OpenClaw Learning Coach

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:49 AM UTC
• Version: 1.0.1

Overview

This learning coach is mostly educational, but it tells the agent to create recurring study tasks despite also saying it will not change the user's environment.

Review the scheduling behavior before installing. The teaching content and documentation use look ordinary, but only use this skill if you are comfortable with it creating recurring study tasks after approval; ask the agent to preview the exact schedule, duration, and removal steps before allowing task creation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The documented safety boundary says not to run commands or change environments, yet the skill later directs the agent to schedule recurring tasks. Even with confirmation, this is a side-effecting operation that can modify system or platform state, so the internal contradiction can mislead users and downstream policy enforcement about the skill's true capabilities.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill states it will only provide guidance and not perform actions, but later instructs the agent to create recurring scheduled tasks after user confirmation. That contradiction matters because scheduling creates persistent system state and extends the agent's influence beyond the current session, which is more than passive teaching.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Automation Schedule
Ask each time whether the user wants a fixed study schedule.
Do not create any scheduled tasks without explicit confirmation; only describe the optional arrangement.
After confirmation, schedule recurring tasks to deliver the learning plan.
Once scheduled, remind the user to check the task list and confirm it was added.

• Confidence: 93% confidence
• Finding: Creating a recurring scheduled task introduces session persistence: the skill's effects continue after the immediate conversation ends. In a teaching context this is not inherently malicious, but it is still risky because persistent automation can surprise users, accumulate notifications or actions over time, and be harder to notice or revoke than a one-time response.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs the agent to create recurring scheduled tasks, but the skill description presents it as a learning coach and does not prominently disclose that it may establish persistent automation. Users choosing an educational skill may not reasonably expect system-impacting behavior, increasing the risk of surprise actions or overbroad consent.

Static analysis

No suspicious patterns detected.