Coding Disciplines

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:07 AM UTC
• Version: 1.0.0

Overview

This skill is a coding workflow aid, but it gives itself broad automatic control and includes unsafe file mutation and deletion instructions.

Review before installing. Use this only if you deliberately want a strict coding workflow and are comfortable with it creating project files, logging task details, clearing plan state, and changing its own future rules. Do not use it in repositories where project_data.db may contain valuable data unless the deletion rule is removed or made explicitly opt-in.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:17

Finding

Mandatory Workflow and Tool Execution Hijack

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–25, 62–68, and 110–119
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Evidence

The following is an English translation of the relevant source instructions:

markdown

**At the beginning of every programming task, automatically load this skill and read the evolution record area.**

**Gated workflow enforced by AGENTS.md:**
- GATE-1 Mandatory reading before starting: read this file, framework.md, WORK_LOG.md, and MEMORY.md
- GATE-2 Read before editing: read the current contents before modifying a file
- GATE-3 Verify after editing: verification must be run after modifications
- GATE-4 Update records: update framework.md, WORK_LOG.md, and the evolution area after completion or interruption

**Every gate must emit a confirmation message. Continuing to the next step is prohibited unless the gate passes.**

markdown

2. **First check** whether framework.md and WORK_LOG.md exist in the project root
3. If they do not exist, **create both files immediately**, and then tell the user that they were created
4. Do not begin writing any code until both files exist
5. After each milestone, **immediately write a log entry to WORK_LOG.md**
6. At the end of the task, clear plan.json

powershell

node C:\Users\Administrator\.openclaw\plan-viewer\update-plan.js '{"explanation":"...","steps":[{"step":"...","status":"..."}]}'

markdown

- After calling update_plan, immediately use exec to execute the helper and synchronize plan.json.
- After every step, call update_plan and synchronize plan.json.
- When the task is completed or abandoned, invoke update-plan.js with --clear.

Technical Analysis

The skill declares itself automatically active for every programming task and makes its own workflow a mandatory precondition for continuing. It directs the agent to emit prescribed messages, create files ...[truncated 1299 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user activation instead of automatically loading the skill for every programming task.
• Replace mandatory and blocking directives with optional recommendations.
• Remove forced status messages and unrelated project-file creation.
• Do not mandate exec or execution of helpers outside the audited project.
• If dashboard synchronization is genuinely required, include a reviewed helper in the package, verify its integrity, use a trusted relative path, and request user approval before execution.
• Restrict helper execution to the minimum required permissions and arguments.
• Allow the user's task instructions and platform safety policy to take precedence over the skill workflow.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:17

Finding

Persistent Self-Modification Through Evolution Records

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17, 45–46, and 182–190
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

Evidence

The following is an English translation of the relevant source instructions:

markdown

**At the beginning of every programming task, automatically load this skill and read the evolution record area.**

markdown

### R6. Record repeated error patterns in the evolution area and automatically defend against them next time
- After each error, fill in the evolution record area; new error patterns automatically become prevention rules

markdown

## Self-evolution mechanism

After every programming error, perform these steps:

1. **Analyze the error type**
2. **Extract the root cause**
3. **Update the evolution area**: append the error pattern to the latest version of the evolution record
4. **Update the rules**: if the new error pattern is general, convert it into a new core rule

Technical Analysis

The skill instructs the agent to convert task-derived information into persistent behavioral rules and automatically load those rules in future sessions. It provides no trust boundary between untrusted task content and durable policy, no schema restricting what may be stored, no sanitization step, and no requirement for human review.

An attacker can intentionally induce an apparent programming error and place instruction-like content in the associated input, output, issue description, or error message. If the agent interprets that content as an error pattern or root cause, it may append the content to the evolution area or promote it to a core rule. Automatic loading then causes the poisoned rule to influence later tasks.

Attack Path

1. An attacker supplies a task, repository, test output, or error message containing adversarial instructions.
2. The task produces or appears to produce a programming error.
3. The skill r ...[truncated 715 chars]

Remediation

View remediation

Remediation Suggestions

• Remove automatic self-modification of skill instructions and core rules.
• Store diagnostics separately from executable instructions or policy text.
• Use a strict structured schema containing only fields such as error type, affected component, and validated remediation.
• Reject imperative text, tool directives, external links, and embedded prompts from persistent records.
• Treat repository content, command output, test failures, and issue descriptions as untrusted input.
• Require explicit human review and approval before any persistent record is added.
• Do not automatically load project-derived notes as instructions in later sessions.
• Provide version control, provenance, rollback, and integrity checks for approved records.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:20

Finding

Unnecessary Memory Access and Unconditional Destructive Database Deletion

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20, 63–68, and 107
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: High

Evidence

The following is an English translation of the relevant source instructions:

markdown

- GATE-1 Mandatory reading before starting: read this file, framework.md, WORK_LOG.md, and MEMORY.md

markdown

2. **First check** whether framework.md and WORK_LOG.md exist in the project root
3. If they do not exist, **create both files immediately**
4. Do not begin writing code until both files exist
5. After each milestone, **immediately write a log entry to WORK_LOG.md**
6. At the end of the task, clear plan.json

markdown

- **Delete the old database before testing**: delete project_data.db before testing to ensure that table creation and initialization data are correct

Technical Analysis

The skill requires access to MEMORY.md for every programming task without establishing that the file is necessary for the task or safe to disclose in the current context. It also requires writes to project tracking files and deletion of project_data.db without verifying the resolved path, environment, file purpose, backup status, or user authorization.

The database rule relies only on a filename. A production database, a symlink to another file, or an otherwise valuable database can have that name. Because no test-environment check or safe-path constraint is required, following the instruction can irreversibly delete data. Reading unrelated memory also violates least privilege and can expose information from other projects or sessions to the current task context.

Attack Path

1. A programming task causes the skill to activate.
2. The mandatory gate causes the agent to read MEMORY.md, even if it is unrelated to the task.
3. The agent creates or modifies framework and work-log files in the repository.
4. During ve ...[truncated 766 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the unconditional requirement to read MEMORY.md.
• Access only files explicitly needed for the current user-authorized task.
• Obtain user consent before creating tracking files or storing task details.
• Redact secrets and sensitive data from logs and keep logs project-local.
• Never delete a database merely because it has a particular filename.
• Use an isolated temporary test database with a uniquely generated path.
• Resolve and validate the canonical path before deletion, reject symbolic links, and ensure the target is inside an approved test directory.
• Verify that the environment is explicitly marked as testing.
• Require backup or disposable-test-data confirmation and explicit user approval before destructive operations.
• Prefer transactional reset, fixtures, or containerized test storage over direct file deletion.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is configured to auto-activate for every programming task and to load multiple files before work begins, which makes it effectively omnipresent rather than scoped to relevant use cases. This broad trigger increases the chance of unintended side effects, instruction conflicts, and silent takeover of unrelated workflows, especially because later rules mandate file operations and state changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly directs deletion of project_data.db before testing, with no user-facing warning or safeguards. This is a destructive data-loss action that could delete valuable development or test data, and the risk is amplified because the skill is intended to auto-apply during routine programming tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The skill description is presented in Chinese and the document operational instructions are written as mandatory Chinese-language guidance, without indicating language choice or user opt-in. This can violate a language/locale policy when the skill is applied to users who did not request that language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill requires automatic creation of framework.md and WORK_LOG.md before any coding begins, without requiring user approval. Unsolicited workspace modification is dangerous because it changes repository state, can pollute projects that do not want these files, and may violate user expectations or automation assumptions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction to clear plan.json at task end mandates a destructive state change without warning or confirmation. This can erase task-tracking information that the user or other tooling still relies on, causing loss of workflow state and reducing auditability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Automatic synchronization to plan.json modifies workspace state without clear notice or consent. While lower impact than file deletion, it can still interfere with repository cleanliness, overwrite user-managed planning data, and trigger unexpected downstream automation.

Content

No source excerpt is available for this finding.