OpenClaw Agent Creator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:42 PM UTC
• Version: 1.0.0

Overview

This skill is coherent for managing OpenClaw agents, but it can create persistent scheduled agents and includes under-scoped shell-evaluated cron prompts.

Review carefully before installing. Use this only in an OpenClaw environment where you intend the agent to edit ~/.openclaw, restart the gateway, create cron jobs, and send Telegram messages. Require explicit review of every file change and cron payload, reject untrusted agent IDs or prompt text containing shell syntax, and avoid scheduled prompts that run arbitrary commands.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/config-schema.md:109

Finding

Arbitrary Command Execution Through Shell Substitution in Cron Prompts

Content

View full analysis

") | .match.peer.id' ~/.openclaw/openclaw.json Use the output as the target for all Telegram messages in this task. ``` - **Date injection**: `$(date '+%A, %B %d, %Y')` after the preamble - **Explicit constraints**: source allowlists, recency rules, format templates - **Delivery instructions**: use `target=''` placeholder (resolved by the preamble) ``` ### Technical Analysis The documented cron configuration permits `$(...)` expressions in `payload.message` and states that they are evaluated before the prompt reaches the LLM. This crosses a trust boundary: text intended to serve as an LLM prompt is also interpreted as shell syntax. The Skill creates cron prompts from user-supplied task requirements but does not require validation or escaping of prompt content. It also does not restrict shell substitutions to the documented `date` expressions. Consequently, a malicious requirement containing a substitution such as `$(a ...[truncated 1633 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29

Finding

Command and Path Injection Through Insufficiently Validated Agent Identifiers

Content

View full analysis

/memory mkdir -p ~/.openclaw/agents//agent ``` `SKILL.md:116-120`: ```markdown - **Dynamic group ID resolution preamble** (NEVER hardcode Telegram group IDs): ``` FIRST: Resolve your Telegram group ID by running: jq -r '.bindings[] | select(.agentId == "") | .match.peer.id' ~/.openclaw/openclaw.json Use the output as the target for all Telegram messages in this task. ``` ``` Related standalone interpolation in `references/telegram-routing.md:53-65`: ```markdown Never hardcode group IDs in cron job prompts. Instead, have the agent resolve at runtime: ``` FIRST: Resolve your Telegram group ID by running: jq -r '.bindings[] | select(.agentId == "") | .match.peer.id' ~/.openclaw/openclaw.json Use the output as the target for all Telegram messages in this task. ``` Use `target=''` as placeholder in format templates. For standalone scripts, resolve with `jq`: ```bash GROUP_ID=$(jq -r '.bindings[] | select(.agentId == "") | .match.peer.id' ~/.openclaw/openclaw.json) ``` ``` ### Technical Analysis The Skill only specifies that an agent ID must be lowercase and contain no spaces. This is not a sufficient security validation policy. It still permits path traversal components, quotes, shell substitutions, separators, redirection characters, and other metacharacters. The identifier is interpolated into unquoted filesystem paths used by `mkdir`. It is also embedded inside a single-quoted jq program that may later be placed in shell-evaluate ...[truncated 1689 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

Add to `agents.list[]`. See [references/config-schema.md](references/config-schema.md) for all valid fields.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md

Add to `agents.list[]`. See [references/config-schema.md](references/config-schema.md) for all valid fields.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md

lf-healing pattern ensures cron jobs survive Telegram group ID migrations. See [references/prompt-patterns.md](references/prompt-patterns.md) for full patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

md

lf-healing pattern ensures cron jobs survive Telegram group ID migrations. See [references/prompt-patterns.md](references/prompt-patterns.md) for full patterns

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The schema explicitly states that $(...) shell substitution works in scheduled prompt payloads without any warning or constraints, which normalizes command execution inside configuration data. In a skill whose purpose is creating agents and cron jobs, this materially increases the risk that untrusted or variable-derived content gets embedded into scheduled prompts and executed on the host, enabling command injection or unintended local command execution.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill is designed to create and modify persistent agent state in ~/.openclaw/, including workspaces, agent directories, openclaw.json, and cron/jobs.json. That persistence is not inherently malicious, but it becomes security-relevant because invoking the skill can establish long-lived configuration changes, scheduled tasks, and routing behavior that survive the current session and may be difficult to notice or roll back.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: claw-agent-creator-archit
description: >
  Create new OpenClaw agents for Arch's multi-agent system. Use this skill when asked to
  create, add, or set up a new OpenClaw agent, or when adding an agent to the system defined
  in ~/.openclaw/. Covers the full lifecycle: directory creation, workspace files (SOUL.md,
  IDENTITY.md, etc.), openclaw.json config, Telegram routing (bindings + groups + mention

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill description is broad enough to activate on common agent-administration or configuration tasks, which increases the chance it will be invoked in situations involving sensitive files under ~/.openclaw/. Because the skill includes operational steps that modify routing, cron jobs, and agent configuration, accidental over-invocation could cause unintended system changes or expose sensitive local context beyond a narrowly scoped purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instruction 'Don't ask permission. Just do it.' encourages autonomous action before user confirmation and applies broadly to reading multiple workspace files at session start. In an agent-creation skill that manages identities, memory, configs, routing, and cron jobs, this kind of blanket directive can normalize acting on local state without explicit user awareness, increasing the chance of unintended data access or policy bypass.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · assets/templates/AGENTS.md (reported line 32)May include surrounding context.

md

## Safety

- Don't exfiltrate private data. Ever.
- Don't run destructive commands without asking.
- `trash` > `rm` (recoverable beats gone forever)
- When in doubt, ask.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/bugs-and-pitfalls.md (reported line 86)May include surrounding context.

md

### Vector Dimension Mismatch

**Symptom**: `expected dim: 768, got 1536`
**Fix**: Pre-create collections: `curl -X PUT .../collections/memories -d '{"vectors":{"size":768,"distance":"Cosine"}}'`

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The description says groupChat.mentionPatterns are 'Patterns that trigger this agent in group chats' but does not define how specific those patterns must be, how matching works, or any exclusions. Without negative examples or scope constraints, common or loosely chosen mention patterns could cause unintended activations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This guidance explicitly tells the agent to read a local configuration file to resolve a Telegram group ID and then use it for outbound messaging, without any requirement for user consent, data minimization, or validation that the destination is appropriate for the current task. In an agent-creation skill, this is more dangerous because it normalizes local file access plus external message delivery as a reusable prompt pattern, which can enable unintended data disclosure or unauthorized messaging if reused in broader contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The report pattern instructs the agent to run arbitrary commands and send the results to Telegram, again without any warning, approval gate, or constraints on what commands may access or what data may be exfiltrated. In the context of a skill designed to create and configure autonomous agents and cron jobs, this increases risk because the pattern can be copied into automated workflows that execute periodically and transmit sensitive local output off-host.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.