ClawHub
Back to skill

Security audit

Multica Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a task-manager for other agents, but it can create/control work and send cross-session messages from broad trigger phrases without clear confirmation or scope limits.

Review this skill before installing if your Multica account can create, stop, restart, or message real agents. Use it only where broad automatic triggers are acceptable, avoid putting sensitive data in task titles, and prefer requiring confirmation before task creation, control actions, fallback sessions_send messaging, or logging.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:11
Finding

Agent Role and Behavioral Instruction Hijacking

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:11-40
Vulnerability Type: Agent role and behavioral instruction hijacking
Risk Level: High

Vulnerable Code Snippet

The following is an English rendering of the relevant source instructions:

markdown
## Role Definition
You (QClaw) now play the role of a human manager.
- Execution team: Baymax (coordinator), Hermes (operator), and Jingang (assistant).
- Your responsibilities: Monitor task status, publish tasks, validate results,
  and summarize output for the user.

## Keywords
When the user says any of the following phrases, automatically activate this skill:

- Start task
- Assign task
- Begin discussion
- Check progress
- Task status
- Summarize results
- Pause task
- Stop current task
- Restart Multica

Technical Analysis

The Skill directs the host Agent to assume a new identity and managerial role when loaded. It also establishes automatic activation based on broad, ordinary task-management phrases.

These instructions do not merely describe optional functionality. They modify the Agent's current-session behavior by defining its identity, authorized user, responsibilities, activation conditions, and access to external task-management operations. Phrases such as “check progress,” “assign task,” or “stop current task” may occur in unrelated contexts but are treated as authorization to activate the Skill.

The Skill does not require explicit invocation, confirmation, or verification that a triggering phrase was intended to authorize a state-changing Multica operation. It also does not distinguish read-only requests from operations that create, stop, or redirect work.

Attack Path

  1. The Skill is loaded into an Agent session.
  2. Its role instruction replaces or influences the Agent's existing role with the designated manager identity.
  3. A user or untrusted message includes one of the broad trigger phrases.
  4. The ...[truncated 1003 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove instructions that replace the host Agent's identity or claim that it is a human manager.
  2. Require explicit Skill invocation instead of automatic activation from ordinary phrases.
  3. Require confirmation immediately before every state-changing operation, including task creation, assignment, stopping, restarting, and cross-session messaging.
  4. Separate read-only monitoring commands from state-changing commands and assign different authorization requirements.
  5. Verify the requesting user's authorization using platform-provided identity data rather than a name embedded in the Skill text.
  6. Display the exact target Agent, title, message, and proposed operation before requesting confirmation.
  7. Treat task text, issue comments, and messages from other Agents as untrusted data rather than executable instructions.
  8. Apply least-privilege Multica credentials and restrict the manager account to approved projects and Agents.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:46
Finding

Shell Command Injection Through Unsanitized Task Parameters

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:46-50
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code Snippet

The following is an English rendering of the documented command template:

bash
# Create an issue and assign it to the selected Agent.
multica issue create --title "TASK_TITLE" --assignee <agent_name> --message "TASK_DESCRIPTION"

# Record the operation in a local log.
echo "[$(date)] Task assigned to $AGENT: $TITLE" >> ~/.openclaw/workspace/logs/multica-tasks.log

Technical Analysis

The workflow expects values derived from a user's task request to be inserted into shell commands. The task title, task description, Agent name, and log title are not accompanied by validation, escaping, length restrictions, or a requirement to use an argument-vector execution API.

Quoting a substituted value with double quotes is not sufficient when a command is assembled as a shell string. Shell constructs such as command substitution remain active inside double quotes, and an improperly escaped quote can terminate the intended argument and introduce additional shell syntax.

The logging command also expands $AGENT and $TITLE inside a double-quoted shell expression. If those variables contain attacker-controlled shell syntax and were assigned or interpolated unsafely, the command can evaluate unintended substitutions while writing the log entry.

The vulnerability is exploitable when the Agent implements the documented pseudocode by concatenating or interpolating user-controlled values into a command string passed to a shell. Using a process API with a fixed executable and separate argument array would prevent shell interpretation.

Attack Path

  1. An attacker submits a task request containing shell syntax in the title or description.
  2. The Agent extracts that content as the issue title, message, or logging value.
  3. Following the Skill instructions, ...[truncated 1386 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not build commands by concatenating or interpolating user-controlled strings into shell source.

  2. Invoke the Multica executable using a process API with a fixed argument array, for example:

    python
    subprocess.run(
    [
        "multica", "issue", "create",
        "--title", validated_title,
        "--assignee", validated_assignee,
        "--message", validated_message,
    ],
    shell=False,
    check=True,
)

  3. Restrict assignees to a fixed allowlist of canonical identifiers and reject all other values.

  4. Apply explicit type, character, and length validation to titles and messages.

  5. Write logs through a language-native file API rather than an echo shell command.

  6. Encode control characters in log fields to prevent forged or multiline log entries.

  7. Avoid exposing credentials through command-line arguments, logs, error messages, or subprocess environments.

  8. Run Multica operations under a dedicated least-privilege account.

  9. Add security tests using quotes, command substitutions, separators, newlines, redirections, and excessively long values.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list includes broad, natural-language phrases like '开始讨论', '检查一下', and '给我看看输出' that can appear in ordinary conversation and unintentionally activate task-dispatch behavior. In this skill's context, accidental activation can cause real side effects such as creating issues, querying agent state, or initiating multi-agent work without explicit user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

The workflow persists task details to a local log under ~/.openclaw/workspace/logs, creating durable storage of agent names and task titles. If tasks contain sensitive operational or personal data, this persistence can expose information to other local processes or future sessions beyond the user's immediate expectation.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

bash
# 1. 创建 Issue 并分配给指定 Agent
multica issue create --title "任务标题" --assignee <agent_name> --message "任务详细描述"

# 2. 记录到本地日志
echo "[$(date)] 发布任务给 $AGENT: $TITLE" >> ~/.openclaw/workspace/logs/multica-tasks.log

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly logs task metadata to a local file and supports direct agent messaging via a fallback channel, but it does not describe consent, retention, access controls, or what sensitive data may be propagated. This creates a privacy and data-handling risk because user-provided task content may be persisted locally or sent to agent sessions without adequate notice or minimization.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md
**用户**: “启动任务，让大白分析一下上个月的财务报表。”
**QClaw (你)**:
1. 识别触发词 `启动任务`。
2. 执行: `multica issue create --title "财务分析" --assignee 大白 --message "分析上个月的财务报表"`
3. 回复: “✅ 任务已发布给大白，Issue ID: xxxxxxxx。我会监控进度。”

**用户**: “查看进度。”

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md
**用户**: “启动任务,让大白分析一下上个月的财务报表。”
**QClaw (你)**:
1. 识别触发词 `启动任务`。
2. 执行: `multica issue create --title "财务分析" --assignee 大白 --message "分析上个月的财务报表"`
3. 回复: “✅ 任务已发布给大白,Issue ID: xxxxxxxx。我会监控进度。”

**用户**: “查看进度。”