Multi Step Workflow

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:22 AM UTC
• Version: 4.4.5

Overview

This workflow skill is mostly coherent, but its optional snapshot feature can retain sensitive task context after claiming it was cleared.

Install only if you are comfortable with a workflow skill that runs local node scripts and may store raw task context in a project-specific temp directory when snapshots are enabled. Keep useSnapshots disabled unless needed, and do not rely on the provided clear command to remove saved snapshot contents until the script is fixed to actually delete or sanitize the snapshot file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/context-snapshot.js:77

Finding

Snapshot Clear Operation Retains Sensitive Context

Content

View full analysis

Vulnerability Details

File Location: scripts/context-snapshot.js, lines 77-81
Vulnerability Type: Improper deletion of sensitive information
Risk Level: Medium

Vulnerable Code

javascript

else if (cmd === 'clear') {
  const snapshot = loadSnapshot();
  if (snapshot) {
    saveSnapshot(snapshot.task, snapshot.findings, snapshot.pending, snapshot._clearedAt = new Date().toISOString());
  }
  console.log(JSON.stringify({ ok: true, message: 'Snapshot cleared.' }));
}

Technical Analysis

The clear command does not delete the snapshot or sanitize its sensitive fields. Instead, it loads the existing snapshot and writes the original task, findings, and pending values back to the same file. The clearing timestamp is passed as the lastError argument, so the rewritten snapshot still contains the data that the user intended to remove.

The command then unconditionally reports "Snapshot cleared.", creating a false assurance that deletion succeeded. Because snapshots are explicitly designed to contain high-fidelity raw findings and may also contain error details, retained content can include sensitive project information.

Attack Path

1. Snapshot support is enabled.
2. The agent invokes save with sensitive task context, findings, pending work, or error information.
3. The user or agent invokes node scripts/context-snapshot.js clear.
4. The script reloads the snapshot and rewrites its sensitive contents instead of deleting them.
5. A later invocation of node scripts/context-snapshot.js load, or direct access by another process running as the same operating-system user, recovers the supposedly cleared information.

Impact Assessment

This issue causes unintended local retention and disclosure of snapshot content. The affected scope is the project-specific snapshot file under the operating system's temporary directory.

The flaw does not grant elevated privileges, bypas ...[truncated 315 chars]

Remediation

View remediation

Remediation Suggestions

Implement clear by deleting the snapshot file with unlinkSync or its asynchronous equivalent rather than rewriting the existing values. Handle deletion errors explicitly and report success only after deletion completes.

Example:

javascript

import {
  readFileSync,
  writeFileSync,
  existsSync,
  chmodSync,
  unlinkSync
} from 'fs';

// ...

else if (cmd === 'clear') {
  try {
    if (existsSync(SNAPSHOT_FILE)) {
      unlinkSync(SNAPSHOT_FILE);
    }
    console.log(JSON.stringify({
      ok: true,
      message: 'Snapshot cleared.'
    }));
  } catch (error) {
    console.error(JSON.stringify({
      ok: false,
      error: 'Failed to clear snapshot.'
    }));
    process.exit(1);
  }
}

Add automated tests verifying that:

1. Saving and then clearing a snapshot removes the file.
2. load returns no snapshot after clearing.
3. Deletion failures produce a nonzero exit status and do not claim success.
4. Repeated clear operations are safely idempotent.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose overstates the skill's security and workflow guarantees, while the actual content appears to be a generic SOP plus references to local JSON snapshotting rather than a hardened sandbox system. In security-sensitive agent environments, overstated controls can lead operators to permit broader autonomy, subprocess use, or data handling than is justified.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose overstates the skill's security and workflow guarantees, while the actual content appears to be a generic SOP plus references to local JSON snapshotting rather than a hardened sandbox system. In security-sensitive agent environments, overstated controls can lead operators to permit broader autonomy, subprocess use, or data handling than is justified.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

1. **Decompose**: Register steps in `task-tracker.js`.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to run shell-capable commands such as node ... and openclaw config ... but does not declare any explicit tool scope or allowed-tools boundary. That creates an authorization and review gap: consumers cannot easily tell what execution powers the skill expects, and an agent may be induced to invoke shell commands without clear sandbox/tool restrictions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The clear command does not delete or sanitize the saved context; it reloads the existing snapshot and writes the same sensitive fields back to disk while only modifying metadata. This creates a misleading security boundary: users or higher-level workflows may believe task context has been erased, but private task details, findings, pending work, and errors remain recoverable from the snapshot file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

该文件整体以中文编写，且未说明是否提供其他语言版本或允许用户按偏好选择语言。根据规则，若技能在自然语言层面强制特定语言而没有用户选择或合理限定，属于语言/区域策略风险。

Content

No source excerpt is available for this finding.