ClawHub
Back to skill

Security audit

OpenClaw Skill Lazy Loader

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed lazy-loading guide with templates and a local helper script, and I did not find hidden, destructive, or exfiltration behavior.

Install only if you want your agent's AGENTS.md behavior changed to lazy-load skills in future sessions. Review the template before merging it, and keep sensitive information out of SKILL.md, SKILLS.md, and memory catalog files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (35)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md
| `SKILL.md` | This guide |

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
cp ~/.openclaw/skills/openclaw-skill-lazy-loader/SKILLS.md.template ~/my-agent/SKILLS.md
cp ~/.openclaw/skills/openclaw-skill-lazy-loader/AGENTS.md.template ~/my-agent/AGENTS.lazy.md

# 3. Edit SKILLS.md — fill in your actual skills
# 4. Merge AGENTS.lazy.md into your AGENTS.md
# 5. Test with context_optimizer.py
python3 ~/.openclaw/skills/openclaw-skill-lazy-loader/context_optimizer.py recommend "your next task"

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILLS.md.template (reported line 3)May include surrounding context.

text
# SKILLS — Available Skills Catalog

<!--
This is your agent's skill index. Load this file at session start (it's lightweight).
Load individual SKILL.md files only when a task actually needs them.
Part of: OpenClaw Skill Lazy Loader (clawhub install openclaw-skill-lazy-loader)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill metadata explicitly claims strong security properties and even says it is 'verified: true', but it does not declare any concrete tool scope such as allowed-tools or permissions. The document also includes commands, file-copy operations, external URLs, and references to running a helper script, so the absence of explicit capability constraints can let an integrating agent grant broader file, shell, or network access than intended.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · AGENTS.md.template (reported line 34)May include surrounding context.

text
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · AGENTS.md.template (reported line 35)May include surrounding context.

text
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · AGENTS.md.template (reported line 63)May include surrounding context.

text
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILLS.md.template (reported line 23)May include surrounding context.

text
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILLS.md.template (reported line 54)May include surrounding context.

text
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILLS.md.template (reported line 24)May include surrounding context.

text
| Skill | File | Use When | Size |
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILLS.md.template (reported line 25)May include surrounding context.

text
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILLS.md.template (reported line 58)May include surrounding context.

text
|-------|------|----------|------|
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
| SQL / Databases | `skills/sql/SKILL.md` | Queries, schema design, migrations | ~500 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
| SQL / Databases | `skills/sql/SKILL.md` | Queries, schema design, migrations | ~500 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILLS.md.template (reported line 26)May include surrounding context.

text
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
| SQL / Databases | `skills/sql/SKILL.md` | Queries, schema design, migrations | ~500 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILLS.md.template (reported line 62)May include surrounding context.

text
| Python | `skills/python/SKILL.md` | Writing, debugging, or reviewing Python code | ~600 tok |
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
| SQL / Databases | `skills/sql/SKILL.md` | Queries, schema design, migrations | ~500 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
| SQL / Databases | `skills/sql/SKILL.md` | Queries, schema design, migrations | ~500 tok |
| API Design | `skills/api/SKILL.md` | REST APIs, OpenAPI specs, authentication | ~600 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
| SQL / Databases | `skills/sql/SKILL.md` | Queries, schema design, migrations | ~500 tok |
| API Design | `skills/api/SKILL.md` | REST APIs, OpenAPI specs, authentication | ~600 tok |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILLS.md.template (reported line 27)May include surrounding context.

text
| JavaScript / TypeScript | `skills/js/SKILL.md` | Frontend/backend JS, React, Node.js tasks | ~700 tok |
| Git | `skills/git/SKILL.md` | Git commands, PRs, branches, merges | ~400 tok |
| Docker | `skills/docker/SKILL.md` | Containers, images, docker-compose, builds | ~550 tok |
| Browser Automation | `skills/browser/SKILL.md` | Web scraping, UI testing, Playwright | ~800 tok |
| AWS | `skills/aws/SKILL.md` | S3, Lambda, EC2, CloudFormation | ~900 tok |
| SQL / Databases | `skills/sql/SKILL.md` | Queries, schema design, migrations | ~500 tok |
| API Design | `skills/api/SKILL.md` | REST APIs, OpenAPI specs, authentication | ~600 tok |

Static analysis

No suspicious patterns detected.