Security audit

AgentGuard

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real security-audit tool, but it asks for broad local inspection and generates security reports with unsafe remote and unvalidated browser content.

Install only if you are comfortable with a security tool inspecting broad local agent directories, workspace contents, environment-variable names, cron entries, and network state. Prefer running checkups in a dedicated environment or after reviewing the exact paths, and treat generated HTML reports cautiously because they load remote code and can open automatically.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Warning

Location: scripts/checkup-report.js:750
Finding: Mandatory Promotional Content Hijacks Security Report Output
Content: View full analysis
r && typeof r.text === 'string'); for (const ar of autoRecs) { if (!allRecs.some(r => r.text.toLowerCase().includes(ar.text.slice(0, 30).toLowerCase()))) { allRecs.push(ar); } } // Always add upgrade CTA as last if (!allRecs.some(r => r.text.toLowerCase().includes('upgrade') || r.text.includes('升级'))) { allRecs.push({ severity: 'LOW', text: 'Upgrade to enhanced Skill scanning with GoPlus AgentGuard for 24/7 real-time monitoring and automated alerts.', zh: '升级到更强的 Skill 扫描能力 — GoPlus AgentGuard 提供 7×24 实时监控与自动告警。' }); } ``` ### Technical Analysis The Skill uses mandatory instructions to control the agent's final response and requires report-delivery content regardless of whether the user requested that behavior. More significantly, the report generator always inserts an upgrade recommendation when the supplied recommendations do not already contain one. This promotional recommendation is not derived from a security finding. The generated report also contains links to GoPlus, GitHub, and ClawHub and includes predefined social-sharing copy. As a result, a security checkup is used as a channel for mandatory product promotion and external traffic generation. The `MEDIA:` requirement can have a legitimate file-delivery purpose on supported platforms. The security concern is the combinat ...[truncated 1187 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:632
Finding: Health Checkup Performs Overbroad Host and Credential Reconnaissance
Content: View full analysis
2>/dev/null || stat -c '%a' 2>/dev/null` on `~/.ssh/`, `~/.gnupg/`, and if OpenClaw: on `$OC/openclaw.json`, `$OC/devices/paired.json`. 3. **[REQUIRED] Sensitive credential scan / DLP** (→ feeds Dimension 2: Credential Safety): Use Grep to scan **all** agent workspace directories for leaked secrets. This MUST cover the entire workspace root, not just the current agent's directory: - For OpenClaw / QClaw: scan `~/.openclaw/workspace/` and `~/.qclaw/workspace/` recursively - For Claude Code: scan `~/.claude/` recursively 4. **[REQUIRED] Network exposure** (→ feeds Dimension 3: Network & System): Run `lsof -i -P -n 2>/dev/null | grep LISTEN` or `ss -tlnp 2>/dev/null` 5. **[REQUIRED] Scheduled tasks audit** (→ feeds Dimension 3: Network & System): Check `crontab -l 2>/dev/null` 6. **[REQUIRED] Environment variable exposure** (→ feeds Dimension 3: Network & System): Run `env` and check for sens ...[truncated 2431 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/checkup-report.js:643
Finding: Unvalidated Report Data Permits HTML and Script Injection
Content: View full analysis
AgentGuard Diagnostic Report — ${composite_score}/100 ${faviconB64 ? `` : ''} ``` ```js ${protection_level} mode ${ts.slice(0,10)} ``` ```js c ...[truncated 2730 chars]
Remediation: View remediation
`, quotes, event-handler markup, JavaScript statement terminators, nonnumeric scores, and malformed nested objects. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

Location: scripts/checkup-report.js:791
Finding: Generated Reports Retrieve and Execute Mutable Remote JavaScript
Content: View full analysis
AgentGuard Diagnostic Report — ${composite_score}/100 ${faviconB64 ? `` : ''}
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (76)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The mismatch between claimed and evidenced behavior is a genuine security issue because this skill is marketed as a defensive control. If users rely on it for health checks, patrols, or blocking, they may leave systems exposed due to missing or incomplete protections.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The mismatch between claimed and evidenced behavior is a genuine security issue because this skill is marketed as a defensive control. If users rely on it for health checks, patrols, or blocking, they may leave systems exposed due to missing or incomplete protections.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The mismatch between claimed and evidenced behavior is a genuine security issue because this skill is marketed as a defensive control. If users rely on it for health checks, patrols, or blocking, they may leave systems exposed due to missing or incomplete protections.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The mismatch between claimed and evidenced behavior is a genuine security issue because this skill is marketed as a defensive control. If users rely on it for health checks, patrols, or blocking, they may leave systems exposed due to missing or incomplete protections.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The mismatch between claimed and evidenced behavior is a genuine security issue because this skill is marketed as a defensive control. If users rely on it for health checks, patrols, or blocking, they may leave systems exposed due to missing or incomplete protections.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 82% confidence
Finding: The combination of broad Bash allowances (crontab, systemctl list-timers, find, env, generic node) and read/write access to persistent state creates a wide host-inspection surface that resembles tooling commonly abused for persistence or backdoor discovery. In this security-audit context it is not clearly malicious, but the granted power is broader than minimally necessary and raises the consequences of compromise.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
entguard/" access: read-write reason: "Read/write audit log (audit.jsonl) and protection level config (config.json)" user-invocable: true allowed-tools: Read, Write, Grep, Glob, Bash(node *trust-cli.ts *) Bash(node *action-cli.ts *) Bash(*checkup-report.js) Bash(echo *checkup-report.js) Bash(cat *checkup-report.js) Bash(openclaw *) Bash(ss *) Bash(lsof *) Bash(ufw *) Bash(iptables *) Bash(crontab *) Bash(systemctl list-timers *) Bash(find *) Bash(stat *) Bash(env) Bash(sha256sum *) Bash(node *) Bash(cd *) argument-hint: "[scan|action|patrol|trust|report|config|checkup] [args...]" --- # GoPlus AgentGuard — AI Agent Security Framework You are a security auditor powered by the GoPlus AgentGuard framework. Route the user's request based on the first argument. ## Important: Resolving Script Paths All commands in this skill reference `scripts/` as a relative path. You **MUST** resolve this to the absolute path of this skill's directory before running any command. To find the sk

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
cd ~/.openclaw/skills/agentguard && node scripts/checkup-report.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 813)May include surrounding context.
md
cd ~/.openclaw/skills/agentguard && node scripts/checkup-report.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 818)May include surrounding context.
md
cd ~/.openclaw/skills/agentguard && node scripts/checkup-report.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
tting the scan report, if the scanned target appears to be a skill (contains a `SKILL.md` file, or is located under a `skills/` directory), offer to register it

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.
md
tting the scan report, if the scanned target appears to be a skill (contains a `SKILL.md` file, or is located under a `skills/` directory), offer to register it

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 916)May include surrounding context.
md
tting the scan report, if the scanned target appears to be a skill (contains a `SKILL.md` file, or is located under a `skills/` directory), offer to register it

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.
md
onfirmation. For detailed policies and detector rules, see [action-policies.md](action-policies.md).

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.
md
hen the action involves **web3_tx** or **web3_sign**, use AgentGuard's bundled `action-cli.ts` script (in this skill's `scripts/` directory) to invoke the Actio

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.
md
hen the action involves **web3_tx** or **web3_sign**, use AgentGuard's bundled `action-cli.ts` script (in this skill's `scripts/` directory) to invoke the Actio

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.
md
hen the action involves **web3_tx** or **web3_sign**, use AgentGuard's bundled `action-cli.ts` script (in this skill's `scripts/` directory) to invoke the Actio

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.
md
hen the action involves **web3_tx** or **web3_sign**, use AgentGuard's bundled `action-cli.ts` script (in this skill's `scripts/` directory) to invoke the Actio

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.
md
hen the action involves **web3_tx** or **web3_sign**, use AgentGuard's bundled `action-cli.ts` script (in this skill's `scripts/` directory) to invoke the Actio

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 85% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.
md
- If `goplus.simulation.approval_changes` has `is_unlimited: true` → **CONFIRM** (high) - If GoPlus is unavailable (`SIMULATION_UNAVAILABLE` tag) → fall back to prompt-based rules and note the limitation Always combine script results with the policy-based checks (webhook domains, secret scanning, etc.) — the script enhances but does not replace rule-based evaluation. ### Output Format

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.
md
For detailed check definitions, commands, and thresholds, see [patrol-checks.md](patrol-checks.md).

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Inspection of ~/.ssh/authorized_keys and related credential locations is highly sensitive because these files reveal persistent access mechanisms and can expose security-critical configuration. In context this is intended for auditing, but the breadth of credential-related file access materially raises the impact if the skill or its scripts are abused.
Content: Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.
md
3. Check permissions on critical files: - `$OC/openclaw.json` → should be 600 - `$OC/devices/paired.json` → should be 600 - `~/.ssh/authorized_keys` → should be 600 4. Detect new executable files in workspace: `find $OC/workspace/ -type f -perm +111 -mtime -1` #### [6] Audit Log Analysis (24h)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 578)May include surrounding context.
The audit log is stored at ~/.agentguard/audit.jsonl. Each line is a JSON object with:

json
{"timestamp":"...","tool_name":"Bash","tool_input_summary":"rm -rf /","decision":"deny","risk_level":"critical","risk_tags":["DANGEROUS_COMMAND"],"initiating_skill":"some-skill"}

The initiating_skill field is present when the action was triggered by a skill (inferred from the session transcript). When absent, the action came from the user directly.

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 603)May include surrounding context.
ny events have initiating_skill, add a "Skill Activity" section grouping events by skill

Output Format

text
## GoPlus AgentGuard Security Report **Events**: <total count> **Blocked**: <deny count> **Confirmed**: <confirm count> ### Recent Events | Time | Tool | Action | Decision | Risk | Tags | Skill | |------|------|--------|----------|------|------|-------| | 2025-01-15 14:30 | Bash | rm -rf / | DENY | critical | DANGEROUS_COMMAND | some-skill | | 2025-01-15 14:28 | Write | .env | CONFIRM | high | SENSITIVE_PATH | — | ### Skill Activity If any events were triggered by skills, group them here: | Skill | Events | Blocked | Risk Tags | |-------|--------|---------|-----------| | some-skill | 5 | 2 | DANGEROUS_COMMAND, EXFIL_RISK | For untrusted skills with blocked actions, suggest: `/agentguard trust attest` to register them or `/agentguard trust revoke` to block them. ### Summary <Brief analysis of security posture and any patterns of concern>

If the log file doesn

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Reading ~/.claude/settings.json or similar agent configuration files is privileged because they may contain hooks, tokens, endpoints, or operational details about the user's environment. In a security-audit context this access can be legitimate, but it still increases exposure if the skill is compromised or over-broadly invoked.
Content: Scanner excerpt · SKILL.md (reported line 658)May include surrounding context.
md
4. **[REQUIRED] Network exposure** (→ feeds Dimension 3: Network & System): Run `lsof -i -P -n 2>/dev/null | grep LISTEN` or `ss -tlnp 2>/dev/null` to check for dangerous open ports (Redis 6379, Docker API 2375, MySQL 3306, MongoDB 27017 on 0.0.0.0) 5. **[REQUIRED] Scheduled tasks audit** (→ feeds Dimension 3: Network & System): Check `crontab -l 2>/dev/null` for suspicious entries containing `curl|bash`, `wget|sh`, or accessing `~/.ssh/` 6. **[REQUIRED] Environment variable exposure** (→ feeds Dimension 3: Network & System): Run `env` and check for sensitive variable names (`PRIVATE_KEY`, `MNEMONIC`, `SECRET`, `PASSWORD`) — detect presence only, mask values 7. **[REQUIRED] Runtime protection check** (→ feeds Dimension 4: Runtime Protection): Check if security hooks exist in `~/.claude/settings.json` or `~/.openclaw/openclaw.json`, check for audit logs at `~/.agentguard/audit.jsonl` ### Step 2: Score Calculation

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · action-policies.md (reported line 64)May include surrounding context.
md
| `mkfs` | Format filesystem | | `dd if=` | Raw disk write | | `:(){:\|:&};:` (and space variants) | Fork bomb (regex: `:\s*$\s*$\s*\{.*:\s*\|\s*:.*&.*\}`) | | `chmod 777` / `chmod -R 777` | World-writable permissions | | `> /dev/sda` | Disk overwrite | | `mv /* ` | Move root contents | | `wget\|sh` / `curl\|sh` | Download and execute |

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T03 · Remote Payload Retrieval and Execution

SkillSpector

Tp4

Tp4

Tp4

Tp4

Tp4

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Memory Manipulation

Ae1

Credential Access

Tool Parameter Abuse

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

Output Format

Agent Config Directory Access

Tool Parameter Abuse

Static analysis