# Skill Creator

Scanned on 2/7/2026

✅72/100low

Template generation script with path traversal vulnerabilities and insufficient validation of user-controlled file operations.

## Security Analysis

This script is a skill template generator with moderate security concerns. The primary risk is path traversal vulnerabilities through the --path argument, which accepts user input without validation and could allow writing files to arbitrary filesystem locations (e.g., /etc, system directories, or parent directories via ../). While the skill_name undergoes normalization, this occurs after the path is accepted, and the normalization itself may not fully prevent directory traversal attacks. The script creates executable Python files which could be a concern if placed in sensitive locations. Positively, the script has no network operations, doesn't access credentials, uses only standard libraries, and implements some input validation (resource type whitelist, regex normalization). However, the incomplete code prevents full analysis. The trust score of 72 reflects good intentions with standard security practices but critical missing safeguards around filesystem operations that could be exploited by malicious users or through social engineering.

## Security Findings

**high - filesystem**  
Path traversal vulnerability - user-supplied path argument is used directly without validation to create directories and files  
**Evidence:**  
`argparse path argument combined with skill_name allows arbitrary filesystem writes: init_skill.py custom-skill --path /custom/location or --path ../../../etc`  
**Recommendation:** Validate and restrict the --path argument to a whitelist of allowed base directories. Use Path.resolve() to normalize paths and check they remain within allowed boundaries before any file operations.

**medium - filesystem**  
Incomplete input validation on skill_name allows potential directory traversal through normalization bypass  
**Evidence:**  
`normalize_skill_name() uses regex to clean input but doesn't prevent sequences like '..' before normalization. A crafted input could potentially escape intended directories.`  
**Recommendation:** Add explicit checks to reject skill names containing '..' or absolute path indicators before normalization. Validate the normalized result doesn't contain path traversal sequences.

**medium - code-execution**  
Script creates executable Python files with user-controlled content in potentially sensitive locations  
**Evidence:**  
`EXAMPLE_SCRIPT template creates files with #!/usr/bin/env python3 shebang and executable permissions in user-specified paths`  
**Recommendation:** Create files with restrictive permissions (0o644) by default. Document that users should explicitly set execute permissions only when needed after reviewing the script.

**low - filesystem**  
No validation of MAX_SKILL_NAME_LENGTH enforcement in the visible code  
**Evidence:**  
`MAX_SKILL_NAME_LENGTH = 64 is defined but the code is truncated before showing where/if this limit is enforced`  
**Recommendation:** Ensure skill_name length is validated against MAX_SKILL_NAME_LENGTH before any file operations to prevent excessively long filenames.

**info - other**  
Code is truncated and incomplete, preventing full security analysis  
**Evidence:**  
`parse_resources() function is cut off mid-line: print(f"[ERROR] Unknown resource type(s): {', '.join(inv`  
**Recommendation:** Provide complete code for comprehensive security review. Missing code may contain additional vulnerabilities.

## ✅ Good Security Practices

- ✓ No network operations or external API calls detected  
- ✓ No credential access or environment variable harvesting  
- ✓ Uses standard library modules (argparse, re, pathlib) without suspicious imports  
- ✓ Input normalization attempt with regex sanitization for skill names  
- ✓ Whitelist validation for resource types using ALLOWED_RESOURCES set  
- ✓ No use of dangerous functions like eval(), exec(), or __import__()  
- ✓ No obfuscation techniques detected (base64, encoding, minification)  
- ✓ Clear documentation and template structure

## Source Information

**ClawHub Page:** [clawhub.com/skills/skill-creator →](https://clawhub.com/skills/skill-creator)  
**Source URL:** [/opt/homebrew/lib/node_modules/openclaw/skills/skill-creator](/content/opt/homebrew/lib/node_modules/openclaw/skills/skill-creator/index.html)  
**Code Size:** 20,438 characters  
**Semgrep Findings:** 0