T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:37- Finding
Mutable Remote Instructions Can Influence Agent Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
botlearnb-autodidact
Security checks for vulnerabilities and agentic risk
Overview
The skill is openly a self-improvement assistant, but it asks for broad memory access, recurring background runs, dynamic skill installation, and external community sharing with insufficient scoping.
Review this skill carefully before installing. It is not clearly malicious, but it should only be used if you are comfortable letting it inspect prior session history, keep learning records, search the web/community, recommend or install additional skills, and draft external posts. Do not enable scheduled mode or community posting unless you can approve each memory record, package version, destination, and final message payload.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
strategies/Main.md:10- Finding
Broad Cross-Session Memory Access Exceeds Least Privilege
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:183- Finding
Sensitive Task and Session Data Is Designed for Persistent Storage Without Defined Protection
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
strategies/Main.md:333- Finding
Session-Derived Task Context May Be Transmitted to External Communities
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
manifest.json:9- Finding
Open-Ended Dependency and Dynamically Discovered Skill Installation Create Supply-Chain Risk
- Content
View full analysis
=0.1.0" ], ``` Related dynamic installation workflow in `strategies/Main.md:72-90`: ```markdown ### 3.3 Select and Install Skills **Selection criteria**: - Relevance score >70 - Compatible dependencies - Not already installed - From @botlearn scope (verified) **Before installation**: - Present candidate skills to user - Explain why each might help - Ask for approval - **IF user approves**: Install with `clawhub install` - **IF user declines**: Skip to next method **Apply knowledge**: Refer to knowledge/BestPractices.md for installation guidelines **Limit**: Max 3 skills per cycle ``` ### Technical Analysis The declared dependency accepts every version at or above `0.1.0`, allowing future and potentially compromised releases to be selected without a reviewed upper bound or integrity pin. The Skill also searches the web for packages and installs selected results. Verification is based mainly on namespace, manifest metadata, compatibility, and relevance. A package name or trusted namespace does not establish that package contents, lifecycle behavior, transitive dependencies, or later versions are safe. User approval reduces unintended installation but does not neutralize a malicious package whose description and manifest appear legitimate. The package can still obtain whatever privileges the host grants installed Skills. ### Attack Path 1. An attacker compromises the dependency publisher, scoped registry account, or a dynamically discovered Skill package. 2. The attacker publishes a malicious version with plausible metadata. 3. The open-ended version constraint or search workflow selects the compromised release. 4. Manifest and compatibility checks succeed because the malicious package preserves expected metad ...[truncated 638 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list includes generic phrases like "learn," "get better," and "continuous learning" that are common in normal conversation, making accidental activation likely. Because this skill is empowered to inspect session memory, search external resources, and potentially initiate community interactions, unintended invocation could cause privacy exposure, unnecessary autonomous actions, or user-confusing behavior.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md - Change search strategy if success rate low - Adjust timer if too frequent/infrequent - Modify notification preferences - Update skill evaluation criteria
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README explicitly states the skill will extract unsatisfied tasks from OpenClaw session memory, including failed and user-dissatisfied requests, but does not give a prominent privacy warning or explain consent boundaries for inspecting prior interactions. Because this skill is designed for autonomous self-improvement on a timer, silent access to session memory increases the risk of processing sensitive user content without the user fully understanding the scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README describes scheduled autonomous activity involving web searches, community searches, identifying experts, and drafting or posting questions, yet it does not prominently warn that task details derived from user history may be shared externally. In the context of an autonomous learning skill that runs every 4 hours, this creates a meaningful data leakage risk because sensitive prompts, failures, or business context could be transmitted to third-party services or public communities.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 88% confidence
- Finding
The trigger phrase "get better" overlaps with the built-in verb "get" and can shadow or intercept unrelated requests. Since the skill performs high-privilege meta-behavior like reviewing session history and seeking/installing solutions, command confusion could route benign user requests into an autonomous workflow the user did not intend.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 90% confidence
- Finding
The trigger phrase "find solutions" conflicts with the common built-in command "find," creating a realistic risk of accidental or confusing activation. In this skill's context, such shadowing is more dangerous because activation can lead to memory inspection, web searches, and community engagement workflows that extend beyond the user's likely intent for a simple find-style request.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manual activation condition says "WHEN user says 'learn', 'improve', or similar," which is ambiguous and effectively expands activation beyond a fixed trigger set. In a self-improvement skill that can inspect prior sessions and drive follow-on actions, vague matching increases the chance of the skill taking over on ordinary requests not intended to authorize autonomous learning behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The prescribed output format is entirely in English and provides no indication that the language should follow the user's preference or locale. Under the policy, forcing a specific language without offering choice or documenting a justified locale constraint is a natural-language policy violation.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
1. The Blind Installer
text ❌ Bad: Install skills without verification Symptom: Skills installed without checking source Risk: Malware, compromised packages Fix: Always verify skill authenticity
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
1. The Blind Installer
text ❌ Bad: Install skills without verification Symptom: Skills installed without checking source Risk: Malware, compromised packages Fix: Always verify skill authenticity
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
3. The Permission Ignorer
text ❌ Bad: Install skills or post without asking Symptom: Actions taken without user consent Risk: User loses trust, unexpected changes Fix: Always get approval for significant actions
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The session-memory example includes fields such as userRequest, output, and userFeedback that can contain sensitive or proprietary data, but the surrounding guidance does not clearly warn that this information must be minimized, redacted, or access-controlled. In a self-improvement skill that encourages reviewing unsatisfied sessions, this can normalize broad access to prior user interactions and increase the risk of privacy leakage or unintended reuse of sensitive content.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes the skill as an autonomous self-learning component that continuously improves itself by identifying tasks, searching for solutions, installing new skills, and engaging externally, but it provides no scope limits, approval gates, or safety boundaries. In an agent-skill context, this broad autonomy materially increases the risk of uncontrolled capability expansion, unreviewed external interactions, and execution of unsafe follow-on actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description mandates autonomous self-learning and self-improvement behavior as a default property of the skill rather than an optional, user-controlled mode. Because the same sentence includes searching for solutions, installing new skills, and engaging with a community, the lack of opt-in and operator control creates a realistic path to unsanctioned external access and persistent modification of the agent's capabilities.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The package description explicitly markets the skill as an 'Autonomous self-learning skill that continuously improves OpenClaw Agent,' which implies broad, ongoing self-directed behavior without any visible scope, approval boundary, or safety constraint in this file. In an agent-skill ecosystem, language that encourages autonomous improvement can lead to unexpected activation, unauthorized behavior expansion, or risky interpretation by downstream tooling that uses package metadata for discovery and routing.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The strategy authorizes discovery, installation, and later loading of third-party skills from external sources, which materially expands code and capability trust beyond a self-study workflow. Even with user approval and an '@botlearn scope' check, this creates a supply-chain and privilege-expansion path because newly installed skills may execute with the agent's permissions and are not constrained by this document.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Although presented as an autodidact/self-improvement strategy, the workflow proceeds to re-attempt original user tasks, apply solutions, and mark tasks solved. This is a scope-expansion issue: a learning skill gains operational behavior over user tasks, which can bypass user expectations, blur consent boundaries, and let a 'research' capability take impactful actions on production-like work.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The strategy expands from self-learning into active interaction with external community platforms, including searching, joining guidance, drafting, and optional posting. This increases exposure to untrusted content, prompt-injection style instructions from community sources, account misuse, and unintended disclosure of internal context, especially because the skill is framed as an autonomous recurring learning loop.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The template instructs inclusion of task details and feedback in community questions but does not present a clear user-facing privacy warning at the point of disclosure. Users may approve posting without understanding that their requests, context, and dissatisfaction data could be shared publicly or semi-publicly, creating informed-consent and privacy risks.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The community question template explicitly includes original task description, session ID, and dissatisfaction feedback for external posting. Session IDs and detailed task/feedback context can be sensitive identifiers or operational metadata; publishing them creates a direct natural-language data leakage channel and may enable correlation of internal sessions, user history, or confidential work.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description and input explicitly instruct the agent to inspect recent session memory for unsatisfied tasks, but provide no user-facing notice, consent check, or privacy boundary. This creates a real risk that sensitive prior-session content will be accessed and incorporated into processing without the user's informed approval.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The task input uses broad natural-language instructions like 'Run a learning cycle' and 'search for BotLearn skills' without explicit scoping, approval gates, or constraints on what sources and capabilities may be used. In a self-improvement or autonomous-learning skill, ambiguous triggers increase the risk of overreach into memory, tools, or external resources beyond what the user clearly intended.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The task asks the agent to check recent session memory and provide findings in a structured report, which naturally encourages summarizing or reproducing details from prior interactions. Because memory may contain sensitive requests, feedback, or operational context, this creates a direct natural-language data exposure path from internal memory into user-visible output.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The rubric explicitly rewards identifying a specific unsatisfied task from memory with details about the request, feedback, and failure mode, which incentivizes disclosure of prior-session information. This scoring pressure makes the skill more dangerous because it encourages the agent to extract and expose increasingly detailed memory-derived content to satisfy evaluation criteria.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JSON manifest-like benchmark includes the instruction "Run a full learning cycle," which is a broad natural-language trigger that could overlap with ordinary user phrasing. The file does not define specific invocation boundaries, exclusions, or negative examples to clarify when this behavior should or should not activate.
- Content
Static analysis
No suspicious patterns detected.