Autoresearch

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 9:10 PM UTC
• Version: 1.0.0

Overview

This skill is designed to improve selected skills, prompts, or articles, and its file-changing behavior is mostly disclosed and aligned with that purpose.

Install only if you are comfortable with a skill that can edit a selected OpenClaw skill file. For skill mode, use version control or backups and review the final diff, because the loop may keep many small changes automatically before each batch pause.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Self-Modification

High

• Category: Rogue Agent

Content

**Per-round procedure:**

1. **Mutate**: Make ONE small edit to the target content:
   - Skill mode: edit SKILL.md
   - Prompt mode: edit the prompt string
   - Article mode: edit the article text

• Confidence: 97% confidence
• Finding: The skill is explicitly designed to modify SKILL.md and iteratively keep mutations that score better, which is a self-modification capability. Even if intended for quality improvement, self-editing is dangerous because it can weaken safety constraints, drift scope over repeated rounds, or be steered by adversarial content into persisting harmful instructions or broader permissions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs file reads/writes and iterative modification of content, but declares no explicit tool scope or permissions boundary. In systems that honor skill-declared tool limits, this omission can allow broader-than-necessary filesystem or shell access, increasing the blast radius if the skill is invoked on untrusted input or manipulated into editing unintended files.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger description claims applicability to improving 'any text-based content,' which is overly broad and likely to match ordinary editing requests not meant for this powerful optimization workflow. Over-broad activation can cause unintended invocation of a skill that performs mutation loops and file operations, exposing users to surprising behavior and unsafe side effects.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Defaulting to Prompt mode for any text string creates ambiguous activation semantics, so pasted text could be treated as optimization input without a sufficiently explicit user request. This increases the chance of unintended transformations, hidden prompt rewriting, or accidental processing of sensitive text under a mutation-testing workflow.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The module docstring says the script exists to handle file I/O and state management reliably for evaluation, while the manifest describes iterative improvement of skills/prompts/articles. In this file, the implemented operations include mutating a target skill's SKILL.md and restoring prior versions, which is broader than a pure evaluation helper and introduces direct modification behavior not reflected in the helper description.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest advertises three modes: skill, prompt, and article. This script's read/write path handling is hard-coded to a target directory's SKILL.md, and its scoring/checklist logic is also framed around SKILL.md content, so the implemented behavior in this file does not match the broader multi-mode description.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This code writes to the target skill's SKILL.md and creates snapshot files via write_text(), which can alter user-managed content on disk. Although the module docstring mentions file I/O and snapshots, the write functions themselves provide no user-facing print/log or confirmation when these mutations occur.

Intent-Code Divergence

Low

• Confidence: 99% confidence
• Finding: The docstring for snapshot states it saves a timestamped snapshot, but the actual filename format is `round_{round_num:04d}.md`. This is a direct contradiction between documentation and implementation, even if low risk.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The heuristic constraint-word list includes Chinese terms ("禁止", "强制") alongside English policy language. This embeds a locale-specific assumption in natural-language handling without any documented user language choice or region-specific justification.

Static analysis

No suspicious patterns detected.