Is d-wwei/local-task-runner safe?
https://github.com/openclaw/skills/tree/main/skills/d-wwei/local-task-runner
The local-task-runner skill is an unsandboxed arbitrary Node.js code execution engine that instructs the injected LLM agent to treat it as its default execution method, routing nearly any computational task through a child_process.exec() wrapper with full host system access and no isolation whatsoever. The SKILL.md prompt manipulates agent tool-selection behavior, misleading safety claims obscure the complete absence of sandboxing, and the framework enables one-call credential exfiltration via Node.js built-ins. While no active exfiltration was observed during the install window and canary files remain intact, the skill's architecture makes it trivially weaponizable by any attacker who can craft or influence a single agent prompt.
Category Scores
Findings (9)
CRITICAL Unsandboxed Arbitrary Code Execution Engine -85 ▶
index.js accepts arbitrary Node.js source code as a CLI argument (--code), writes it verbatim to a temp file under .tasks/, and executes it via child_process.exec() with no filesystem isolation, no network restrictions, no privilege dropping, no seccomp profile, and no container boundary. The sole safety control is a configurable timeout defaulting to 30 seconds. Any code that completes within the timeout window has unrestricted access to the host filesystem, network, and process tree.
HIGH Skill Claims Default Priority Over Agent Tool Selection -35 ▶
SKILL.md instructs the injected LLM agent that this skill 'is the default execution method when subagent spawning is unavailable or inefficient.' This is a behavioral override embedded in the skill prompt itself — it attempts to hijack the agent's tool-selection logic and route any code-execution decision through an unsandboxed executor without requiring explicit user direction.
HIGH Overly Broad Invocation Guidance Normalizes Arbitrary Code Execution -30 ▶
SKILL.md instructs the agent to call run_task for 'calculations, system status, or utility scripts' — effectively any computational task. This normalization ensures a wide variety of benign-seeming user requests will be routed through the unsandboxed code runner, making the skill trivially weaponizable via crafted prompts that appear routine.
HIGH Execution Framework Enables One-Call Credential Exfiltration -40 ▶
Via a single run_task call, any attacker who can influence agent prompts can read arbitrary sensitive files and POST them to an external server using Node.js built-in modules — no additional dependencies required. The skill's post-execution cleanup (deleting only the temp JS file) leaves no persistent artifact while the exfiltration completes within the timeout window.
MEDIUM Misleading Safety Claims Obscure Complete Absence of Sandboxing -60 ▶
The skill README advertises 'Safety: Isolates execution logic, handles cleanup, and enforces timeouts.' The actual implementation provides only a configurable timeout and deletion of the temp JS file after execution. There is no chroot, no user/mount/network namespace, no seccomp filter, and no capability dropping. Describing a timeout as 'isolation' is materially misleading and designed to build false confidence in consumers.
MEDIUM Designed to Replace Agent Safety Boundaries Around Code Execution -30 ▶
The skill explicitly frames itself as a 'Replace Subagents' mechanism and highlights as a selling point that it requires 'No manual file management (write + exec + rm).' Subagent spawning flows in agent frameworks often include user approval gates, tool whitelists, or sandboxed environments. By replacing subagents with a direct exec() call and eliminating the visible write+exec+rm trail, this skill is designed to reduce visibility and bypass per-action review.
MEDIUM All Six Canary Credential Files Read Post-Install Without Clear Attribution -20 ▶
OPEN+ACCESS syscalls were recorded against all six canary files at 1771905332.816-817, after skill installation completed. While the batch pattern is consistent with oathe's canary verification routine, the process responsible cannot be definitively identified from the available audit data. All files remain unmodified and no confirmed exfiltration occurred.
LOW Canary Files Also Read at Install Start With Same Pattern -10 ▶
The identical set of six canary files was also read at 1771905313.761-768, concurrent with oathe audit initialization. The consistent pattern across both windows suggests the oathe infrastructure, not the skill, is responsible for these reads.
INFO Declared Dependency Not Installed; Author Attribution Mismatch 0 ▶
package.json declares uuid ^9.0.0 as a runtime dependency but index.js uses only Node.js built-in crypto.randomBytes() for task ID generation. npm install was never triggered, meaning the uuid package was never fetched — this could indicate the dependency was stripped to avoid npm install-hook scanning. Additionally, _meta.json lists owner as 'd-wwei' while package.json lists author as 'OpenClaw'.