CtrlZ

• Outcome: Review
• Latest audit: May 28, 2026 · 4:49 AM UTC
• Version: 1.0.0

Overview

CtrlZ is a coherent undo skill, but it can delete or overwrite local files from broad “undo” triggers without preview or confirmation.

Review before installing. Use explicit /ctrlZ commands rather than broad natural-language triggers, inspect the undo list before rollback, avoid recording secret-bearing files, and understand that package installs and external command effects are not fully undone.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill promises automatic, comprehensive undo of recent conversation changes, but the documented behavior is narrower: it only reverts operations that were explicitly recorded, and package installations are not actually undone. This mismatch can cause users to rely on a false safety net, leading to accidental data loss, incomplete rollback, or persistence of risky system changes they believed had been reverted.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill advertises that it can revert installations, but for package installs it only prints manual uninstall suggestions and does not actually reverse the change. In an undo-oriented safety tool, this mismatch can mislead users or higher-level agents into believing system changes were reverted when they were not, leaving persistent software modifications in place.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The clear command irreversibly deletes all undo records and backup artifacts, which is unrelated to narrowly undoing the last step and can destroy recovery data. In a tool intended to provide rollback and accountability, exposing a bulk wipe operation increases the chance of accidental or intentional loss of forensic and restoration capability.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The header claims the script records and reverts all AI changes, but the implementation only undoes operations that are explicitly recorded through this wrapper and cannot automatically reverse installs. This creates a dangerous trust gap: users may rely on a false sense of recoverability and take riskier actions under the assumption that all changes are safely undoable.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The natural-language trigger includes the single word "undo," which is highly ambiguous and likely to appear in ordinary conversation. In an agent environment that auto-invokes skills from user phrasing, this can cause unintended activation of a destructive rollback action, reverting files or other recent changes without the user explicitly intending to call the skill.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README describes one-command reversion of file modifications, deletions, and other changes, but it does not prominently warn that invoking the skill performs destructive state changes. Users may interpret the feature as a harmless conversational undo and trigger it without understanding that it can delete or revert real workspace changes, increasing the chance of accidental data loss.

Vague Triggers

High

• Confidence: 92% confidence
• Finding: Triggers like "undo" and "ctrl+z" are so broad that normal conversation or ambiguous user phrasing could invoke rollback unexpectedly. In a skill that can revert or delete files, unintended activation is dangerous because it may destroy recent work without the user meaning to trigger the command.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The description omits a clear warning that undo can revert or delete recent file changes and may not fully reverse external side effects. Without this notice, users may invoke the skill assuming it is safe and complete, increasing the chance of accidental destructive actions and misplaced trust in rollback coverage.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: These test cases normalize destructive undo behavior that deletes files and directories, including entire paths, without any explicit warning, confirmation, or scope restriction. In an agent skill whose purpose is automatic rollback, this increases the chance of accidental data loss if the wrong path is recorded, if session state is stale, or if users misunderstand what will be removed.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The clear operation deletes database records and backup files without any confirmation, making recovery impossible if triggered accidentally or by an upstream agent mistake. Because this skill is explicitly positioned as an undo mechanism, silent destruction of rollback state is especially risky and undermines the core safety function.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The undo logic can remove files or recursively delete directories based solely on recorded paths, with no validation, preview, or confirmation before destructive actions occur. If incorrect, poisoned, or stale records are present, invoking undo could delete unintended data and amplify prior mistakes.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# Scenario: Set up AI News Agent but config wrong, want to revert everything

# 1. Create original file
cp ~/.openclaw/cron/jobs.json ~/.openclaw/cron/jobs.json.bak

# 2. Start a big session

• Confidence: 78% confidence
• Finding: The integration test operates on persistent user configuration under ~/.openclaw, showing the skill is intended to modify and later restore real session state rather than isolated test fixtures. In this context, an undo system is more dangerous because mistakes, stale snapshots, or partial rollback can affect durable agent configuration and create data loss or inconsistent state across sessions.

Session Persistence

Medium

• Category: Rogue Agent

Content

ctrlz record $SESSION file_edit ~/.openclaw/cron/jobs.json
# ... modify json ...

# 4. Create database
ctrlz record $SESSION dir_create ~/.openclaw/agents/ai-news-agent
echo "CREATE TABLE..." | sqlite3 ~/.openclaw/agents/ai-news-agent/news.db

• Confidence: 84% confidence
• Finding: This test records deletion of an application directory under ~/.openclaw and then creates a database inside it, implying that undo may recursively remove a persistent agent directory and its contents. In a skill designed for automatic reversal, recursive deletion of durable directories is particularly risky because newly created or unrelated files inside that path could be erased during rollback.

Static analysis

No suspicious patterns detected.