自定义多agent

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:31 AM UTC
• Version: 1.0.0

Overview

This skill is not malicious, but it creates persistent, auto-loaded agent templates that can override built-in behavior and its file-write behavior is inconsistently described.

Review this skill before installing if you rely on stable agent behavior. Only use custom templates you trust, watch for same-ID templates overriding built-ins, and confirm before allowing any generated content to be saved into SOUL.md or ~/.openclaw/workspace/agent-templates/.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

~/.openclaw/workspace/agent-templates/

text

- ✅ **Persistent** - Never overwritten by skill updates
- ✅ **Highest priority** - Override system templates with same ID
- ✅ **User full control** - Create, edit, delete anytime
- ✅ **Auto-detected** - Skill automatically finds and loads them

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

md

- User templates persist across skill updates
- System templates may change with skill updates
- User can override system templates with same ID
- Templates are markdown files, easy to edit manually

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: writing-agent-creator
description: |
  Generate writing agent configurations for OpenClaw. Use when the user wants to:
  (1) Create specialized writing agents (tech, marketing, academic, business, creative)
  (2) Add custom agent templates (persisted, won't be overwritten)
  (3) Generate sub-agent spawn instructions
  (4) List available agent templates

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow examples and interactive prompts are presented entirely in Chinese, including selection instructions and data-entry guidance, with no indication that the user can choose another language. This creates a natural-language policy concern because the skill appears to impose a specific language/locale without user opt-in.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The registry explicitly instructs users to create persistent files under ~/.openclaw/workspace/agent-templates/ and notes that they are auto-detected and not overwritten. Persistent, auto-loaded prompt templates can become a durable prompt-injection foothold: once a malicious or careless template is placed there, later agent runs may silently pick it up and alter behavior across sessions.

Content

Scanner excerpt · references/agent-registry.md (reported line 20)May include surrounding context.

md

See: `~/.openclaw/workspace/agent-templates/README.md`

Quick method:
1. Create file: `~/.openclaw/workspace/agent-templates/my-template.md`
2. Use format below
3. Done! Skill will auto-detect it.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The template format and many prompt templates prescribe Chinese-language field comments and system prompt content such as '你是一名…' and '系统提示词', with no indication that users may choose another language. This creates a language policy concern because the skill appears to default to a specific language without opt-in or documented locale justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file defines activation triggers, and several trigger lists use short generic terms like '文档', '教程', '报告', and '测试' without any scope limits or exclusion conditions. Such broad terms can match many ordinary requests and make it unclear when a specific template should activate versus when it should not.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The multi-mode SOUL.md template hardcodes Chinese-language instructions and examples without checking user locale or preferences. While not a classic code-execution issue, this can cause prompt misalignment, deceptive output expectations, and unsafe operator behavior if users cannot accurately review generated agent instructions before reuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The single-agent template enforces Chinese section headings and output conventions regardless of the user's language context. This creates a trust and usability risk because generated agent configurations may be misunderstood, misapplied, or propagated without proper review by users expecting another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The quick prompt template requires Chinese-language prompting without offering a locale choice, which can produce opaque or unintended prompts for users operating in other languages. In a prompt-generation skill, forced language can materially increase the risk of user error and reduce the ability to audit generated instructions before they are used elsewhere.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template tells the user that SOUL.md has been created or updated and lists a concrete target path, which conflicts with the skill metadata stating the skill only generates configurations and does not modify existing files. In an agent setting, this mismatch can mislead downstream systems or users into believing file writes are expected or already performed, increasing the chance of unintended persistence or unauthorized file modification workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The template scaffold tells users to define 'trigger: [关键词1, 关键词2]' but provides no guidance on required specificity, allowed scope, or examples of overly broad triggers to avoid. This can lead to future templates using ambiguous activation phrases that collide with normal conversation.

Content

No source excerpt is available for this finding.