Security Audit

sota-tracker-claw

github.com/openclaw/skills

AI SkillCommit 13146e6a3d46

CRITICAL

Scanned about 2 months ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

sota-tracker-claw received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.

SkillShield's automated analysis identified 34 findings: 7 critical, 7 high, 18 medium, and 2 low severity. Key findings include Persistence / self-modification instructions, Arbitrary command execution, File read + network send exfiltration.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 0/100, indicating areas for improvement.

Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

Static Code Analysis

Dependency Graph

35%

LLM Behavioral Safety

84%

Behavioral Risk Signals

Network Access

9 findings

Filesystem Write

5 findings

Shell Execution

9 findings

Dynamic Code

3 findings

Excessive Permissions

8 findings

Security Findings34

Severity	Finding	Layer	Location
CRITICAL	Persistence / self-modification instructions Crontab manipulation (list/remove/edit) Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles.	Manifest	skills/romancircus/sota-tracker-claw/SKILL.md:206
CRITICAL	Persistence / self-modification instructions systemd service persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles.	Manifest	skills/romancircus/sota-tracker-claw/SKILL.md:48
CRITICAL	Persistence / self-modification instructions systemd service persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles.	Manifest	skills/romancircus/sota-tracker-claw/SKILL.md:213
CRITICAL	Persistence / self-modification instructions systemd service persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles.	Manifest	skills/romancircus/sota-tracker-claw/SKILL.md:224
CRITICAL	Persistence / self-modification instructions systemd service persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles.	Manifest	skills/romancircus/sota-tracker-claw/SKILL.md:234
CRITICAL	Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.	Manifest	skills/romancircus/sota-tracker-claw/update_agents_md.py:90
CRITICAL	File read + network send exfiltration AI agent config/credential file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality.	Manifest	skills/romancircus/sota-tracker-claw/SKILL.md:54
HIGH	Potential data exfiltration: file read + network send Function 'scrape' reads files and sends data over the network. This may indicate data exfiltration. Review this function to ensure file contents are not being sent to external servers.	Static	skills/romancircus/sota-tracker-claw/scrapers/civitai.py:116
HIGH	Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'update_agents_md'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives.	Static	skills/romancircus/sota-tracker-claw/update_agents_md.py:90
HIGH	Sensitive path access: AI agent config Access to AI agent config path detected: '~/.claude/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared.	Static	skills/romancircus/sota-tracker-claw/SKILL.md:54
HIGH	Persistence mechanism: systemd service Detected systemd service pattern. Persistence mechanisms allow malware to survive system restarts. Review this persistence pattern. Skills should not modify system startup configuration.	Static	skills/romancircus/sota-tracker-claw/SKILL.md:48
HIGH	Persistence mechanism: systemd service Detected systemd service pattern. Persistence mechanisms allow malware to survive system restarts. Review this persistence pattern. Skills should not modify system startup configuration.	Static	skills/romancircus/sota-tracker-claw/SKILL.md:213
HIGH	Persistence mechanism: systemd service Detected systemd service pattern. Persistence mechanisms allow malware to survive system restarts. Review this persistence pattern. Skills should not modify system startup configuration.	Static	skills/romancircus/sota-tracker-claw/SKILL.md:224
HIGH	Persistence mechanism: systemd service Detected systemd service pattern. Persistence mechanisms allow malware to survive system restarts. Review this persistence pattern. Skills should not modify system startup configuration.	Static	skills/romancircus/sota-tracker-claw/SKILL.md:234
MEDIUM	Unsafe deserialization / dynamic eval Decryption followed by code execution Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions.	Manifest	skills/romancircus/sota-tracker-claw/rest_api.py:5
MEDIUM	Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter.	Static	skills/romancircus/sota-tracker-claw/SKILL.md:1
MEDIUM	Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/romancircus/sota-tracker-claw/fetchers/artificial_analysis.py:16
MEDIUM	Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/romancircus/sota-tracker-claw/fetchers/huggingface.py:14
MEDIUM	Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/romancircus/sota-tracker-claw/fetchers/lmarena.py:12
MEDIUM	Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/romancircus/sota-tracker-claw/scrapers/civitai.py:18
MEDIUM	Suspicious import: socket Import of 'socket' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/romancircus/sota-tracker-claw/utils/hardware.py:5
MEDIUM	Unpinned Python dependency version Dependency 'fastmcp>=2.0,<3.0' is not pinned to an exact version. Pin Python dependencies with exact versions where feasible.	Dependencies	skills/romancircus/sota-tracker-claw/pyproject.toml
MEDIUM	Unpinned Python dependency version Requirement 'fastmcp>=2.0,<3.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'.	Dependencies	skills/romancircus/sota-tracker-claw/requirements.txt:1
MEDIUM	Unpinned Python dependency version Requirement 'aiohttp>=3.9' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'.	Dependencies	skills/romancircus/sota-tracker-claw/requirements.txt:2
MEDIUM	Unpinned Python dependency version Requirement 'huggingface_hub>=0.20' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'.	Dependencies	skills/romancircus/sota-tracker-claw/requirements.txt:3
MEDIUM	Unpinned Python dependency version Requirement 'python-dotenv>=1.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'.	Dependencies	skills/romancircus/sota-tracker-claw/requirements.txt:4
MEDIUM	Unpinned Python dependency version Requirement 'playwright>=1.40' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'.	Dependencies	skills/romancircus/sota-tracker-claw/requirements.txt:5
MEDIUM	Unpinned Python dependency version Requirement 'fastapi>=0.100.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'.	Dependencies	skills/romancircus/sota-tracker-claw/requirements.txt:6
MEDIUM	Unpinned Python dependency version Requirement 'uvicorn>=0.23.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'.	Dependencies	skills/romancircus/sota-tracker-claw/requirements.txt:7
MEDIUM	Unpinned Python dependency version Requirement 'slowapi>=0.1.9' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'.	Dependencies	skills/romancircus/sota-tracker-claw/requirements.txt:8
MEDIUM	Command Injection via subprocess.run The `update_agents_md.py` script uses `subprocess.run` to execute `scrapers/run_all.py`. While the command and its arguments are hardcoded and the script being executed is local to the repository, the use of `subprocess.run` is a powerful primitive that can lead to command injection if the command or its arguments were to become influenced by untrusted input. In this context, if the `REPO_DIR` variable or the `scrapers/run_all.py` script itself were compromised, this could lead to arbitrary code execution. Avoid using `subprocess.run` for executing other scripts within the same package if direct function calls are possible. If external execution is strictly necessary, ensure all components of the command (executable, arguments, working directory) are absolutely fixed and cannot be influenced by any external or untrusted input. Consider using a more restricted execution environment if possible.	LLM	update_agents_md.py:70
MEDIUM	Unpinned or Broadly Pinned Dependencies The project's dependencies are specified with range-based version pinning (e.g., `fastmcp>=2.0,<3.0`, `playwright>=1.40`) in `requirements.txt`, `package.json`, and `pyproject.toml`. This practice, while common, introduces a supply chain risk. A malicious update released within the specified version range by a dependency maintainer could be automatically pulled into the project, leading to compromise without explicit action from the skill developer. For production environments, it is generally safer to pin dependencies to exact versions (`==X.Y.Z`). Pin all dependencies to exact versions (e.g., `fastmcp==2.0.0`). Use a dependency management tool that generates a lock file (e.g., `pip-tools` for `requirements.txt`, `poetry` or `pdm` for `pyproject.toml`) to ensure reproducible builds and prevent unexpected dependency updates.	LLM	requirements.txt:1
LOW	Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution.	Dependencies	skills/romancircus/sota-tracker-claw/package.json
LOW	Modification of User Configuration File The `update_agents_md.py` script writes content to `~/.config/opencode/agents.md`, a user-specific configuration file. While the content being written is derived from internal, sanitized data and not directly from untrusted user input, modifying user configuration files is a sensitive operation. If the content generation logic were to become flawed, or if external data sources were to inject strings that could be interpreted as instructions by another agent consuming `agents.md`, this could lead to unintended behavior or privilege escalation within the user's agent environment. Ensure robust sanitization and validation of all data before it is written to user configuration files. Clearly document the purpose and content of such modifications to users. Consider implementing a mechanism for users to review or approve changes to sensitive configuration files before they are applied.	LLM	update_agents_md.py:140

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/e46efa4c2a646d4d.svg)](https://skillshield.io/report/e46efa4c2a646d4d)