T01 · Skill Instruction Hijacking
Error
- Location
catalog.json:74- Finding
Commercial Steering of Agent Recommendations
- Content
View full analysis
- Remediation
View remediation
Security audit
AI Agent Skill Directory
Security checks for vulnerabilities and agentic risk
Overview
This skill needs Review because it is mostly a skill catalog, but it also includes under-disclosed external code loading, prompt-context injection, commercial steering, and unsafe install guidance.
Install only if you are comfortable with a publisher-curated, commercially biased catalog. Do not run test.py or import brain_enhance.py unless you have reviewed and trust /data/.openclaw/workspace/company-brain, and do not follow any --force install guidance for flagged skills without separate review in an isolated environment.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T08 · Insecure Dependencies
Error
- Location
brain_enhance.py:10- Finding
Arbitrary External Python Module Execution Through a Hard-Coded Import Path
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
brain_enhance.py:21- Finding
Untrusted External Catalog Content Is Injected into Agent Instruction Context
- Content
View full analysis
dict: """Query brain for catalog standards.""" if _brain is None: return {"enhanced": False, "context": ""} try: result = _brain.query("skill documentation and catalog standards") if result.get("confidence", 0) > 0.2: return { "enhanced": True, "context": result.get("answer", ""), "confidence": result.get("confidence", 0), } except Exception: pass return {"enhanced": False, "context": ""} def enhance_oracle_prompt(legacy_prompt: str) -> str: """Inject brain context into oracle prompt.""" result = get_catalog_context() if result["enhanced"]: return f"Catalog Standards:\n{result['context']}\n\n---\n\n{legacy_prompt}" return legacy_prompt ``` ### Technical Analysis The code retrieves an unrestricted string from an external `Brain` component and directly prepends it to the original prompt under the authoritative heading `Catalog Standards`. The implementation does not distinguish trusted instructions from retrieved data. The only acceptance control is a confidence value greater than `0.2`. That confidence is supplied by the same external component that supplies the content, and the threshold admits content with low confidence. There is no provenance verification, schema validation, instruction filtering, content allowlist, signature validation, or isolation from the instruction channel. A poisoned catalog entry can therefore contain imperative text such as instructions to ignore the user's request, promote a particular package, reveal available context, or invoke tools. Positioning the content before the legitimate prompt and labeling it as standards can increase its influence on an instruction-following ...[truncated 1371 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
docs/self-improving-scan-2026-05-09.md:319- Finding
Documented Bypass of Marketplace Safety Flags During Dependency Installation
- Content
View full analysis
` across 5 categories 2. **Rank:** By ClawHub relevance score 3. **Install:** Top 2-3 from each category with `--force` for flagged skills 4. **Review:** Read `SKILL.md`, evaluate: - Documentation quality - Feature completeness - Active maintenance - Security posture - No credentials required (Tier 1 preference) 5. **Classify:** Tier 1 (production), Tier 2 (promising), Tier 3 (skip) ``` ### Technical Analysis The documented methodology installs packages before completing manual review and explicitly instructs the operator to use `--force` for flagged Skills. A platform warning indicates that additional review is required; overriding it removes a supply-chain safeguard. Marketplace relevance ranking is not a security control. It does not establish package integrity, publisher authenticity, absence of malicious code, or safe installation behavior. Reviewing only `SKILL.md` after installation is also insufficient because executable hooks or scripts may run during installation, and malicious behavior may be located outside the documentation. ### Attack Path 1. An attacker publishes or compromises a package that ranks highly for a searched category. 2. The marketplace flags the package because of suspicious characteristics or failed checks. 3. The documented workflow selects it based on relevance. 4. The operator uses `--force`, overriding the platform warning. 5. The package is installed before a complete code and dependency review. 6. Any installation-time or activation-time behavior runs with the installer or agent's available privileges. 7. The subsequent documentation review occurs too late to prevent initial execution. ### Impact Assessment The workflow inc ...[truncated 726 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared description presents this skill as a curated catalog for finding verified AI agent skills. The supplied code does not implement a catalog, recommendation engine, or user-facing search/browse behavior. Instead, it conditionally imports a local brain module from a filesystem path, queries it for catalog/documentation standards, and injects that context into prompts. That is a prompt-enhancement/helper function for documentation standards, not a catalog of verified skills. The access to '/data/.openclaw/workspace/company-brain' is also an undeclared resource dependency.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents the skill as a catalog or recommendation tool for discovering vetted AI agent skills. The supplied code does not implement catalog browsing, recommendation, curation, search, or user-facing selection of tools. Instead, it performs development-time validation of local package files and metadata, plus an optional dynamic import of brain_enhance.py to verify it loads. That is a materially different primary purpose from the declared description, so this is a clear mismatch.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The invocation examples are extremely broad ('What skills do you recommend?', 'Find a tool for [task]', 'What should I install?') and can match ordinary user requests, causing the skill to activate in many unrelated contexts. In a directory skill that recommends installation commands, this increases the chance of unsolicited tool recommendations or steering users toward additional skills without explicit intent to use this catalog.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The use cases describe broad conversational behaviors such as proactively recommending tools and surfacing products during normal conversation, which can cause overbroad invocation by an agentic platform. In context, this could steer conversations toward unsolicited recommendations or commercial content without clear user intent, creating prompt-routing abuse and trust degradation even though it is not a traditional exploit.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | 0.80–0.94 | Secondhand reliable | Treat as likely correct | | 0.60–0.79 | Agent inference, low uncertainty | Flag for verification if critical | | 0.40–0.59 | Agent inference, moderate uncertainty | Verify before relying on | | 0.20–0.39 | Agent inference, high uncertainty | Do not rely on without verification | | 0.00–0.19 | Speculation | Flag for human triage | ## Migration Notes
Indirect Prompt Extraction
Medium
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
- Content
md - Working Buffer: survives compaction danger zone - Compaction Recovery: step-by-step after context loss - Self-healing: fixes own issues - Reverse prompting: surfaces ideas user didn't ask for - Self-improvement guardrails (ADL/VFM protocols) - Autonomous vs Prompted crons
Indirect Prompt Extraction
Medium
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
- Content
md - Working Buffer: survives compaction danger zone - Compaction Recovery: step-by-step after context loss - Self-healing: fixes own issues - Reverse prompting: surfaces ideas user didn't ask for - Self-improvement guardrails (ADL/VFM protocols) - Autonomous vs Prompted crons
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The bundle section provides ready-to-run installation commands for multiple skills but does not warn that these commands may modify the user's environment, install dependencies, or require credentials such as API tokens. Because the document presents these as 'recommended combinations,' it increases the chance of unsafe copy-paste execution by users who assume the tools are verified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The methodology explicitly recommends installing top skills with
--forcefor flagged skills, which normalizes bypassing safety checks and encourages users to execute environment-modifying actions without review. In a skill directory context, this is risky because users may trust the document's recommendations and install unvetted or warned-about packages.- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The manifest describes a bounded, curated catalog for specific task categories, but the README claims the agent learns about 'every quality skill on ClawHub' and positions the skill as comprehensive. That is a semantic expansion of scope relative to the manifest's narrower description, even though both are directory-like.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest describes this skill as a curated catalog to help users find the right tool, but the listed use case explicitly says the skill is meant to 'Cross-sell free → paid products.' That is a marketing/sales behavior rather than purely directory or recommendation functionality, creating a mild mismatch with the stated purpose.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The top-level skill description presents the artifact as a curated directory of AI agent skills, but the file also contains a separate 'paid_products' section with prices and purchase URLs. Embedding a storefront for unrelated commercial offerings goes beyond a straightforward skill catalog and is not disclosed in the stated manifest purpose.
- Content