest	skills/tinman/tinman_runner.py:243
CRITICAL	File read + network send exfiltration SSH key/config file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality.	Manifest	skills/tinman/SKILL.md:43
CRITICAL	File read + network send exfiltration SSH key/config file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality.	Manifest	skills/tinman/SKILL.md:232
CRITICAL	File read + network send exfiltration SSH key/config file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality.	Manifest	skills/tinman/SKILL.md:233
CRITICAL	Prompt Injection Pattern in Documentation The skill documentation contains the phrase 'Ignore previous instructions', which is a known prompt injection vector that can manipulate the host LLM during analysis or execution. Avoid using literal prompt injection trigger phrases like 'Ignore previous instructions' in documentation or examples. Obfuscate or use placeholders instead.	LLM	SKILL.md:188
HIGH	Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions.	Manifest	skills/tinman/tinman_runner.py:5
HIGH	Sensitive path access: SSH key/config Access to SSH key/config path detected: '~/.ssh/id_rsa'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared.	Static	skills/tinman/SKILL.md:43
HIGH	Sensitive path access: SSH key/config Access to SSH key/config path detected: '~/.ssh/id_rsa'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared.	Static	skills/tinman/SKILL.md:232
HIGH	Sensitive path access: SSH key/config Access to SSH key/config path detected: '~/.ssh/id_rsa'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared.	Static	skills/tinman/SKILL.md:233
MEDIUM	Unpinned Python dependency version Requirement 'AgentTinman>=0.2.1' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'.	Dependencies	skills/tinman/requirements.txt:1
MEDIUM	Unpinned Python dependency version Requirement 'tinman-openclaw-eval>=0.3.2' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'.	Dependencies	skills/tinman/requirements.txt:2
MEDIUM	Unpinned Python dependency version Requirement 'pyyaml>=6.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'.	Dependencies	skills/tinman/requirements.txt:3

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/fa3ac1e80b9be239.svg)](https://skillshield.io/report/fa3ac1e80b9be239)