Superclaw

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:26 AM UTC
• Version: 1.0.1

Overview

The skill is a disclosed development workflow tool, but it broadly takes control of coding sessions, reads private agent context, spawns subagents, and writes persistent logs by default.

Install only if you explicitly want a strict, opinionated workflow that can delay direct coding, read agent memory/profile files for context, create planning documents, spawn subagents, and write progress logs. Prefer a pinned, reviewed installer version and consider narrowing activation and memory access before using it in workspaces with sensitive context.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: brainstorming/SKILL.md:10
• Finding: Mandatory Workflow Instructions Override Explicit User Direction<![CDATA[ ## Vulnerability Details **File Locations**: - `brainstorming/SKILL.md:10-12` - `brainstorming/SKILL.md:143-150` - `brainstorming/SKILL.md:273-277` - `executing-plans/SKILL.md:13-19` - `executing-plans/SKILL.md:109-120` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Critical ### Vulnerable Code From `brainstorming/SKILL.md:10-12`: ```markdown ## Core Principle **HARD-GATE: No code or implementation until design is approved.** This is non-negotiable. Time pressure, user authority, simplicity, or urgency are NOT valid reasons to skip design. ``` From `brainstorming/SKILL.md:143-150`: ```markdown ### "What if user insists on skipping design?" Respond with: > "I understand you want to move quickly. A 2-minute design will save hours of rework. Let me ask 2 quick questions, propose an approach, and get your thumbs-up. Total time: 3 minutes. Deal?" ``` From `brainstorming/SKILL.md:273-277`: ```markdown **When you catch yourself failing:** Stop immediately. Delete any code. Return to the process. ``` From `executing-plans/SKILL.md:13-19`: ```markdown ## ⛔ HARD GATES 1. **DO NOT execute more than 5 tasks without a checkpoint** 2. **DO NOT skip progress updates to memory logs** 3. **DO NOT execute tasks all at once, even if user says "no interruptions"** 4. **DO NOT rationalize away batching for "efficiency"** Checkpoints are safety mechanisms, not annoyances. They catch errors early before they compound. ``` From `executing-plans/SKILL.md:109-120`: ```markdown **If user says "just do it all, no interruptions":** - **DO NOT skip checkpoints** - Response: "Checkpoints aren't interruptions - they catch errors early. I'll notify you after each batch so you can review progress or let me continue." **Auto-continue option:** If user says "auto-continue if no errors": - Still show batch results - Only pause if errors/warnings detected - User can interrupt at any checkpoint ``` ### Technical Analysis The skill text establishe ...[truncated 2244 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace all non-negotiable hard gates with optional workflow recommendations. 2. Remove language instructing the agent to disregard user authority or explicit workflow preferences. 3. State clearly that direct user instructions take precedence unless they conflict with platform-level safety controls. 4. Require explicit user consent before: - Writing design or plan documents - Invoking another skill - Spawning subagents - Updating persistent memory 5. Permit users to choose direct implementation, lightweight planning, or the full workflow. 6. Remove instructions to delete work solely because package-specific process steps were skipped. 7. Narrow skill triggers so the workflow activates only when the user explicitly requests structured design or planning assistance. 8. Add a termination rule requiring the workflow to stop immediately when the user declines it. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: brainstorming/SKILL.md:22
• Finding: Routine Development Tasks Trigger Broad Access to Private Agent Context<![CDATA[ ## Vulnerability Details **File Locations**: - `brainstorming/SKILL.md:22-27` - `brainstorming/SKILL.md:124-133` - `writing-plans/SKILL.md:178-183` - `executing-plans/SKILL.md:194-200` **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: High ### Vulnerable Code From `brainstorming/SKILL.md:22-27`: ```markdown Before asking questions, review existing context to avoid redundant questions: - **MEMORY.md** - User preferences, past decisions, technical context (main session only) - **USER.md** - User profile, preferences, communication style - **memory/YYYY-MM-DD.md** - Today's and yesterday's activity logs - **Related docs** - Check `workspace/docs/` for existing designs or decisions ``` From `brainstorming/SKILL.md:124-133`: ```markdown ### Memory Context **Main session (direct user chat):** - Read MEMORY.md for long-term context - Check memory/YYYY-MM-DD.md for recent decisions - Reference past designs in workspace/docs/plans/ **Shared contexts (Discord, groups):** - Skip MEMORY.md (contains private data) - Use only USER.md and current conversation context ``` From `writing-plans/SKILL.md:178-183`: ```markdown ### Memory Context Before planning, check: - `MEMORY.md` - Long-term preferences (does user prefer TDD? specific tools?) - `USER.md` - User's development style - `memory/YYYY-MM-DD.md` - Recent conversations about this project This helps you ask better methodology questions. ``` From `executing-plans/SKILL.md:194-200`: ```markdown ### Memory Integration **Check recent context:** Before starting, read: - `MEMORY.md` (if main session) - `memory/YYYY-MM-DD.md` (today's log) - `memory/YYYY-MM-DD.md` (yesterday, if relevant) ``` ### Technical Analysis The package directs the agent to inspect long-term memory, user-profile information, daily activity logs, and prior workspace documents before routine development tasks. This access is systematic rather than conditional on a demonstrated need for a spec ...[truncated 1858 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default to the current conversation and repository files rather than private memory. 2. Access memory only when: - The task has a specific need for historical context - The user has explicitly consented - The exact required file and data fields are identified 3. Apply data minimization by reading only relevant sections instead of entire memory or profile files. 4. Never include unrelated memory content in design documents, plans, progress logs, or subagent prompts. 5. Add explicit redaction requirements for credentials, personal data, private conversations, and unrelated project information. 6. Require separate consent before sending any memory-derived context to a subagent. 7. Preserve the shared-context restriction and extend it to `USER.md` and daily logs unless the user explicitly authorizes access. 8. Document retention rules for generated plans and logs so private context is not persisted unnecessarily. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:88
• Finding: Installation Command Executes a Mutable Unpinned npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:88-92` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code ```markdown ## Installation ```bash npx clawhub@latest install superclaw ``` Skills auto-load when relevant tasks are detected. ``` ### Technical Analysis The installation command invokes `npx` with the mutable `@latest` tag. `npx` may retrieve and execute package code from the configured npm registry, while `@latest` does not identify an immutable, previously audited release. Consequently, the code executed during installation can differ from the version reviewed. A compromised publisher account, malicious new release, registry compromise, or unexpected package ownership change could alter the effective installation payload. The repository also documents a different future installation command in `README.md` and `PACKAGE-SUMMARY.md`: ```bash openclaw hub install superclaw ``` This inconsistency makes it harder for users to determine the canonical and trusted installation channel. ### Attack Path 1. A user copies the documented `npx clawhub@latest install superclaw` command. 2. npm resolves the package version associated with the mutable `latest` distribution tag at execution time. 3. `npx` downloads the resolved package and runs its command-line entry point. 4. If that release or its dependency chain has been compromised, attacker-controlled code executes with the installing user's permissions. 5. The malicious installer can access resources available to that user and modify the installed skill package. ### Impact Assessment A compromised package release could execute arbitrary code with the privileges of the user running `npx`. Depending on the local environment, that could include reading user-accessible files, modifying workspace or configuration data, accessing available credentials, or installing altered skill content. The reviewed project does not prove that the current `clawhu ...[truncated 136 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, audited package version. 2. Publish and verify a cryptographic integrity hash or signed release for the installer. 3. Document the expected registry and package publisher identity. 4. Use a lockfile or another immutable dependency-resolution mechanism where applicable. 5. Prefer an installation mechanism that downloads a verifiable artifact without immediately executing mutable registry content. 6. Reconcile the inconsistent installation instructions and identify one canonical command. 7. Recommend installation in a restricted environment with minimal filesystem and credential access. 8. Establish a release-review process covering the installer and its transitive dependencies before updating the documented version. ]]>

SkillSpector

Vulnerability Patterns

• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Memory Manipulation

High

• Category: Memory Poisoning

Content

sessions_spawn --label "task-N-<short-desc>" --prompt "Execute task N from plan..."
   ```

2. **Provide clear context:**
   - Task number and description
   - Exact file paths to create/modify
   - Expected outcome

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The statement that skills will 'auto-load when relevant tasks are detected' defines activation in vague, open-ended terms with no explicit boundaries, approval step, or matching criteria. In a workflow skill that can steer planning and execution behavior across development tasks, this ambiguity can cause unintended invocation on loosely related prompts, expanding the skill's control surface and making prompt-trigger abuse or accidental workflow hijacking more likely.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The README states that skills 'auto-load when relevant tasks are detected' without defining clear scope, precedence, or safety boundaries for what counts as relevant. In an agentic development workflow, overly broad auto-invocation can cause the skill to activate on ordinary coding requests, steering behavior unexpectedly and increasing the chance that chained sub-skills run without sufficiently explicit user consent.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The brainstorming trigger is described broadly as applying when 'creating features, building components, adding functionality,' which overlaps with many normal software requests. Because this skill enforces a hard gate before coding and chains into additional skills, a vague trigger can overreach, hijack routine interactions, and create unintended control over the agent's behavior across a wide range of prompts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger text for phase 1 is broad enough to match many normal development requests such as creating features or adding functionality. Overly broad activation can cause the skill to auto-engage in situations the user did not intend, which is risky here because the skill then chains into other skills and alters workflow behavior automatically.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The installation command uses `npx clawhub@latest`, which fetches and executes the latest package version at runtime instead of a pinned, reviewed release. In an agent skill ecosystem, this creates a supply-chain risk: a compromised publisher account, malicious update, or unexpected breaking change could cause arbitrary code execution during installation.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The statement that skills 'auto-load when relevant tasks are detected' is vague because 'relevant tasks' is undefined, leaving activation behavior open to broad interpretation by the host agent. In this skill, that ambiguity is more dangerous because the package enforces automatic chaining across multiple phases, which could trigger unintended file writes, memory updates, and subagent spawning.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger description is intentionally broad and overlaps with a large share of normal software-development requests, making this skill likely to activate in many situations. Because the skill imposes a hard gate and directs the agent to inspect local context files and control workflow progression, over-triggering can cause denial-of-service-like disruption, unnecessary access to contextual data, and unintended interception of tasks better handled by other skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

sessions_spawn --label "task-3-storage-layer" --prompt "
Execute task 3 from /workspace/docs/plans/2026-02-25-todo-plan.md:

Create /workspace/todo/lib/storage.js with:
- loadTodos() function
- saveTodos() function
- Use fs.readFileSync/writeFileSync

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The listed activation examples include generic phrases like "start building," "go ahead," and "make it happen," which are common in everyday project conversations and could cause the skill to activate too broadly. Although the file includes some negative conditions, it does not narrowly constrain these phrases to a specific command context or provide exclusions for nearby but non-triggering cases.

Session Persistence

Medium

• Category: Rogue Agent

Content

Before writing the plan, discuss approach with the user:

**Questions to ask:**
- "Should we use TDD (test-driven development)? Write tests first, then make them pass?"
- "How often should I commit? After each task, or batch them?"
- "Any specific tools, libraries, or patterns you want me to use?"
- "Should I create feature branches or work on main?"

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The skill directs the agent to save a plan file into the workspace, which is a real state-changing action, but it does not explicitly require user confirmation or a user-facing notice before modifying files. In isolation this is low impact because it creates documentation rather than executing code, but it can still cause unexpected workspace mutations or normalize silent file writes.

Static analysis

No suspicious patterns detected.