Skill Release Lifecycle

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 0.1.3

Overview

This is a disclosed Markdown workflow for checking and improving OpenClaw skill releases, with no hidden execution, credential access, exfiltration, or destructive behavior found.

Install this if you want an agent-assisted checklist for deciding whether a skill is ready to publish and for organizing post-release fixes. Be aware that using it may result in user-approved edits to the skill being reviewed and persistent global installation of this workflow skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

## What This Will Not Do

* It does not write SKILL.md from scratch.
* It does not run ClawHub publish commands directly.
* It does not replace clawhub-auto-publish.
* It does not optimize ClawHub ranking, downloads, stars, or homepage placement.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/dogfood-run-002-lifecycle-self-eval.md (reported line 41)May include surrounding context.

md

## What This Will Not Do

* It does not write SKILL.md from scratch.
* It does not run ClawHub publish commands directly.
* It does not replace clawhub-auto-publish.
* It does not optimize ClawHub ranking, downloads, stars, or homepage placement.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The documented activation is what Buffett would do with [company/ticker], which is natural conversational language and could plausibly appear in ordinary investing discussion, not just as an intentional skill invocation. The file does not provide exclusion conditions or negative examples to clarify when this phrase should and should not activate the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The markdown includes a prescriptive feedback path, "DM me on X: @BeeGeeEth," which imposes a specific platform/locale choice in natural language. The file does not indicate that this channel is optional or provide alternative contact methods, so it can be read as a policy-violating forced channel requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.