Incident Response

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:05 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed incident-response workflow, but it gives agents broad operational authority and persistent follow-up actions without clear approval gates.

Review before installing. Use only with trusted OpenClaw operators and require explicit confirmation before reading session histories, restoring configuration, restarting services, changing chmod, committing to git, creating cron jobs, or writing SOUL.md/rules.md/MEMORY.md. Scope each run to a named host and incident, redact session-log evidence, avoid git add -A, and give any monitoring job a fixed expiry and read-only default.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:155

Finding

Mandatory Recurring Monitoring Creates Cross-Session System Persistence

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:141

Finding

Incident Workflow Persistently Modifies Agent Rules and Long-Term Memory

Content

View full analysis

/agent/SOUL.md` as a Hard Rule (HR-NNN) **For recurring mistakes:** Add to `~/.openclaw/learnings/rules.md` with category and date ``` From `SKILL.md:170-176`: ```markdown ## Phase 6: Document Write to `~/.openclaw/learnings/rules.md` if a Hard Rule should be added: - Category: HR (Hard Rule, recurring) or SR (Soft Rule, first offense) - Include: what triggered, what the rule is, date learned, why it matters Update `MEMORY.md` with incident summary if it's systemic. ``` From `references/prevention-patterns.md:19-53`: ```markdown ## Pattern 2: SOUL.md Hard Rule Use when an agent repeatedly makes the same mistake autonomously. ```markdown ## [Area] — Hard Restriction (HR-NNN) **NEVER [do X].** This causes [Y consequence]. - Correct approach: [what to do instead] - Why: [root cause context] - Learned: [date] — [brief incident description] ``` **Real examples:** - HR-008: Validate schema before writing any config key - HR-009: Config change process — always use config-validate.sh --merge - HR-010: No self-restart or self-config (revoked after 3 incidents) ## Pattern 3: rules.md Hard Rule Use when the agent needs a persistent system-wide rule. File: `~/.openclaw/learnings/rules.md` ```markdown ### HR-NNN: [Title] [What happened] — [date] **Rule:** [Imperative statement of what to always/never do] - **Trigger:** [When this applies] - **Action:** [What to do] - **Learned:** [date + incident summary] ``` ``` ### Technical Analysis The skill directs the agent to write incident-derived content into `SOUL.md`, `rules.md`, and `MEMORY.md`. These files are persistent state that can affect subsequent sessions and, in the ...[truncated 1663 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:58

Finding

Unredacted Session Tool Inputs Can Disclose Credentials and Sensitive Data

Content

View full analysis

" "rg -rl 'keyword' ~/.openclaw/agents/*/sessions/*.jsonl | head -5" # Extract tool calls from a session ssh "" "python3 << 'EOF' import json for line in open('SESSION.jsonl'): obj = json.loads(line) if obj.get('type') != 'message': continue for block in obj.get('message',{}).get('content',[]): if block.get('type') == 'toolCall' and block.get('name') in ['Write','Edit','gateway','exec']: print(obj['timestamp'], block['name'], str(block.get('input',''))[:200]) EOF" ``` ``` ### Technical Analysis The evidence-collection procedure searches agent session histories and prints the first 200 characters of raw tool-call input. Tool inputs for `Write`, `Edit`, `gateway`, and especially `exec` may contain access tokens, passwords, private keys, API credentials, personally identifiable information, private paths, configuration values, or command-line secrets. The fixed 200-character truncation is not a security control because credentials commonly occur near the start of command arguments or serialized input. No key-based filtering, credential-pattern redaction, output minimization, authorization check, or secure output channel is provided. Printed values can consequently enter the active transcript, terminal history, audit logs, or later incident reports. ### Attack Path 1. A previous session invokes a tool with a secret in its arguments or file content. 2. An incident involving a related keyword triggers the session-log search. 3. The investigator selects the matching JSONL session. 4. The extraction script serializes and prints raw tool-call input. 5. A credential located in the first 200 characters appears i ...[truncated 576 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:150

Finding

Overbroad Git Staging Can Commit Unrelated Sensitive Files

Content

View full analysis

" "cd ~/.openclaw && git add -A && git commit -m 'prevention: after '" ``` ``` ### Technical Analysis The command executes `git add -A` from `~/.openclaw`, staging all modified, deleted, and untracked files in that repository. The same project documentation identifies this directory as containing configuration, agent files, learning rules, backups, session JSONL data, and other operational state. Repository-wide staging is unnecessary for committing a specific prevention change. It can capture unrelated files created before or during the incident, including sensitive configuration, session records, memory files, backup data, or credentials. Once committed, deleting the working-tree file does not remove it from Git history. The workflow also omits a review of the staged diff before committing. ### Attack Path 1. A sensitive modified or untracked file exists under the `~/.openclaw` Git worktree. 2. The incident workflow creates or edits a prevention rule. 3. The mandatory commit command runs `git add -A`. 4. Git stages both the intended prevention file and the unrelated sensitive file. 5. The commit records all staged content in durable repository history. 6. If the repository is backed up, shared, or pushed, the sensitive content is propagated to additional locations. ### Impact Assessment The issue can expose any readable file located within the Git worktree and not excluded effectively by repository configuration. Committed secrets may grant the privileges associated with those credentials. Session histories and memory files can expose private conversations or operational details. Git history makes remediation more difficult because ordin ...[truncated 66 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 87% confidence

Finding

The command uses a destructive filesystem operation directly on a path containing a variable-like agent placeholder, which can be misapplied if an agent, wrapper, or user substitutes the wrong value or broadens the target. Although the troubleshooting context is legitimate, documenting raw deletion as a normal fix increases the chance of parameter abuse and avoidable data loss.

Content

Scanner excerpt · references/checklists.md (reported line 50)May include surrounding context.

md

1. `openclaw memory status` — check indexed count vs total files
2. If indexed << total: `openclaw memory index --force --agent AGENT_ID`
3. If stuck: delete sqlite → `rm ~/.openclaw/memory/AGENT.sqlite` → restart gateway
4. Check config: `python3 -c "import json; d=json.load(open('openclaw.json')); print(d['agents']['defaults'].get('memorySearch',{}))"`
5. Verify `sources: ["memory","sessions"]` and `extraPaths` are present

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/prevention-patterns.md (reported line 102)May include surrounding context.

text

Prevents direct writes; forces all changes through config-validate.sh which has guards.
**Note:** Adapt chmod strategy to your machine setup — some setups give specific agents controlled self-modify rights.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases are broad enough to match routine troubleshooting requests such as "fix {thing}" or "debug {thing}," which can invoke a powerful incident-response skill unexpectedly. Because the skill grants exec, git, python3, filesystem write, and cron-related capabilities, accidental or adversarial invocation could lead to unauthorized investigation, system changes, or persistence-oriented follow-up actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README advertises recovery steps such as 'Merge from known-good backup, verify, restart' and scheduling cron-based monitoring, but does not prominently warn that these actions can modify system state or disrupt services. In an agent skill context, describing destructive or state-changing actions without an explicit approval boundary increases the risk of unsafe autonomous execution.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The workflow explicitly instructs writing incident learnings to persistent local files, including ~/.openclaw/learnings/rules.md and MEMORY.md. Persistent memory writes can retain sensitive operational details, incident artifacts, hostnames, or assumptions beyond the current session, creating confidentiality and integrity risks if the stored content is later reused without review.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

md

| 3 | Restore | Merge from known-good backup, verify, restart |
| 4 | Prevent | Add guards proportional to severity (config guard, SOUL.md rule, chmod) |
| 5 | Monitor | Schedule a cron check (7–30 days depending on severity) |
| 6 | Document | Write to `~/.openclaw/learnings/rules.md` and MEMORY.md |

**Rule: Never skip a phase. Never assume — follow the evidence.**

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list includes broad, everyday phrases like 'root cause', 'audit X', and 'agent not responding' that could match routine conversation and invoke the skill unintentionally. Because this skill appears to guide operational investigation and recovery actions, accidental activation could steer an agent into sensitive diagnostic or remediation workflows without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list includes very broad phrases such as "fix this," "investigate," and "something changed," which can cause the skill to activate in routine conversations without clear user intent for incident-response actions. In this skill, unintended activation is risky because later phases direct the agent to inspect systems, restore config, restart services, and make persistent changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to restore configuration, restart the gateway, modify validation scripts and agent rules, commit to git, create cron jobs, and write to persistent learning files without an explicit safety checkpoint or user-approval step for system-impacting actions. Because the skill is owned by "any agent with exec access," these instructions could directly alter production state, create persistence, and institutionalize incorrect changes after a misdiagnosis or accidental invocation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill directs the agent to append incident-derived rules to ~/.openclaw/learnings/rules.md, creating persistent state that can influence future behavior beyond the current task. Persistent memory writes are dangerous when they are generated from potentially incomplete incident analysis, because mistakes or adversarially induced conclusions can become durable policy and affect later sessions.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

## Phase 6: Document

Write to `~/.openclaw/learnings/rules.md` if a Hard Rule should be added:
- Category: HR (Hard Rule, recurring) or SR (Soft Rule, first offense)
- Include: what triggered, what the rule is, date learned, why it matters

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The checklist recommends deleting a SQLite file as a recovery step without any warning, scope limitation, or backup guidance. In an agent skill context, terse operational commands can be copied or automated blindly, which creates a real risk of unintended data loss or deletion of the wrong file if placeholders are substituted incorrectly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template uses subjective stopping criteria such as "good enough" and also instructs the cron to continue until explicit user stop, which can lead to indefinite monitoring and overreach beyond the user’s likely intent. In an agent skill, ambiguous lifecycle control is dangerous because it can normalize persistent automated actions without clear authorization boundaries or objective termination conditions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The template includes remote shell access, git inspection, restore commands, guard modifications, and commit actions, but it does not require an explicit warning or approval gate before system-modifying behavior occurs. In this context, the skill is more dangerous because it is a reusable operational template that could be copied into autonomous workflows, causing unauthorized restoration, configuration changes, or persistence of preventive controls on production systems.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/prevention-patterns.md (reported line 76)May include surrounding context.

Pattern 5: Valid Keys Guard

Use when agents write invalid config keys (causing gateway crashes).

Add to config-validate.sh validate() function:

python

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/prevention-patterns.md (reported line 98)May include surrounding context.

Use for critical config files on multi-agent machines.

bash

chmod 444 ~/.openclaw/openclaw.json  # read-only; config-validate.sh handles unlock/relock

Prevents direct writes; forces all changes through config-validate.sh which has guards.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/prevention-patterns.md (reported line 102)May include surrounding context.

text

Prevents direct writes; forces all changes through config-validate.sh which has guards.
**Note:** Adapt chmod strategy to your machine setup — some setups give specific agents controlled self-modify rights.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Several triggers in this section are highly ambiguous, including phrases like "root cause," "audit {thing}," and "something disappeared," which are common in normal conversation and may activate the skill without clear user intent. In the context of a high-privilege operational skill, this increases the chance of unsafe activation and misuse of investigation or restoration tooling.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill is allowed to write to ~/.openclaw/learnings/rules.md, creating persistent state that survives the current session. Even though the stated purpose is prevention rules, session-persistent writes can be abused to influence future agent behavior, encode unsafe instructions, or create hard-to-audit long-term changes, especially when paired with broad invocation and incident-response privileges.

Content

Scanner excerpt · skill.yml (reported line 67)May include surrounding context.

yaml

- exec: git (audit trail, config backups)
  - exec: python3 (config diff and restore scripts)
  - filesystem: read config-backups/ and session JSONL logs (read-only investigation)
  - filesystem: write ~/.openclaw/learnings/rules.md (prevention rules)
  - cron: schedule monitoring jobs post-incident

skill_metadata:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This is a real trigger-quality issue: several positive utterances such as "settings disappeared," "my API key is missing," or "who changed my config" are broad, natural-language problem statements that may arise outside a true incident-response scenario. In a trigger-based skill, overly generic phrases can cause unintended activation, pulling the user into incident-response workflows when they may be asking about ordinary support, account, or product-usage issues.

Content

No source excerpt is available for this finding.