Study And Port

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:44 AM UTC
• Version: 1.2.0

Overview

This skill discloses its purpose, but it can create persistent OpenClaw skills in the active skills directory from broad research triggers, so users should review it carefully before installing.

Install only if you specifically want an agent workflow that researches other AI tools and may create new OpenClaw skills. Before approving any generated skill or script, verify the exact destination path, review the generated files, and consider staging them outside the active skills directory first.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill explicitly instructs the agent to write new SKILL.md files, i.e. to modify or extend its own capability surface. Even with stated confirmation requirements, this is a self-modification pathway that can persist new behavior in a trusted skills directory and materially expand future agent actions if a user is tricked or triggers are too broad.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md

For each "portable" feature:

1. **Write SKILL.md:**
   - Clear trigger conditions
   - Detailed execution steps
   - Usage boundaries

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

## Safety & Boundaries

- **Always ask user before creating new skills or scripts**
- **Never auto-execute created scripts without confirmation**
- **Research only — do NOT implement features that require core OpenClaw changes**
- **Report findings to user, let them decide what to keep**

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

## Safety & Boundaries

- **Always ask user before creating new skills or scripts**
- **Never auto-execute created scripts without confirmation**
- **Research only — do NOT implement features that require core OpenClaw changes**
- **Report findings to user, let them decide what to keep**

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are broad enough that ordinary discussion of AI tools or competing frameworks could invoke this skill without an explicit user request to research or create derivative skills. In a skill with write permissions to the skills directory and self-improvement logs, ambiguous invocation increases the chance of unintended capability discovery, planning, and follow-on modification workflows.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicated finding points to the same persistence behavior: the workflow goes beyond temporary analysis and into durable creation of skills and session-spanning records. That persistence becomes security-relevant because the destination includes a live skills directory, not just passive notes.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

- 🏗️ **Requires Core Change** — needs OpenClaw source modification
- ⏳ **Wait & Watch** — tech not mature enough

### Step 4 — Create Skill (if portable)

**User confirmation required:** Before creating any new skill or script, ALWAYS ask user:
- "这个框架的 [功能] 值得移植，我要创建新 skill，可以吗？"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicated finding points to the same persistence behavior: the workflow goes beyond temporary analysis and into durable creation of skills and session-spanning records. That persistence becomes security-relevant because the destination includes a live skills directory, not just passive notes.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

- 🏗️ **Requires Core Change** — needs OpenClaw source modification
- ⏳ **Wait & Watch** — tech not mature enough

### Step 4 — Create Skill (if portable)

**User confirmation required:** Before creating any new skill or script, ALWAYS ask user:
- "这个框架的 [功能] 值得移植,我要创建新 skill,可以吗?"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

A hard-coded confirmation prompt in Chinese can undermine the reliability of informed consent if the user does not understand the prompt, especially because the confirmed action is creation of new skills/scripts with write access. This is not a direct exploit primitive, but it weakens a safety gate that is supposed to prevent unauthorized or misunderstood self-modification actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The title mixes English and Chinese, and the required confirmation prompt is written in Chinese elsewhere in the file, but the skill does not state that Chinese is optional or required for a specific audience. This can violate language/locale policy by implicitly forcing a language choice without user opt-in.

Content

No source excerpt is available for this finding.