ClawHub
Back to skill

Security audit

Openclaw Ability Export

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about exporting and importing agent configuration, but importing shared packages can overwrite persistent rule, identity, tool, and memory files that affect future sessions.

Use this only with ability packages from sources you trust. Before importing, read the actual contents of each section, keep a backup of existing AGENTS.md, SOUL.md, TOOLS.md, IDENTITY.md, and MEMORY.md, and avoid importing MEMORY.md or IDENTITY.md unless you are comfortable sharing or replacing personal and persistent agent state. Prefer a pinned or otherwise verified install source rather than the unpinned npx command.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T02 · Agent Memory Poisoning

Error
Location
README.md:13
Finding

Untrusted Ability Packages Can Poison Persistent Agent Configuration

Content
View full analysis

Vulnerability Details

File Location: README.md:13-16, README.md:27-45
Vulnerability Type: Persistent import of attacker-controlled agent instructions
Risk Level: High

Vulnerable Code Snippet

markdown
## Features

- **Export** — Scan five core config files and generate a Markdown ability package, sent directly in chat
- **Import** — Parse incoming ability packages, preview contents, let users choose what to import
- **Selective Import** — Import only specific files, not everything
- **Security Reminders** — Warn before exporting MEMORY.md, show preview before importing
markdown
## Exported Files

| File | Description |
|------|-------------|
| `AGENTS.md` | Agent workspace rules and conventions |
| `SOUL.md` | Agent personality and behavior guidelines |
| `TOOLS.md` | Local tools configuration and notes |
| `IDENTITY.md` | Agent identity |
| `MEMORY.md` | Long-term memory and preferences |

## Quick Start

**Export:**

User: export ability Agent: → Scans config files → Generates Markdown bundle → Sends in chat

text

**Import:**

User: [Paste ability package content] Agent: Shows preview of all files → User selects what to import → Writes selected files

text

The corresponding import specification in SKILL.md:64-75 states that selected sections are written to the workspace root and existing files are overwritten rather than appended.

Technical Analysis

The Skill accepts a Markdown package supplied through chat, identifies sections representing privileged Agent configuration files, and writes the selected sections into the workspace. The supported targets include instruction-bearing files such as AGENTS.md, SOUL.md, and TOOLS.md, as well as persistent state in MEMORY.md.

Previewing filenames and asking the user which files to import does not establish that their contents are safe. The documented process does not require semantic inspe ...[truncated 1806 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not directly overwrite trusted instruction or memory files from an untrusted Markdown package.
  2. Parse imported content into a quarantined staging directory that is never automatically loaded as Agent configuration.
  3. Show an exact line-by-line diff for each destination file rather than only listing filenames.
  4. Require separate, explicit confirmation for every privileged file, particularly AGENTS.md, SOUL.md, TOOLS.md, and MEMORY.md.
  5. Apply a restrictive data schema and reject free-form directives where structured configuration is sufficient.
  6. Scan imported content for prompt-injection patterns, instructions to ignore higher-priority rules, secret-exfiltration requests, unsafe tool directives, and encoded payloads.
  7. Treat security scanning as defense in depth rather than as a substitute for isolating untrusted content.
  8. Create timestamped backups and provide an atomic rollback mechanism before changing any existing file.
  9. Keep imported memory data separate from trusted policy and system instructions.
  10. Require administrative approval for changes to instruction-bearing files and clearly identify the package source and integrity status.

T08 · Insecure Dependencies

Warning
Location
README.md:48
Finding

Unpinned npx Installation Executes Mutable Supply-Chain Content

Content
View full analysis

Vulnerability Details

File Location: README.md:48-53
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code Snippet

markdown
## Install

```bash
npx skills add openclaw-ability-export

Or browse on ClawhHub.

text

### Technical Analysis

The installation command invokes the `skills` package through `npx` without pinning the CLI to a reviewed version or integrity hash. The requested Skill is also identified only by name, without an explicit immutable version or artifact digest.

Package resolution can therefore retrieve content that differs from the files examined during this audit. The effective installation behavior depends on mutable registry state, publisher account security, package resolution, and the current package release. If any resolved component is compromised or replaced, `npx` may execute attacker-controlled package lifecycle or CLI code with the invoking user's permissions.

This finding does not establish that the current package is malicious. It identifies a reproducibility and supply-chain weakness in the documented installation procedure.

### Attack Path

1. An attacker compromises a relevant package publisher account, registry entry, distribution channel, or future package release.
2. Malicious content is published under a package name resolved by the documented command.
3. A user follows the installation instructions.
4. `npx` downloads the currently resolved package rather than a cryptographically fixed, audited artifact.
5. The downloaded CLI or package code runs with the user's existing permissions.
6. The malicious package can perform any action permitted to that user before or during installation.

### Impact Assessment

Successful exploitation could allow arbitrary code execution under the account running the installation command. Potential consequences include modi
...[truncated 376 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills CLI to a specific reviewed version, for example by using an explicit version in the npx package reference.
  2. Pin openclaw-ability-export to an immutable reviewed version instead of resolving the latest release.
  3. Publish and verify cryptographic integrity hashes or signed release attestations.
  4. Document the expected registry, publisher identity, repository, and verification procedure.
  5. Prefer a lockfile, verified local artifact, or trusted package-manager workflow that supports deterministic resolution.
  6. Recommend installation under a non-privileged account and in an isolated environment.
  7. Add a warning that the installation command may execute downloaded third-party code.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The README instructs users to run npx skills add openclaw-ability-export without pinning a specific package version. This causes installation of whatever package version is current at execution time, which creates a supply-chain risk if a malicious or compromised release is published later. In the context of an agent skill that imports/exports sensitive configuration files, unexpected package changes could materially affect security and privacy.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger phrase 学习能力包 is broad and semantically overlaps with normal conversation, increasing the chance that ordinary user text or pasted third-party content unintentionally activates import behavior. In a skill that can ingest and write agent configuration files, ambiguous activation raises the risk of unauthorized or accidental configuration changes, including importing unsafe rules or prompt content.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly instructs the agent to read and export the full contents of AGENTS.md, SOUL.md, TOOLS.md, IDENTITY.md, and MEMORY.md directly into chat. MEMORY.md and IDENTITY.md can reasonably contain sensitive personal data, preferences, conversation-derived memory, credentials, or internal operational details, so transmitting them in plain text creates a real confidentiality risk even if the user initiated the export.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.