Security audit

Agent Group

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small Chinese-language agent group helper that stores simple group membership locally, with no evidence of network access, credential access, privilege escalation, or destructive behavior.

Install only if you are comfortable with a Chinese-only command interface and with the skill storing simple agent group membership in a local OpenClaw memory JSON file until you dissolve the group.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares no explicit tool scope or permissions while static analysis detected file_write capability. If the runtime infers or permits file-writing behavior without a least-privilege declaration, the skill could modify local files in ways the user did not expect. In a multi-agent/group-management skill, this is more concerning because delegated agents may amplify side effects across workflows.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The description is presented only in Chinese ("极简多Agent群组 - 像微信拉群一样简单"), which indicates a language-specific user experience without offering any language choice or opt-in. Under the policy, language constraints should either be user-selectable or clearly justified as region-specific.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrases are extremely broad, short, and natural-language generic, making accidental activation or invocation collisions with unrelated user requests more likely. In a skill that manages multiple agents, unintended activation could create groups, add agents, or dissolve groups without clear user intent, increasing the risk of unauthorized orchestration or confusing cross-agent actions.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill's docstring, agent metadata, command phrases, and user-facing responses are entirely in Chinese, and command handling only recognizes Chinese trigger phrases such as 建群 and 解散群. This imposes a specific language requirement without offering an opt-in or alternative locale choice.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This Python code writes persistent state to /root/.openclaw/workspace/memory/agent-groups.json and later deletes entries from that file, but there is no confirmation prompt, logging, print statement, or explanatory comment/docstring describing the data persistence or deletion behavior. Users invoking group creation or dissolution may not be warned that their data is being stored and removed from disk.

Static analysis

No suspicious patterns detected.