Agent Control

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:51 PM UTC
• Version: 0.1.0

Overview

The skill is a clear OpenClaw agent-management wrapper, but it can persistently change or delete agents and its helper can delete an agent without enforcing the confirmation its own instructions require.

Install only if you intend to let this skill modify OpenClaw agents and channel bindings from chat. Treat deletion as high impact; the helper should be hardened to require a matching confirmation flag before running delete, and use should be limited to trusted workspaces where agent reconfiguration is acceptable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/example.py:42

Finding

Destructive Agent Deletion Bypasses the Required Confirmation

Content

View full analysis

Vulnerability Details

File Location: scripts/example.py, lines 42–43 and 65–66
Vulnerability Type: Missing authorization-style confirmation for a destructive operation
Risk Level: Medium

Vulnerable Code

python

p_delete = sub.add_parser("delete")
p_delete.add_argument("name")

python

elif args.action == "delete":
    result = run(["openclaw", "agents", "delete", args.name])

The required safety policy appears in SKILL.md, lines 40–42 and 55:

markdown

- Delete:
  - Require explicit confirmation in the same turn for destructive action.
  - Then run: `openclaw agents delete <name>`

markdown

- Treat `agent delete` as destructive: confirm before running.

Technical Analysis

The Skill documentation explicitly requires same-turn confirmation before deleting an agent. However, the deterministic helper accepts only the agent name for its delete subcommand and immediately invokes openclaw agents delete. It has no confirmation option, matching-token check, or interactive confirmation mechanism.

Consequently, the documented safeguard is enforced only through natural-language instructions and can be bypassed whenever the helper is invoked directly or mistakenly called without prior user confirmation. Although subprocess.run receives an argument array and does not introduce shell-command injection here, safe process invocation does not prevent unauthorized or accidental execution of the destructive operation.

Attack Path

1. An attacker, automation error, or misunderstood request causes the helper to be invoked as scripts/example.py delete <agent-name>.
2. The argument parser accepts the target name without requesting confirmation.
3. The delete branch constructs ["openclaw", "agents", "delete", args.name].
4. The helper immediately executes that command.
5. If the caller has sufficient local OpenClaw permissions, the selected agent is d ...[truncated 743 chars]

Remediation

View remediation

Remediation Suggestions

Enforce confirmation inside the executable helper rather than relying solely on Skill instructions:

1. Add an explicit confirmation argument, such as --confirm-delete <agent-name>.
2. Require the confirmation value to exactly match the deletion target.
3. Refuse execution with a nonzero exit status when confirmation is absent or mismatched.
4. Ensure the calling agent obtains explicit confirmation from the user in the same turn before supplying the flag.
5. Where appropriate, first verify that the target exists and display the exact target to be deleted.
6. Add automated tests proving that unconfirmed and mismatched deletion requests cannot invoke openclaw.

Example hardening pattern:

python

p_delete = sub.add_parser("delete")
p_delete.add_argument("name")
p_delete.add_argument("--confirm-delete", required=True)

# ...

elif args.action == "delete":
    if args.confirm_delete != args.name:
        parser.error("Deletion confirmation must exactly match the agent name")
    result = run(["openclaw", "agents", "delete", args.name])

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code largely matches the declared agent-management purpose: it supports listing, creating, binding, switching/channel routing via bind, and deleting OpenClaw agents. However, the description claims it can 'set an agent identity,' which is not implemented anywhere in the code. The code also includes an unbind action that is not declared, though this is a minor extra capability related to the same domain. Additionally, the implementation is a command-line wrapper script, not obviously a chat-integrated skill, so the 'from chat with short commands' framing is only partially supported by the supplied code chunk. Overall, this is a description-behavior mismatch due to the missing identity-setting functionality and slight scope differences.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to execute shell-capable CLI operations (openclaw agents ...) but does not declare any tool scope such as permissions or allowed-tools. That creates an under-specified trust boundary: a host system may permit broader command execution than intended, increasing the risk of unauthorized agent management or command abuse if the skill is invoked in a permissive environment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/example.py (reported line 11)May include surrounding context.

python

def run(cmd):
    p = subprocess.run(cmd, text=True, capture_output=True)
    return {
        "ok": p.returncode == 0,
        "code": p.returncode,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The delete action directly executes an agent deletion command with no confirmation, dry-run, or secondary safety check. In a chat-driven agent-control skill, accidental invocation, ambiguous user intent, or prompt-induced misuse could cause irreversible loss of agent configuration or workspace state more easily than in a manual CLI context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The create, bind, unbind, and switch actions perform state-changing subprocess operations without any user-facing disclosure or confirmation. In an agent-management skill exposed through chat, this increases the chance of unintended reconfiguration, especially when commands are triggered from natural-language requests rather than explicit terminal usage.

Content

No source excerpt is available for this finding.