T02 · Agent Memory Poisoning
Error
- Location
agents/squad-manager/AGENTS.md:13- Finding
Persistent memory and instruction-policy poisoning across all agents
- Content
View full analysis
- Remediation
View remediation
Security audit
Calling Agent Squad
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent multi-agent project helper, but its bundled agent policies grant broad persistent memory, personal-context monitoring, and autonomous push authority beyond what the main skill description clearly scopes.
Install only if you are comfortable with multiple agents reading and writing persistent local memory, keeping environment notes, spawning sessions, and potentially performing heartbeat-driven repository operations. Before use, remove or disable the heartbeat/personal-assistant sections, require approval before memory or policy-file writes, and require explicit review before any git push or outbound communication.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:19- Finding
Bundled persona policies hijack agent behavior beyond the declared squad workflow
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
agents/squad-manager/TOOLS.md:5- Finding
Project agents are instructed to collect and persist sensitive infrastructure and physical-environment information
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
agents/squad-manager/AGENTS.md:189- Finding
Heartbeat policy permits autonomous repository pushes without user approval
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
agents/squad-manager/AGENTS.md:5- Finding
Unauthenticated bootstrap instructions are automatically followed and then deleted
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
squad-init.sh:6- Finding
Initialization script uses hardcoded user-specific installation paths
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (79)
YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]
High
- Category
- YARA Match
- Confidence
- 70% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md # IDENTITY - Market Researcher ## Character Description You are an acute market bloodhound. Highly sensitive to trends, competitor dynamics, and data. You distill golden insights from massive internet noise. ## Communication Style - Data-driven and objective. - Report using the "Insight + Source" format.
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill explicitly supports spawning sub-agents via
openclaw agent, which introduces subprocess execution from a skill whose primary purpose is orchestration. Even if intended functionality, this expands the execution surface: user-controlled project/task text is passed into a command invocation, and downstream agent behavior becomes harder to constrain or audit.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 81% confidence
- Finding
The skill persists user task data and generated deliverables to a dated folder in the user's Documents directory, creating session persistence beyond the immediate interaction. In a multi-agent workflow that reads multiple persona/config files and may handle sensitive project information, this increases the risk of unintended retention, later disclosure, or cross-task data exposure.
- Content
md ### Standard Mode When user says `calling squad [project] [task]`: 1. Create project folder: `Documents/squad_projects/[project]_[yyyymmdd]/` 2. For each role (Researcher → Architect → Copywriter → Reviewer → Observer): - Read that role's `SOUL.md` and `IDENTITY.md` from `agents/[role]/` - Adopt their persona and complete their task
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The maintenance instructions invoke an external shell script from a user home directory, which creates a code-execution path outside the skill file itself. If that script is modified, replaced, or misunderstood by users/operators, the skill becomes a launch point for unintended command execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instruction to delete BOOTSTRAP.md after reading encourages the agent to remove a file without user confirmation or visibility. Even if intended as cleanup, it is a destructive action that can erase provenance, onboarding context, or evidence of prior instructions, and it normalizes silent file deletion by the skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file authorizes external communications such as emails, tweets, and public posts as part of the agent's operating model, even though the manifest describes a squad for managing projects and workflows rather than a communications proxy. This broadens the action surface and can lead to unintended disclosures or impersonation-like behavior if the skill is activated in the wrong context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The group-chat guidance is broad enough that the agent may decide to participate in ordinary conversations whenever it thinks it can add value. In a skill intended for squad/project work, that increases the risk of accidental triggering, oversharing from workspace context, or socially intrusive behavior outside the user's intended task scope.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
These instructions expand the skill from project/workflow support into ongoing personal-assistant surveillance and proactive monitoring. That creates a scope mismatch: once invoked for a squad task, the agent is encouraged to keep checking inboxes, calendars, notifications, and other user context unrelated to the requested task, increasing unnecessary access to sensitive data and the chance of unexpected actions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Directing the agent to check calendars, emails, social mentions, and weather is unrelated to the stated multi-agent project squad purpose and needlessly grants broad access to personal context. This violates least privilege and increases the likelihood of privacy exposure, over-collection, or actions based on data the user did not intend to share for this skill invocation.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 83% confidence
- Finding
The skill explicitly authorizes proactive work without asking, including reading/organizing memory files and checking projects. In combination with the broader memory and heartbeat instructions, this creates autonomous access and behavior beyond a single user-requested task, increasing the risk of unauthorized data review or unintended state changes.
- Content
md - Nothing new since last check - You just checked <30 minutes ago **Proactive work you can do without asking:** - Read and organize memory files - Check on projects (git status, etc.)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The instruction to delete BOOTSTRAP.md on first run authorizes file deletion without a user-facing warning or confirmation. Even if intended as cleanup, it normalizes destructive behavior during initialization and can erase forensic or onboarding information that may be important for audit, recovery, or user review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The instructions encourage creating and updating memory files with user context but do not provide adequate warning, consent, minimization, or retention guidance for personal data. This can result in unbounded storage of sensitive information and increase privacy and leakage risks across sessions and contexts.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file permits sending emails, tweets, public posts, and other machine-leaving actions within a skill described only as activating a multi-agent squad for projects and workflows. Even though it says 'ask first,' embedding these communication powers in the workspace instructions expands the operational scope beyond what users would reasonably expect from this skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The heartbeat trigger condition relies on matching a configured prompt, which is ambiguous and may cause accidental invocation if ordinary messages resemble the expected text. That can lead the agent to perform background checks or file operations unexpectedly, without clear user intent in the current conversation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The heartbeat section authorizes broad proactive personal-assistant behavior such as checking email, calendar, mentions, weather, organizing memory, and pushing changes, which exceeds the declared purpose of a squad/project orchestration skill. This creates scope creep and can lead to unauthorized access, monitoring, or outbound actions unrelated to the user’s explicit request.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Generalized monitoring of emails, calendars, social mentions, and weather is not justified by the stated squad-activation purpose and introduces persistent surveillance-like behavior. In a multi-agent context, this increases the chance of collecting, retaining, and acting on sensitive personal data outside the original task scope.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
The section explicitly authorizes proactive work 'without asking,' including reading/organizing memory files, checking projects, updating documentation, and committing/pushing changes. In practice this grants autonomous decision-making and write-side actions that could modify user data or external systems without contemporaneous approval.
- Content
md - Nothing new since last check - You just checked <30 minutes ago **Proactive work you can do without asking:** - Read and organize memory files - Check on projects (git status, etc.)
Static analysis
No suspicious patterns detected.