Security audit

Skill Engineer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed skill-building workflow helper, but it also asks agents to use broad private memory, unpinned external tooling, scheduled follow-up jobs, and repository pushes.

Review this skill before installing. Use it only in a dedicated workspace, avoid enabling broad memory search unless you explicitly need prior-session context, verify any DeepWiki dependency before running it, and do not allow cron jobs, git commits, or remote pushes unless you have reviewed the exact diff and destination.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:55
Finding: Mandatory Broad Access to Persistent Session History and Private Memory
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:55
Finding: Unpinned Third-Party DeepWiki Dependency Is Installed and Executed
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:366
Finding: Workflow Registers Scheduled Jobs Without a Defined Cleanup Mechanism
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:458
Finding: Repository-Wide Staging and Automatic Push Can Exfiltrate Unrelated Files
Content: View full analysis
"` - After Designer revisions (iteration 2+): `git add . && git commit -m "fix: address review issues (iteration N)"` - After Tester passes and before ship: `git add README.md && git commit -m "docs: add quality scorecard for "` **When to push:** - After final ship (all gates passed): `git push origin main` - Do NOT push intermediate iterations — only ship-ready artifacts **Branch strategy:** - Work in main branch for routine skill development - Use feature branches for experimental or breaking changes ``` ```markdown | **Git push fails** | Exit code ≠ 0 | Retry once. If fails again, report to user: "Cannot push to remote. Check network/permissions." | ``` The behavior conflicts with the declared boundaries in `SKILL.md`, lines 145-150: ```markdown ### What This Skill Does NOT Handle - **Release pipeline** — publishing, versioning, changelogs belong to release processes - **Repository management** — git submodules, repo creation, branch strategy belong to your VCS workflow - **Deployment** — installing skills to agents, configuration management ``` ### Technical Analysis `git add .` stages every unignored modification under the current Git working tree, not only files generated by this Skill. If the repository contains unrelated source changes, private notes, configuration files, build artifacts, or newly created sensitive files, those items can be included in the commit. The workflow then directs the Agent to push directly to `origin main`. It does not require: - User confirmation - Ver ...[truncated 2182 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:350
Finding: Global Nested-Subagent Configuration Expands Delegation Privileges
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad multi-agent system for skill design and quality assurance, involving Designer, Reviewer, and Tester subagents. The actual code is a simple shell utility that validates the presence of expected files in a skill directory. While this could be a small supporting check within a larger skill-maintenance workflow, the supplied code chunk itself does not implement the declared primary purpose and instead has a materially narrower and different function. Therefore, this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a broad multi-agent quality-gated skill engineering capability, including orchestration of Designer, Reviewer, and Tester subagents for designing, reviewing, testing, auditing, and refactoring skills. The supplied code does none of that. It is a narrowly scoped validation utility that counts rubric check rows in a SKILL.md file and verifies the total equals 33. This is not a supporting implementation detail of the declared behavior; it is a materially different and much narrower function. There are no undeclared dangerous permissions, but the primary purpose and capabilities are clearly mismatched.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a comprehensive skill-engineering system that orchestrates multiple subagents for iterative refinement and quality-gated development of OpenClaw skills. The supplied code does none of that. It is a single-purpose scoring script: it reads rubric markdown files from disk, extracts criterion scores with regex, computes totals/percentages/ratings, and prints JSON (plus optional pretty summaries). While this may support auditing workflows, it is only a narrow reporting utility and not the described designer/reviewer/tester orchestration capability. Therefore the description materially misrepresents the code chunk’s actual primary purpose and capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill orchestrates multiple subagents for iterative skill development and quality-gated review/testing of OpenClaw agent skills. The supplied code does nothing of that sort. It is a narrow shell utility that reads a README file, finds a 'Quality Scorecard' section, parses numeric scores, checks whether their sum matches the stated total, and exits accordingly. This is a materially different primary purpose and capability set from the declared description, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description describes a broad agent skill engineering system with iterative refinement and orchestration of Designer, Reviewer, and Tester subagents. The supplied code instead is a narrow utility script for validating trigger definitions and trigger test coverage in a skill directory. It performs file existence checks, parses YAML-like trigger entries, reads JSON test cases, checks minimum counts, warns about uncovered triggers, and reports pass/fail. This is materially different from the declared primary purpose and lacks the advertised capabilities, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly claims repository management and release pipeline work are out of scope, then later instructs the agent to perform git commits, pushes, and branch-strategy decisions. This contradiction is dangerous because it can bypass user expectations and lead an autonomous agent to mutate and publish repository state despite earlier assurances that it would not do so.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 397)May include surrounding context.
md
## Orchestrator Responsibilities The Orchestrator (depth-1 subagent in Mode B, or main agent in fallback mode) owns the Design→Review→Test loop. It does NOT write skill content or evaluate quality — it only coordinates. 1. **Query DeepWiki** for any OpenClaw-specific topics in the requirements (if Director hasn't already) 2. **Spawn Designer** with requirements, DeepWiki findings, and any prior feedback

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 826)May include surrounding context.
md
A skill is a **directory** containing at minimum a `SKILL.md` file:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 895)May include surrounding context.
md
A skill is a **directory** containing at minimum a `SKILL.md` file:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 903)May include surrounding context.
md
A skill is a **directory** containing at minimum a `SKILL.md` file:

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Adding GitHub and registry publishing capabilities extends the skill into remote-side effects unrelated to its core design/review/test purpose. In skill context this is more dangerous because users may invoke it expecting local artifact preparation, while the skill is also equipped to create repos or publish packages externally.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/designer-guide.md (reported line 333)May include surrounding context.
md
5. Map data flow between steps 6. Plan for error handling at each step ### Step 4: Write SKILL.md **A. YAML Frontmatter**

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 74% confidence
Finding: The skill instructs extensive filesystem inspection, shell command execution, git operations, and subagent orchestration, but it declares no explicit tool scope or allowed-tools boundary. In an agent skill, missing capability constraints increases the chance the skill is invoked with broader-than-necessary authority and can perform unintended local actions during normal use.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file repeatedly defines review success in terms of 33 checks and a passing threshold of 28/33, but the 'Every shipped skill' scorecard example totals 29/30. This is not mere omission; it provides a concrete output template inconsistent with the actual scoring model described elsewhere, which could mislead implementers and auditors.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill directs git push origin main without an explicit user-facing warning or confirmation gate. In an autonomous agent setting, silently pushing to a remote repository can leak sensitive changes, overwrite shared state, or trigger CI/CD workflows, making this materially risky.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The Configuration section says 'No persistent configuration required,' yet the skill elsewhere requires vector memory enabled in openclaw.json, DeepWiki installed, and even lists gh and clawhub CLIs as requirements. That is an active contradiction in operational behavior: the skill does rely on environment and configuration prerequisites.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The rubric explicitly instructs reviewers to execute repository-provided shell scripts, which creates a trust-boundary violation: a reviewer may run untrusted code from the skill package or local installation without prior inspection or sandboxing. In the context of agent skills, where content must be treated as potentially adversarial, this can lead to arbitrary command execution, data exfiltration, or host modification on the review environment.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes several broad, natural-language phrases such as 'review skill', 'test skill', and 'evaluate skill' that can plausibly appear in ordinary discussion, increasing the chance of unintended activation. Because this skill orchestrates lifecycle actions over other skills, accidental invocation could cause unnecessary analysis, workflow hijacking, or confusing agent behavior even without malicious intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Several trigger examples in this range are ambiguous about scope, including phrases like "validate skill structure," "build agent skill," and "maintain the skill lifecycle." These can overlap with general consulting or engineering language, increasing the chance of accidental activation, routing confusion, and unintended invocation of a powerful orchestration skill that can review, test, and modify other skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase at line 11, "help me design a skill", is broad enough to match ordinary user requests that may not specifically intend to invoke this skill. In an agent-routing context, overly generic triggers can cause misfires, unintended delegation, or interception of requests better handled by other skills, reducing reliability and potentially exposing broader skill capabilities than the user intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The cron safety-net guidance introduces persistent background behavior and local file inspection without clearly surfacing those side effects. While lower impact than remote pushes, hidden scheduled checks can surprise users, consume resources, and create unintended monitoring of workspace contents.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The rubric's stated review intent includes checking that artifacts contain no hardcoded paths, org names, or private/internal details, yet it documents the internal path /tmp/openclaw-skill-skill-engineer/scripts/ as the expected script location. That is a direct contradiction between the document's operational guidance and its own stated OPSEC-style standard, not merely an omission.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.