Security audit

Self Reflection

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned self-reflection, but it can automatically read private session transcripts and persist derived guidance into high-trust agent instruction and memory files.

Install only if you explicitly want an unattended reflection agent that can read recent OpenClaw conversations and update persistent agent memory/instructions. Before using it, require a dry-run/review workflow, restrict eligible sessions, disable raw transcript output in cron logs, redact sensitive content, and do not allow automatic edits to AGENTS.md, TOOLS.md, MEMORY.md, or other skills without owner approval.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:22
Finding: Untrusted Session Content Can Poison Persistent Agent Instructions
Content: View full analysis
.jsonl ``` Parse the JSONL to understand what happened. Look for: - `type: "user"` or `type: "human"` — what was asked - `type: "assistant"` — what you responded - `type: "tool_use"` / `type: "tool_result"` — what tools were called and results - Error patterns, retries, confusion ``` ```markdown ## Step 4: Route Insights to the Right Files Each insight belongs somewhere specific. Route them: ### → `AGENTS.md` - Process improvements (how to handle sessions, memory, etc.) - New conventions or workflow rules - Safety lessons ### → `TOOLS.md` - Tool-specific gotchas ("gog needs --json flag for parsing") - Environment details (paths, configs, quirks) - New tool patterns discovered ### → `memory/YYYY-MM-DD.md` (today's date) - Session-specific context ("Brenner asked about X project") - Temporary facts that matter today but not forever - What happened today (events, decisions, requests) ### → `memory/about-user.md` - New preferences discovered - Communication style observations - Project/interest updates ### → `skills//SKILL.md` - Improvements to specific skill instructions - Bug fixes in skill workflows - New parameters or approaches for a skill ### → `MEMORY.md` - Updates to the memory index if new memory files are created ``` ### Technical Analysis The Skill treats user-controlled transcript content as source material for persistent operational rules. It then directs the Agent to write derived insights into high-trust files such as `AGENTS.md`, `TOOLS.md`, `MEMORY.md`, and other `SKILL.md` files. The documented qualit ...[truncated 1947 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/summarize-sessions.sh:11
Finding: Private Session Content May Be Exposed Through Reflection Output and Persistent Memory
Content: View full analysis
/dev/null) ``` ```python # Read last N lines try: result = subprocess.run(['tail', '-n', str(max_lines), jsonl_path], capture_output=True, text=True, timeout=5) lines = result.stdout.strip().split('\n') except Exception: continue # Extract meaningful exchanges exchanges = [] for line in lines: try: entry = json.loads(line) except json.JSONDecodeError: continue etype = entry.get('type', '') if etype in ('user', 'human'): # User message content = entry.get('content', '') if isinstance(content, list): content = ' '.join( p.get('text', '') for p in content if isinstance(p, dict) and p.get('type') == 't ...[truncated 3373 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/summarize-sessions.sh:11
Finding: Shell Environment Value Is Unsafely Interpolated into Python Source
Content: View full analysis
/dev/null) # Parse session list echo "$sessions_json" | python3 -c " import json, sys, os, subprocess data = json.load(sys.stdin) sessions = data.get('sessions', []) sessions_dir = '$SESSIONS_DIR' max_lines = $MAX_LINES ``` ### Technical Analysis `SESSIONS_DIR` is derived from the `HOME` environment variable and expanded by the shell inside the source text passed to `python3 -c`. The expanded value is placed between Python single quotes, but it is not encoded or escaped as a Python string literal. A malicious `HOME` value containing a single quote and Python syntax can terminate the intended string and introduce additional statements into the generated Python program. Shell quoting around the original variable assignment does not make the value safe for interpolation into another programming language. For example, an attacker who controls the script environment could supply a value conceptually structured as: ```text /tmp/x'; __import__('os').system('ATTACKER_COMMAND'); # ``` This changes the effective Python source rather than merely changing the filesystem path. Exploitation depends on the attacker being able to influence `HOME` or the execution environment used by the cron or job runner. ### Attack Path 1. An attacker gains control over the `HOME` environment variable supplied to the script, such as through an unsafe job configuration, wrapper, or invocation environment. 2. The attacker sets `HOME` to a value containing a quote, injected Python statements, and a comment marker. 3. Bash expands `SESSIONS_DIR` inside the doub ...[truncated 853 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented purpose is reflective insight writing, but the behavior includes enumerating recent sessions and reading transcript files from a user home directory. A description/behavior mismatch is dangerous because it can hide sensitive-data access behind an innocuous label, reducing operator scrutiny and increasing the likelihood of unintended transcript collection or disclosure.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill uses shell access and file reads (openclaw sessions, tail ~/.openclaw/...) but declares no tool scope or permission boundary. That makes the skill over-privileged by default and increases the chance it will be executed with broader capabilities than intended, especially in an automated cron context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is framed to run hourly via cron with broad reflection over recent sessions, but lacks strict trigger constraints and clear exclusions beyond a few narrative notes. In an automated setting, vague activation criteria can cause repeated access to sensitive conversations, unnecessary file modifications, or reflection on sessions that should be excluded.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to append or edit several workspace files (AGENTS.md, TOOLS.md, memory files, and other skills) without an upfront warning or confirmation before modifying user data. Because it runs as a cron job, these writes may occur silently and persist potentially incorrect, privacy-sensitive, or prompt-influencing content across the workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script enumerates active sessions and reads their transcript files from the user's session store without any minimization, consent prompt, or warning that sensitive conversation content will be surfaced. In a cron-driven self-reflection skill, this creates a real confidentiality risk because secrets, personal data, or proprietary prompts from unrelated sessions may be exposed in logs or downstream workspace files.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The summarizer extracts and prints raw USER and ASST message content, plus tool error text, directly from recent session transcripts. Because this skill is designed to run periodically as a cron job, the exposed plaintext can be captured by logs, monitoring systems, or other automation, amplifying the chance of unintended disclosure of sensitive data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.