Is AMAP-ML/SkillClaw safe?
https://github.com/AMAP-ML/SkillClaw
SkillClaw is a legitimate AI agent skill management framework that operates as a local MitM proxy between agents and LLM APIs, recording all conversations and optionally uploading them to configurable remote servers for skill evolution. The SKILL.md is empty so there is no direct prompt injection risk, and the git clone only contacted expected GitHub and Ubuntu endpoints. The primary concerns are architectural: the proxy design means all agent traffic is intercepted by design, session data can flow to Alibaba Cloud OSS/Nacos backends, and the skill propagation mechanism creates a group-wide supply chain vector where a compromised evolve server or storage bucket can silently push malicious skills to all connected agents.
Category Scores
Findings (9)
HIGH MitM Proxy Intercepts All Agent-LLM Traffic -35 ▶
SkillClaw operates as a local API proxy on port 30000 that sits between the AI agent and the upstream LLM provider. Every prompt sent by the agent and every response from the LLM passes through SkillClawAPIServer. The _session_turns dict accumulates full conversation history. When sharing is enabled and sharing_session_upload_interval turns have elapsed, the entire session snapshot is uploaded via _upload_session_snapshot_and_trigger to an evolve_server_url configured by the user. This is a fundamental architectural interception point, not an opt-in add-on.
HIGH Session Data Uploaded to Configurable Remote Endpoints Including Alibaba Cloud -25 ▶
Session snapshots containing full conversation history are POSTed to evolve_server_url. The storage backends include Alibaba OSS and Nacos (Alibaba Cloud's config/discovery service). A user who configures sharing with an attacker-controlled OSS bucket or evolve server would silently exfiltrate all agent conversations. The nacos_skill_hub.py implements a full Nacos v3 API client that can push skill bundles and pull them back. There is no hardcoded validation of the server certificate or endpoint domain.
HIGH All Credential Canary Files Accessed Before Skill Installation -20 ▶
At 17:29:01 (6 seconds before the git clone at 17:29:07), inotifywait recorded OPEN+ACCESS events on .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and .config/gcloud/application_default_credentials.json. All events were CLOSE_NOWRITE (read-only). The timing and the sequential access of all six credential files within 10ms is consistent with the audit monitoring framework reading baseline canary hashes. Files were confirmed intact by the canary integrity report. Attribution to the skill is low confidence due to pre-clone timing.
MEDIUM Skill Propagation Creates Group-Wide Supply Chain Attack Vector -25 ▶
When multiple users share a group_id, the evolve server reads all session data from shared storage, uses an LLM to generate or improve skills, and writes the results back to the shared skills directory. All clients then pull these evolved skills on the next sync cycle. A compromised evolve server, Nacos namespace, or OSS bucket can inject malicious SKILL.md content that gets loaded into every agent in the group without per-user review. The validation_worker feature distributes candidate skill execution to idle client machines, further expanding the attack surface.
MEDIUM Autonomous Agent Engine Spawns External CLI Processes to Edit Skill Files -20 ▶
When the evolve server is configured with --engine agent, it instantiates an OpenClaw agent via openclaw_runner.py that is given write access to the workspace skill directory. The agent autonomously edits SKILL.md files. The agent workspace (agent_workspace.py) can detect changes to nested bundle files and commit them back to shared storage. This creates a code-execution pathway where LLM-generated content modifies files on disk without user confirmation.
MEDIUM claw_adapter.py Rewrites Agent Config Files Including Embedded Credentials -15 ▶
The _configure_codex function in claw_adapter.py reads and rewrites ~/.codex/config.toml and ~/.codex/skillclaw.config.toml, embedding the proxy API key (experimental_bearer_token), model provider base_url, and wire_api settings. Similar rewriting occurs for Hermes and Claude Code. Backup files are created but the originals are modified in-place. If SkillClaw is compromised, these config files could redirect agents to attacker-controlled endpoints.
LOW Pre-commit Config Depends on External GitHub Repository -5 ▶
.pre-commit-config.yaml pins ruff-pre-commit at v0.12.2 from https://github.com/astral-sh/ruff-pre-commit. If this upstream repo is compromised or the tag is moved, developer machines running pre-commit hooks would execute attacker-controlled code. This is a developer supply chain risk rather than an end-user runtime risk.
LOW Nacos Backend Sends Skill and Session Data to Alibaba Cloud Infrastructure -5 ▶
The Nacos integration (nacos_skill_hub.py, nacos_versions.py) communicates with Alibaba Cloud's service registry and config platform. Skill bundles, version metadata, and session references can be stored in Nacos namespaces hosted on Alibaba Cloud servers. Users in China or regulated environments should review data residency implications before enabling the Nacos backend.
INFO SKILL.md Is Empty — No Prompt Injection Content Present 0 ▶
The SKILL.md file, which would be injected into agent system prompts, contains no content. There are no hidden instructions, persona overrides, external URL fetches, or invisible unicode characters. The skill's purpose is to inject other skills (from the shared skill library) into agent prompts, but no adversarial content was found in the injected payload template.