New Agent Setup

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:34 AM UTC
• Version: 1.0.0

Overview

This is a coherent agent-onboarding runbook, but it asks for credentials and creates durable automation with too little scoping or cleanup guidance.

Only use this skill if you control the OpenClaw environment and intend to let it change agent configuration, store a Discord bot token locally, add a recurring cron job, and route future work through Mission Control. Before installing, reduce Discord permissions to the minimum needed, protect or externalize the bot token, validate agent IDs and roles before shell use, require explicit approval for cron and shared OneDrive access, and document how to remove the cron entry, heartbeat state, memory entries, and bot access.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (5)

T06 · System Persistence

Error

• Location: references/checklist.md:155

Finding

Recurring Mission Control Execution Through User Crontab

Content

View full analysis

,,... * * * * MC_AGENT= ~/.openclaw/skills/mission-control/mc checkin >> ~/.openclaw/logs/mc-checkin.log 2>&1") | crontab - ``` ``` The persistence mechanism is also required by `SKILL.md:35-37`: ```markdown 7. Add staggered cron job for `mc checkin` (check existing slots first) ``` ### Technical Analysis The Skill instructs the operator to modify the user's crontab so that the Mission Control executable runs repeatedly after setup has finished. This is cross-session persistence under the privileges of the account that installs the cron entry. Periodic check-ins may support agent coordination, but an operating-system-level scheduled task is not minimally necessary merely to create and connect an OpenClaw agent. The procedure provides no explicit informed-consent gate, integrity verification for the `mc` executable, idempotent installation, lifecycle limit, or uninstall process. The cron entry invokes `~/.openclaw/skills/mission-control/mc` by a mutable filesystem path. Anyone able to replace or modify that executable after installation obtains repeated execution through a trusted-looking scheduled task. Re-running the setup can also append duplicate entries because the command preserves the existing crontab and unconditionally adds another line. ### Attack Path 1. The operator follows the checklist and installs the cron entry. 2. The entry persists after the setup session and invokes `mc checkin` repeatedly. 3. An attacker or compromised component with write access to the Mission Control executable modifies `~/.openclaw/skills/mission-control/mc`. 4. At the next scheduled interval, ...[truncated 515 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: references/checklist.md:125

Finding

Persistent Agent Control Through Mandatory HEARTBEAT Instructions

Content

View full analysis

~/.openclaw/skills/mission-control/mc inbox --unread` * Run: `MC_AGENT= ~/.openclaw/skills/mission-control/mc list --status pending` * Run: `MC_AGENT= ~/.openclaw/skills/mission-control/mc checkin` * Claim and work on any pending tasks assigned to ## 2. * ... ## 3. Task Completion * After completing a task: `MC_AGENT= ~/.openclaw/skills/mission-control/mc done -m "what I did"` * For urgent tasks: notify Gus via sessions_send at `agent:gus:discord:channel:1478790371902492916` ## Rules * Late night (11pm to 7am): Only work on tasks, do not send unsolicited messages * If nothing needs attention: respond HEARTBEAT_OK * Do not message Tom directly — go through Gus ``` ### Technical Analysis The generated `HEARTBEAT.md` does more than configure a new agent. It establishes a persistent priority rule requiring Mission Control to run “always first,” instructs the agent to claim and perform centrally supplied tasks, hard-codes an escalation destination controlled by a particular agent, and prohibits direct communication with the owner. These directives alter the agent's operational goals and trust boundaries. Control over the Mission Control task queue or the hard-coded Gus session can consequently influence future agent actions. The instructions do not require owner confirmation, validate task provenance, restrict tasks to the declared role, or define safety boundaries for task execution. ### Attack Path 1. Setup creates `HEARTBEAT.md` in the new agent's workspace. 2. Future heartbeat cycles load and follow the persistent instructions. 3. The agent queries Mission Control for ...[truncated 762 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: references/checklist.md:164

Finding

Operational Routing State Written Into Long-Term Agent Memory

Content

View full analysis

/MEMORY.md` ```markdown # MEMORY.md — Long Term Memory **Purpose:** Durable facts, active projects, and pointers. Details live in daily files — semantic search holt sie wenn gebraucht. **Regel:** Niemals vollständigen Projektinhalt hier ablegen. Nur: Was existiert + Suchbegriff für `memory_search`. --- ## Memory-Regel: Projektkontext Details von Projekten **nicht** vollständig hier ablegen — das bläht den Context auf. Stattdessen: kurzer Pointer-Eintrag + `memory_search("Projektname")` wenn Details gebraucht werden. Beispiel: - **p-xyz** — Kurzbeschreibung → Details: `memory_search("p-xyz")` --- Review and update this file regularly. Daily files (memory/YYYY-MM-DD.md) are raw notes. This file is curated pointers. ``` ### 3.8 Session-Key in MEMORY.md speichern Format: `=\`agent::discord:channel:\`` ``` ### Technical Analysis The Skill mandates creation of long-term memory and stores an operational session-routing identifier in that memory. Long-term semantic memory is intended to influence future sessions, so setup-authored content can survive beyond onboarding and become trusted context later. The session key is a routing identifier rather than a password, but placing operational control data in semantic memory mixes configuration with agent-authored knowledge. Combined with the HEARTBEAT control rules, this can preserve installer-selected routing and coordination assumptions across future sessions without validation or provenance enforcement. ### Attack Path 1. The installer creates the mandatory `MEMORY.md`. 2. Installer-selected routing information is written into durable agent memory. 3. Future sessions load or retrieve the stored st ...[truncated 688 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/checklist.md:45

Finding

Discord Bot Is Granted Permissions Beyond Its Messaging Requirements

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/checklist.md:117

Finding

Unvalidated Setup Values Are Interpolated Into Shell and Cron Commands

Content

View full analysis

~/.openclaw/skills/mission-control/mc register --role "" ``` ``` The agent identifier is also inserted into a persistent shell command: ```bash (crontab -l; echo ",,... * * * * MC_AGENT= ~/.openclaw/skills/mission-control/mc checkin >> ~/.openclaw/logs/mc-checkin.log 2>&1") | crontab - ``` ### Technical Analysis The agent ID and role originate from setup information but are placed into shell command templates without a stated validation or escaping requirement. The role is enclosed in double quotes, which still permit command substitution using syntax such as `$(...)` and backticks when interpreted by a shell. The unquoted agent ID can contain whitespace, separators, redirection operators, or other shell metacharacters. The cron template creates an additional persistence risk. If a malicious identifier is embedded into the generated crontab line, the injected command may be executed repeatedly instead of only during setup. Exploitation requires the operator or automation to substitute an attacker-controlled value into these templates and execute the resulting shell command. ### Attack Path 1. An attacker supplies or influences a crafted agent ID or role during onboarding. 2. The value contains shell syntax, such as command substitution or a command separator. 3. The setup process substitutes the value into the documented command without validation. 4. The operator executes the generated command in a shell. 5. The shell evaluates the injected syntax with the operator's privileges. 6. If the payload is placed in the cron template, it is saved in the user's crontab and executes again on future scheduled runs. ### Impact A ...[truncated 393 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (14)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions require restarting the gateway and modifying system cron, which are host-administration actions with persistence implications. For a skill without clearly declared administrative scope, these actions are dangerous because they let the workflow alter system behavior beyond a single task and can be repurposed for unauthorized persistence or service disruption.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/checklist.md (reported line 158)May include surrounding context.

• Late night (11pm to 7am): Only work on tasks, do not send unsolicited messages
• If nothing needs attention: respond HEARTBEAT_OK
• Do not message Tom directly — go through Gus

text

**Wichtig:** Niemals leer lassen — leere HEARTBEAT.md = Heartbeat wird übersprungen!

### 3.6 System-Cron ergänzen
Nächsten freien Minuten-Slot wählen (bestehende Belegung prüfen mit `crontab -l`):
```bash
(crontab -l; echo "<minute>,<minute+10>,...  * * * * MC_AGENT=<agent-id> ~/.openclaw/skills/mission-control/mc checkin >> ~/.openclaw/logs/mc-checkin.log 2>&1") | crontab -

Aktuelle Belegung:

• Minute 0: gus
• Minute 1: walt
• Minute 2: jesse
• Minute 3: skyler
• Minute 4: mike
• Minute 5: nächster Agent

3.7 MEMORY.md erstellen ⚠️ PFLICHT

Datei: ~/.openclaw/workspace-<agent-id>/MEMORY.md

markdown

# MEMORY.md — Long Term Memory

**Purpose:** Durable facts, active projects, and pointers. Details live in daily files — semantic search holt sie wenn gebraucht.
**Regel:*

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description is broadly scoped to requests like 'create, add, or onboard a new agent,' which can trigger the skill for common administrative phrasing without clear guardrails or authorization checks. In a skill that performs infrastructure and configuration changes, over-broad activation increases the chance of unintended execution on ambiguous user requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instructions involve handling sensitive secrets like Discord bot tokens, modifying openclaw.json, registering agents, creating cron jobs, writing session keys to MEMORY.md, and sending onboarding messages, but they provide no explicit warning, consent boundary, or secret-handling controls. This creates a realistic risk of credential exposure, unsafe persistence of sensitive data, and unauthorized operational changes if the skill is invoked in the wrong context.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

- Discord Channel ID (after channel is created by Tom)

**Phase 2 — Manual steps by Tom (before any config):**
- Create Discord bot in Developer Portal, invite to server
- Create Discord channel (lowercase agent name), move to "Agent Direct Lines" category
- Sync permissions with category, add bot user with all permissions set to Allow
- Prepare avatar image: `avatar-<agent-id>.png` (transparent background)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The checklist explicitly directs operators to collect a Discord bot token and application identifiers for provisioning a new agent, which means the skill handles live credentials and account setup. In an unscoped skill with no clear security controls, this expands capabilities into secret handling and external account access, increasing the risk of credential exposure or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document tells the operator to obtain a Discord bot token but does not prominently warn that it is a secret equivalent to account credentials. That omission increases the likelihood the token will be copied, stored, or transmitted insecurely, enabling takeover of the bot if exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The checklist instructs placing the bot token directly into openclaw.json, a local configuration file, without any mention of file permissions, encryption, or secret isolation. Storing credentials in plaintext configuration materially increases exposure through backups, logs, screenshots, or local compromise.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The cron instructions establish recurring automated execution for agent check-ins, which is a persistence mechanism on the host. Even if intended for legitimate automation, persistence in a skill is security-relevant because it survives the current session and could be abused to maintain unauthorized activity or conceal ongoing control.

Content

Scanner excerpt · references/checklist.md (reported line 156)May include surrounding context.

Wichtig: Niemals leer lassen — leere HEARTBEAT.md = Heartbeat wird übersprungen!

3.6 System-Cron ergänzen

Nächsten freien Minuten-Slot wählen (bestehende Belegung prüfen mit crontab -l):

bash

(crontab -l; echo "<minute>,<minute+10>,...  * * * * MC_AGENT=<agent-id> ~/.openclaw/skills/mission-control/mc checkin >> ~/.openclaw/logs/mc-checkin.log 2>&1") | crontab -

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The specific command appends a recurring cron job, creating durable execution on a 10-minute cadence. Persistence mechanisms are dangerous in ambiguous skill contexts because they create ongoing behavior outside direct operator initiation and can be repurposed to run arbitrary commands repeatedly.

Content

Scanner excerpt · references/checklist.md (reported line 158)May include surrounding context.

3.6 System-Cron ergänzen

Nächsten freien Minuten-Slot wählen (bestehende Belegung prüfen mit crontab -l):

bash

(crontab -l; echo "<minute>,<minute+10>,...  * * * * MC_AGENT=<agent-id> ~/.openclaw/skills/mission-control/mc checkin >> ~/.openclaw/logs/mc-checkin.log 2>&1") | crontab -

Aktuelle Belegung:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The optional OneDrive section grants agents shared filesystem access through symlinks into a common library, exposing broader data than is necessary for basic onboarding. In a skill of unknown purpose, this creates unnecessary cross-workspace data access and increases the chance of accidental disclosure, tampering, or lateral movement between agent work areas.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/checklist.md (reported line 214)May include surrounding context.

1. Ordner im Workspace anlegen:

bash

mkdir -p ~/.openclaw/workspace-<agent-id>/onedrive

2. Symlink pro Library erstellen:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/checklist.md (reported line 238)May include surrounding context.

md

- [ ] Gateway läuft fehlerfrei (`openclaw gateway status`)
- [ ] MEMORY.md erstellt (mit Pointer-Regel)
- [ ] HEARTBEAT.md nicht leer
- [ ] Crontab korrekt gestaffelt (`crontab -l`)
- [ ] Session-Key in MEMORY.md eingetragen
- [ ] Agent hat Onboarding bestätigt
- [ ] Avatar-Bild liegt in `~/.openclaw/workspace-<agent-id>/avatar-<agent-id>.png`

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Natural-language policy issues apply to all file types, and this file forces a single language for all instructions. There is no indication that German is optional, user-selected, or required for a region-specific compliance reason.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.