T01 · Skill Instruction Hijacking
Error
- Location
autonomous-operation-sop.md:3- Finding
Unattended Autonomous Operations Triggered Without Explicit Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
Procedural Memory
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent memory-saving purpose, but it also allows unapproved persistent skill creation and broad autonomous maintenance/backups after user inactivity.
Install only if you are comfortable with an agent saving conversation-derived workflows into persistent skill files and logs. Before use, remove or disable the autonomous-operation SOP, require explicit approval and preview before every new skill or log entry, avoid sensitive conversations while it is active, and define deletion and redaction rules for stored memories.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:53- Finding
Automatic Persistence of Conversation-Derived Instructions into Agent Memory
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
autonomous-operation-sop.md:7- Finding
Overbroad Filesystem, Repository, Drive, and Network Access
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:151- Finding
Sensitive Conversation Data Persisted Without Redaction or Retention Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill description advertises multiple broad activation paths such as 'complex task succeeds' and 'end-of-day review' without defining clear scope boundaries. In an agent setting, ambiguous triggers can cause unintended invocation and silent persistence behavior, increasing the chance that conversation-derived data is processed or stored when the user did not clearly intend it.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This SOP grants broad autonomous authority for maintenance, self-improvement, backup, and information gathering that is materially outside the procedural-memory skill’s stated purpose of saving successful workflows as reusable skills. In an agent context, scope creep like this increases the chance of unauthorized file changes, persistence, data handling, and network activity without explicit user consent or clear task binding.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
Automatically creating persistent directories and log files establishes durable storage for session-derived data outside the immediate interaction. While not malicious by itself, this expands the attack and privacy surface because retained artifacts may later be accessed by other processes, users, backups, or future sessions.
- Content
Directory Prerequisites
bash mkdir -p ~/self-improving mkdir -p ~/.openclaw/workspace/skills
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The 'proactive review' trigger is vague because terms like 'end of day' and 'after a complex task completes successfully' do not specify who decides applicability or what data may be examined. That ambiguity can lead to over-collection from conversation history and activation in contexts where the user has not meaningfully consented.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The instruction to auto-create a skill without asking delegates a consequential decision to the agent: deciding when user interactions should become persistent reusable artifacts. This is dangerous because it removes human approval from a state-changing action that may store sensitive information and influence future agent behavior.
- Content
md - ✅ Not one-time / context-specific - ✅ User would benefit **Auto-trigger:** If the same workflow succeeds 3+ times, auto-create skill WITHOUT asking (记录到日志即可)。 Otherwise: ask user "我可以把这个 workflow 存为 skill 吗？"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This section explicitly allows automatic skill creation after repeated success 'WITHOUT asking,' which means workflow-derived content may be written to disk absent contemporaneous user consent. Because the saved material is based on prior conversations, this creates a real privacy and data-governance risk, especially if the workflow includes sensitive user context, credentials, or proprietary procedures.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file instructs the agent to ask the user in Chinese ('我可以把这个 workflow 存为 skill 吗？') as part of normal execution. This imposes a specific language without user opt-in or a documented region-specific reason.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
This step formalizes writing a new SKILL.md to a persistent workspace, causing conversation-derived procedural knowledge to survive across sessions. In context, the danger is not the file creation alone but that the saved artifact can contain sensitive or proprietary details and alter future agent behavior based on unreviewed historical data.
- Content
Limitations: [when NOT to use]
text ### Step 4 — Create Skill File Create `~/.openclaw/workspace/skills/[skill-name]/SKILL.md`:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The notification, skill-loading, and end-of-day review prompts are specified in Chinese only, including lines that direct what the agent should say to the user. Because no language preference or opt-in is provided, this forces a locale choice in a way that may violate organizational language policy.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md > "已记住这个 workflow，存为 skill/[skill-name]。是否需要我下次遇到类似情况时自动执行？" **Default behavior:** Do NOT auto-execute without user confirmation. ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md > "已记住这个 workflow，存为 skill/[skill-name]。是否需要我下次遇到类似情况时自动执行？" **Default behavior:** Do NOT auto-execute without user confirmation. ---
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill normalizes storing conversation-derived summaries and reusable procedures on disk while acknowledging that sensitive conversation data may be captured. Persisting derived data is still persistence of user information, and summaries can retain secrets, identities, internal processes, or other confidential references that outlive the session and expand exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Autonomous cleanup and file-update actions can alter or remove data, yet the SOP provides no user-facing warning, dry-run requirement, or rollback expectation. In practice, unattended cleanup and updates risk accidental data loss, corruption of memory files, or unauthorized modification of agent state.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The SOP permits autonomous backups and external information collection even though those capabilities are not justified by the skill’s documented purpose. These actions can expose sensitive local data to external systems or trigger unreviewed network activity, especially when the agent acts after user inactivity rather than an explicit request.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Describing backups and external information gathering without warning about privacy, network, and storage implications can cause users to underestimate the sensitivity of these actions. For an autonomous agent, that omission is dangerous because it normalizes outbound data movement and remote access during idle periods.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The policy says external API calls require review, but the allowed tasks include searching for AI trends and collecting skill information, which strongly implies external network access without a clear approval checkpoint. This contradiction creates an enforcement gap that can be exploited to justify unsupervised outbound requests under the guise of routine autonomous operation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This file presents all operational instructions in a single language without any indication that users can opt into another language or that the language constraint is required for a region-specific purpose. That can constitute a natural-language locale policy issue under the stated rule when no opt-in or justification is provided.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill allows autonomous web searching and collection of skill information without clearly warning the user that external network access may occur. While primarily a transparency and consent issue, it still increases risk because users may not realize the agent can contact external services during autonomous operation.
- Content