ClawHub
Back to skill

Security audit

OpenClaw Skill Lazy Loader

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed lazy-loading guide with templates and a local helper script, and I did not find hidden, destructive, or exfiltration behavior.

Install only if you want your agent's AGENTS.md behavior changed to lazy-load skills in future sessions. Review the template before merging it, and keep sensitive information out of SKILL.md, SKILLS.md, and memory catalog files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (35)

Ae1

High
Category
analysis-evasion
Content
| `SKILL.md` | This guide |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Self-Modification

High
Category
Rogue Agent
Content
cp ~/.openclaw/skills/openclaw-skill-lazy-loader/SKILLS.md.template ~/my-agent/SKILLS.md
cp ~/.openclaw/skills/openclaw-skill-lazy-loader/AGENTS.md.template ~/my-agent/AGENTS.lazy.md

# 3. Edit SKILLS.md — fill in your actual skills
# 4. Merge AGENTS.lazy.md into your AGENTS.md
# 5. Test with context_optimizer.py
python3 ~/.openclaw/skills/openclaw-skill-lazy-loader/context_optimizer.py recommend "your next task"
Confidence
85% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Hidden Instructions

High
Category
Prompt Injection
Content
# SKILLS — Available Skills Catalog

<!--
This is your agent's skill index. Load this file at session start (it's lightweight).
Load individual SKILL.md files only when a task actually needs them.
Part of: OpenClaw Skill Lazy Loader (clawhub install openclaw-skill-lazy-loader)
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill metadata explicitly claims strong security properties and even says it is 'verified: true', but it does not declare any concrete tool scope such as allowed-tools or permissions. The document also includes commands, file-copy operations, external URLs, and references to running a helper script, so the absence of explicit capability constraints can let an integrating agent grant broader file, shell, or network access than intended.

Skill Enumeration

Medium
Category
Agent Snooping
Content
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
| SQL / Databases | `skills/sql/SKILL.md` | Queries, schema design, migrations | ~500 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
| SQL / Databases | `skills/sql/SKILL.md` | Queries, schema design, migrations | ~500 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
| SQL / Databases | `skills/sql/SKILL.md` | Queries, schema design, migrations | ~500 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
| SQL / Databases | `skills/sql/SKILL.md` | Queries, schema design, migrations | ~500 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
| SQL / Databases | `skills/sql/SKILL.md` | Queries, schema design, migrations | ~500 tok |
| API Design | `skills/api/SKILL.md` | REST APIs, OpenAPI specs, authentication | ~600 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
| SQL / Databases | `skills/sql/SKILL.md` | Queries, schema design, migrations | ~500 tok |
| API Design | `skills/api/SKILL.md` | REST APIs, OpenAPI specs, authentication | ~600 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
| SQL / Databases | `skills/sql/SKILL.md` | Queries, schema design, migrations | ~500 tok |
| API Design | `skills/api/SKILL.md` | REST APIs, OpenAPI specs, authentication | ~600 tok |
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Static analysis

No suspicious patterns detected.