Agent Maker

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:25 AM UTC
• Version: 1.0.0

Overview

This skill appears intended to create OpenClaw agents, but its script can create persistent active agents with broad access and can overwrite files at a user-supplied workspace path, so it needs careful review before installation.

Install only if you are comfortable reviewing each generated agent before activation. Use a dedicated workspace under an expected OpenClaw directory, avoid existing or symlinked directories, choose sandbox all for untrusted inputs, set explicit tool allowlists, avoid tier3 unless you truly need standing automation, and handle channel tokens through a proper secret store rather than chat or generated files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/create-agent.sh:157

Finding

Unrestricted Workspace Path Allows Arbitrary File Creation and Overwrite

Content

View full analysis

Vulnerability Details

File Location: scripts/create-agent.sh, lines 157–404
Vulnerability Type: Unrestricted filesystem write destination and unsafe overwrite behavior
Risk Level: High

Vulnerable Code

bash

# ─── Step 1: Create workspace directory ───────────────────────────────
echo -e "${CYAN}[1/6]${NC} ${YELLOW}Creating workspace...${NC}"
mkdir -p "$WORKSPACE"
mkdir -p "$WORKSPACE/memory"
mkdir -p "$WORKSPACE/skills"

# ─── Step 2: Generate workspace files ─────────────────────────────────
echo -e "${CYAN}[2/6]${NC} ${YELLOW}Generating workspace files...${NC}"

# --- SOUL.md ---
cat > "$WORKSPACE/SOUL.md" << SOULEOF
# $NAME $EMOJI
...
SOULEOF

# --- AGENTS.md ---
cat > "$WORKSPACE/AGENTS.md" << AGENTSEOF
...
AGENTSEOF

# --- IDENTITY.md ---
cat > "$WORKSPACE/IDENTITY.md" << IDENTITYEOF
...
IDENTITYEOF

# --- TOOLS.md ---
cat > "$WORKSPACE/TOOLS.md" << TOOLSEOF
...
TOOLSEOF

# --- USER.md ---
cat > "$WORKSPACE/USER.md" << USEREOF
...
USEREOF

# --- HEARTBEAT.md ---
cat > "$WORKSPACE/HEARTBEAT.md" << HEARTBEATEOF
...
HEARTBEATEOF

TODAY=$(date +%Y-%m-%d)
cat > "$WORKSPACE/memory/$TODAY.md" << MEMEOF
...
MEMEOF

Technical Analysis

The script accepts --workspace as an arbitrary path and uses it directly for directory creation and file writes. It does not:

• Canonicalize the destination with realpath.
• Restrict the destination to an approved workspace root.
• Reject symbolic links in the path or at target filenames.
• Check whether the destination already contains files.
• Require confirmation before overwriting existing files.
• Use exclusive file creation semantics.

Shell quoting prevents direct command injection through WORKSPACE, but it does not prevent path abuse. The cat > file redirections truncate existing files and follow symbolic links. Consequently, a user or upstream agent capable of controlling the workspac ...[truncated 1738 chars]

Remediation

View remediation

Remediation Suggestions

1. Define an approved workspace root, such as $HOME/.openclaw/workspaces, and reject destinations outside it.
2. Resolve both the approved root and requested destination with realpath before comparing them.
3. Reject an existing non-empty workspace unless the user supplies a separate explicit overwrite option.
4. Check every destination component and target file with lstat or equivalent logic, rejecting symbolic links.
5. Create files using exclusive semantics and restrictive permissions, such as a controlled umask 077 and no-clobber behavior.
6. Create content in a private temporary directory and atomically rename it into place only after validation succeeds.
7. If updates to an existing workspace are supported, back up each affected file and present an exact change summary before applying it.
8. Ensure the script refuses privileged execution unless it is explicitly required and justified.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/create-agent.sh:16

Finding

Generated Agents Default to Active Execution Without Sandbox or Tool Restrictions

Content

View full analysis

Vulnerability Details

File Location: scripts/create-agent.sh, lines 16–27 and 141–153
Vulnerability Type: Insecure default permissions and fail-open configuration
Risk Level: Medium

Vulnerable Code

bash

TOOLS_ALLOW=""
TOOLS_DENY=""
AUTONOMY="tier2"
HEARTBEAT_EVERY=""
HEARTBEAT_TARGET="none"
HEARTBEAT_ACTIVE_HOURS=""
SANDBOX="off"

bash

# Derive autonomy description
case "$AUTONOMY" in
  tier1)
    AUTONOMY_DESC="Read-only and draft mode. You observe, analyze, and propose actions for human approval. You do NOT execute changes or send messages directly."
    ;;
  tier2)
    AUTONOMY_DESC="Active execution mode. You can read, write files, search the web, and take actions within your domain. Confirm with the user before irreversible or high-impact actions."
    ;;
  tier3)
    AUTONOMY_DESC="Fully proactive mode. You operate autonomously on schedules, take initiative, and execute standing orders without per-action approval. Report outcomes and escalate exceptions."
    ;;
  *)
    AUTONOMY_DESC="Active execution mode. You can read, write files, search the web, and take actions within your domain. Confirm with the user before irreversible or high-impact actions."
    ;;
esac

The associated configuration logic only emits sandbox and tool restrictions when the caller explicitly requests them:

bash

# Add sandbox if not off
if [[ "$SANDBOX" != "off" ]]; then
  NEW_AGENT_JSON="$NEW_AGENT_JSON,
  \"sandbox\": {
    \"mode\": \"$SANDBOX\",
    \"scope\": \"agent\"
  }"
fi

# Add tools allow/deny
if [[ -n "$TOOLS_ALLOW" ]] || [[ -n "$TOOLS_DENY" ]]; then
  TOOLS_JSON="\"tools\": {"
  if [[ -n "$TOOLS_ALLOW" ]]; then
    ALLOW_ARRAY=$(echo "$TOOLS_ALLOW" | jq -R 'split(",")')
    TOOLS_JSON="$TOOLS_JSON \"allow\": $ALLOW_ARRAY"
    if [[ -n "$TOOLS_DENY" ]]; then
      TOOLS_JSON="$TOOLS_JSON,"
    fi
  fi
  if [[ -n "$TOOLS_DENY" ]];
...[truncated 2810 chars]

Remediation

View remediation

Remediation Suggestions

1. Default generated agents to tier1.
2. Default sandbox mode to all, particularly for agents that process channel messages or other untrusted input.
3. Require an explicit tool allowlist and start with only the minimum tools needed to perform the declared workflow.
4. Treat an omitted tool policy as an error or apply a documented minimal baseline rather than inheriting all platform tools.
5. Strictly validate AUTONOMY and SANDBOX against supported values and terminate on invalid input.
6. Require explicit confirmation before enabling tier 2, tier 3, host filesystem access, command execution, outbound messaging, connected-device execution, or sandbox mode off.
7. Derive recommended permissions from the discovery answers and display the final effective permissions before applying the gateway patch.
8. For externally reachable agents, automatically deny high-risk tools such as exec, unrestricted file writes, browser automation, device execution, and outbound session messaging unless individually justified.
9. Add automated tests verifying that a default invocation produces a sandboxed, read-only agent with a minimal tool set.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · README.md (reported line 203)May include surrounding context.

sessions_list({ kinds: ["agent"], limit: 10, messageLimit: 3 })

text

### Send Messages to Agents
```typescript
sessions_send({ label: "watson", message: "Research competitor X" })

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README promotes autonomous/proactive agents, scheduled execution, and channel bindings, but it does not prominently warn users about privacy exposure, unintended actions, or system-impact risks from granting tools and automation. In a skill whose purpose is to generate agent workspaces and gateway configuration, this omission can lead users to deploy powerful agents with insufficient safeguards or misunderstanding of operational risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 77% confidence

Finding

The skill recommends inter-agent communication and memory tools without clearly defining data sensitivity boundaries, retention limits, or consent requirements. In this context, an agent-maker can easily create agents that persist or share user data across sessions and other agents, increasing the chance of over-collection or unintended disclosure.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

- `browser` — web browsing and automation
- `web_search` — search the web (multiple providers)
- `web_fetch` — fetch URL content
- `image_generate` — create images
- `image` — analyze/understand images
- `memory_search`, `memory_get` — semantic memory recall
- `sessions_list`, `sessions_send`, `sessions_history` — inter-agent communication

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill encourages setup of messaging channels that require bot tokens or accounts, but it omits guidance on secure credential handling, storage, rotation, and redaction. This creates a realistic risk that users will paste secrets into chat, store them in workspace files, or configure channels insecurely, leading to credential exposure and account compromise.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The agent creation flow provisions persistent agent state under the user's OpenClaw directory, but it does not call out persistence risks such as lingering sensitive prompts, memory, configs, and long-lived automation. In an agent factory skill, persistence is especially significant because it creates durable execution contexts that may continue operating or retaining data beyond the user's immediate intent.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md

## Agent Creation

After gathering all requirements, create the agent using this process:

### Step 1: Create agent via CLI

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill states that the creation process automatically updates gateway configuration and restarts the gateway, but it does not require an explicit warning or confirmation before performing service-affecting actions. In an agent-creation workflow, this can surprise the user, interrupt running sessions, and apply unintended configuration changes to a live environment.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/create-agent.sh (reported line 135)May include surrounding context.

sh

PERSONALITY="Professional, helpful, and focused on delivering quality results in your domain of expertise."
fi
if [[ -z "$BOUNDARIES" ]]; then
  BOUNDARIES="Do not make irreversible changes without confirmation. Escalate to the user when uncertain. Stay within your area of expertise."
fi
if [[ -z "$WORKFLOW" ]]; then
  WORKFLOW="1. Receive task or trigger\n2. Analyze requirements and context\n3. Execute using available tools\n4. Document results in memory\n5. Report completion or escalate issues"

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/create-agent.sh (reported line 258)May include surrounding context.

sh

PERSONALITY="Professional, helpful, and focused on delivering quality results in your domain of expertise."
fi
if [[ -z "$BOUNDARIES" ]]; then
  BOUNDARIES="Do not make irreversible changes without confirmation. Escalate to the user when uncertain. Stay within your area of expertise."
fi
if [[ -z "$WORKFLOW" ]]; then
  WORKFLOW="1. Receive task or trigger\n2. Analyze requirements and context\n3. Execute using available tools\n4. Document results in memory\n5. Report completion or escalate issues"

Static analysis

No suspicious patterns detected.