Bw Openclaw Boost

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:52 AM UTC
• Version: 1.2.4

Overview

The skill is not clearly malicious, but its memory, compaction, and permission features can affect future agent behavior without enough trust-boundary controls.

Review this skill carefully before installing. Its cost/status tools appear ordinary, but the memory, compaction, and permission components can persist information and influence future agent context. Install only if you are comfortable auditing the local memory files and permission rules, and avoid using the compaction or memory-injection features until they add clear trust boundaries, sanitization, and user approval.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: tools/compaction_manager.py:239

Finding

Untrusted conversation content is promoted to system-level authority during compaction

Content

View full analysis

str: """生成消息摘要""" if not messages: return "无" # 提取关键信息 topics = [] for msg in messages: content = msg.get("content", "")[:200] # 每条取前200字符 if content: # 提取前几个字作为主题 first_line = content.split('\n')[0][:50] if first_line: topics.append(first_line) summary = f"讨论了 {len(messages)} 条消息，主题包括：{'；'.join(topics[:5])}" if len(summary) > max_length: summary = summary[:max_length] + "..." return summary ``` ### Technical Analysis The compaction mechanism does not distinguish between trusted system instructions and untrusted user or tool-result content when generating its summary. `_summarize_messages()` copies the first line of each old message, including user-controlled messages, into `older_summary`. `auto_compact()` then assigns that summary both `"type": "system"` and `"role": "system"`. This crosses a fundamental instruction trust boundary: text originally supplied at user authority can reappear in a system-authority message. The summary algorithm is extra ...[truncated 1760 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: tools/dream_consolidation.py:112

Finding

Unsanitized log content can poison persistent memory and be reinjected into future Agent contexts

Content

View full analysis

List[str]: """ 从内容中提取关键信息 """ key_points = [] # 提取标题（## 开头的） titles = re.findall(r'^#{1,3}\s+(.+)$', content, re.MULTILINE) key_points.extend(titles) # 提取列表项 list_items = re.findall(r'^[-*]\s+(.+)$', content, re.MULTILINE) key_points.extend(list_items) # 提取代码块（可能是重要配置） code_blocks = re.findall(r'```[\s\S]*?```', content) for block in code_blocks[:2]: # 最多2个 if len(block) < 200: key_points.append(block[:100]) return key_points[:20] # 最多20条 ``` Those values are written without instruction filtering into long-term memory: ```python key_points = self.extract_key_info(log["content"]) new_entry = f""" --- ## 来自 {log['date']} 日志的更新 来源: `{log['file']}` ### 关键信息 """ for point in key_points[:10]: if len(point) > 200: point = point[:200] + "..." new_entry += f"- {point}\n" new_entry += f"\n_整理时间: {update_time}_" # 追加或创建 if existing: # 找到最后一个 --- 分隔符，在那之前插入 last_sep = existing.rfind('\n---\n') if last_sep > 0: updated = existing[:last_sep] + new_entry + existing[last_sep:] else: updated = existing + new_entry else: updated = f"""# {rule.target_file.replace('-', ' ').title()} {new_entry} """ target_file.write_text(updated, encoding='utf-8') ``` The retrieval layer later injects the full memory content into context without a trust boundary: ```python def get_memory_content(m: MemoryHeader) -> str: """读取记忆文件的完整内容""" path = MEMORY_ROOT / m.path try: content = path.read_text(encoding='utf-8') ...[truncated 3281 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: tools/permission_manager.py:61

Finding

Substring-based command allowlisting permits permission-check bypass through composed commands

Content

View full analysis

RuleEffect: """ 检查命令安全性 返回: "allow" | "ask" | "deny" """ # 检查危险模式 for pattern in tool_perm.dangerous_patterns: if re.search(pattern, command, re.IGNORECASE): return "deny" # 检查安全命令白名单 for safe in tool_perm.safe_commands: if safe == "*": return "allow" if safe in command: return "allow" # 默认需要询问 return "ask" ``` The result is used as the final authorization result: ```python # 1. 先检查危险模式 if tool_perm and command: safety = check_command_safety(command, tool_perm) if safety == "deny": return "deny" # 2. 检查用户自定义规则（按优先级） rules = perms.get("rules", []) for rule in rules: if check_rule_m ...[truncated 3166 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (45)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · tools/dream_consolidation.py (reported line 146)May include surrounding context.

python

"""
        for rule in CONSOLIDATION_RULES:
            if re.search(rule.pattern, content, re.IGNORECASE):
                return rule
        return None
    
    def consolidate_log(self, log: Dict[str, Any]) -> bool:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · tools/permission_manager.py (reported line 271)May include surrounding context.

python

"""
        for rule in CONSOLIDATION_RULES:
            if re.search(rule.pattern, content, re.IGNORECASE):
                return rule
        return None
    
    def consolidate_log(self, log: Dict[str, Any]) -> bool:

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · tools/token_budget.py (reported line 246)May include surrounding context.

python

print("监控 Token 使用情况（Ctrl+C 退出）...")
            try:
                while True:
                    os.system('clear')
                    print(monitor.get_report())
                    time.sleep(10)
            except KeyboardInterrupt:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comments and all user-facing help text are presented only in Chinese, including the usage and command descriptions. This creates a language/locale policy concern because the skill does not offer an opt-in choice or explain that it is intentionally restricted to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script includes Chinese-only natural-language comments and a Chinese denial message, and there is no indication that the user can choose a language or that the skill is intentionally limited to a Chinese-speaking context. The policy explicitly disallows forcing a specific language or locale without opt-in or clear justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and all user-facing descriptive text are written only in Chinese, with no indication that users may select another language or that the tool is region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code file contains natural-language documentation and interface text entirely in Chinese, beginning with the module docstring and continuing through user-visible CLI messages. Under the policy rules, forcing a specific language without user opt-in is a locale-policy violation unless the regional constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstring states that the skill receives tasks, routes them to agents, and collects results for return to the user. In practice, the code analyzes keywords, writes tasks to a JSON log, and marks them as pending with a placeholder result, without any result collection or aggregation logic.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring describes '分发任务到目标 Agent' while the function body merely updates local task status/result and explicitly does not transmit anything. This is an intent-level contradiction because the documented operation suggests real dispatch behavior that the code does not perform.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file’s natural-language docstring and user-facing report strings are written exclusively in Chinese, indicating a fixed language choice for the skill's interface. Under the policy, forcing a specific language without opt-in or documented regional justification is a locale-policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

With no manifest available, the skill's intended scope is unknown, so invoking an external command-line tool is an unjustified capability relative to documented purpose. The module documentation describes a cost tracking system, but this implementation depends on spawning openclaw status, which expands capability beyond simple local aggregation/reporting.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tools/cost_tracker.py (reported line 89)May include surrounding context.

python

def poll_sessions(self) -> List[SessionSnapshot]:
        try:
            result = subprocess.run(["openclaw", "status"], capture_output=True, text=True, timeout=30)
            output = result.stdout + result.stderr
        except Exception as e:
            print(f"Failed to get openclaw status: {e}")

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module documentation states '清理已处理的短期记忆' at L010, implying processed logs will be removed. In code, LOGS_DIR is annotated as read-only at L029 and the consolidation loop comments '日志保留，不删除' at L230, with no deletion logic anywhere, so the documented behavior contradicts the actual implementation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The consolidation rules explicitly classify identity-related content such as '用户|角色|身份|我是' into persistent user memory. In this skill context, that is more dangerous because the tool scans conversational/log data and can silently retain personal or profile information long-term, increasing privacy and disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tool automatically copies extracted content from recent logs into long-term memory files without any consent, review gate, or sensitivity filtering. Because logs may contain secrets, personal data, or sensitive operational details, this increases data retention and exposure risk by persisting information beyond its original context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The function assembles full memory file contents and returns them for direct injection into agent context without any consent gate, redaction step, or user-visible disclosure that stored data may be surfaced. In an agent setting, this can expose sensitive prior notes, personal data, or secrets from the memory store to prompts, tools, or downstream model outputs when a broad or attacker-influenced query triggers retrieval.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code embeds user-facing documentation and command-line messages entirely in Chinese, including usage help and status output, with no indication that the skill is region-specific or that users can opt into another language. That creates a natural-language policy concern under the language/locale rule because the skill effectively enforces one language by default.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · tools/permission_manager.py (reported line 10)May include surrounding context.

python

权限类型：
- read      — 读文件/数据
- write     — 写/创建文件
- execute   — 执行命令
- network   — 网络访问
- elevated  — 提升权限

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · tools/permission_manager.py (reported line 10)May include surrounding context.

python

权限类型:
- read      — 读文件/数据
- write     — 写/创建文件
- execute   — 执行命令
- network   — 网络访问
- elevated  — 提升权限

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and all user-facing command descriptions are presented in Chinese only, indicating a fixed language choice. There is no indication that users can opt into another language or locale, which conflicts with the policy against forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tools/slash_commands.py (reported line 92)May include surrounding context.

python

def cmd_cost(self, args: str) -> str:
        """成本统计"""
        try:
            result = subprocess.run(
                ["python3", str(TOOLS_DIR / "cost_tracker.py")],
                capture_output=True, text=True, timeout=10
            )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tools/slash_commands.py (reported line 103)May include surrounding context.

python

def cmd_status(self, args: str) -> str:
        """系统状态"""
        try:
            result = subprocess.run(
                ["openclaw", "status"],
                capture_output=True, text=True, timeout=10
            )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tools/slash_commands.py (reported line 129)May include surrounding context.

python

def cmd_memory(self, args: str) -> str:
        """记忆状态"""
        try:
            result = subprocess.run(
                ["python3", str(TOOLS_DIR / "memory_relevance.py"), "scan"],
                capture_output=True, text=True, timeout=10
            )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tools/slash_commands.py (reported line 155)May include surrounding context.

python

def cmd_tasks(self, args: str) -> str:
        """定时任务"""
        try:
            result = subprocess.run(
                ["openclaw", "cron", "list", "--json"],
                capture_output=True, text=True, timeout=10
            )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The /clear command performs irreversible deletion of cache directories immediately, with no confirmation, dry-run mode, or user warning. In an agent-command context, a mistyped or unintended invocation can cause loss of useful state and disrupt execution, even though the deletion scope is limited to predefined local directories.

Content

No source excerpt is available for this finding.