Security audit

Agent Maker

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it claims, but it can create persistent autonomous OpenClaw agents with broad access unless the user carefully limits and reviews the configuration.

Install only if you intend to create autonomous OpenClaw agents. Start with tier1, explicit tool allow/deny lists, and sandboxing for any untrusted input; review the printed gateway config patch before allowing it to apply; avoid heartbeat, cron, external channel bindings, or bot credentials unless they are necessary and stored securely.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README prominently advertises fully proactive agents, heartbeat automation, channel routing, and inter-agent coordination, but it does not pair those capabilities with a clear warning that the generated agents may autonomously send messages or take actions affecting external systems. In the context of an agent-creation skill, this omission materially increases the risk that users enable autonomous behavior without understanding its operational or security consequences.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The installation and quick-start flow includes copying files into the OpenClaw skills directory and patching gateway configuration, but does not clearly warn that these commands modify local configuration and enable new behavior in the agent platform. Users may run the commands assuming they are read-only setup steps, when they actually persist changes that can activate agent capabilities.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The direct script examples create agent workspaces and configure autonomy, heartbeat scheduling, and sandbox settings, yet the README lacks a prominent warning that these examples generate persistent files and may create agents capable of autonomous actions. In this skill's context, generated configurations can materially change how an AI system behaves, so omission of that warning is security-relevant.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs the agent to restart the gateway and apply configuration changes automatically, but it does not explicitly warn the user that these actions modify live system state and may interrupt service. In an agentic context, silent config mutation and service restarts can cause unintended downtime, overwrite prior configuration, or apply unsafe settings before the user has a chance to review them.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill discusses integrating channels such as Telegram, Discord, Slack, and WhatsApp and notes that bot tokens or account credentials are needed, but it does not include guidance to handle those secrets securely. This creates a realistic risk that users will paste tokens into chat, store them in workspace files, or expose them via logs or generated configs.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The script writes directly to the shared OpenClaw gateway configuration via `openclaw gateway config.patch` without an explicit pre-write warning, confirmation prompt, or dry-run safeguard. Because this skill creates autonomous agents and can alter global routing/bindings behavior, an operator can unintentionally apply persistent system-wide changes from untrusted or mistaken input.

Static analysis

No suspicious patterns detected.