Dual Thinking

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:36 AM UTC
• Version: 8.5.24

Overview

The skill is a coherent review helper, but its normal workflow can expose reviewed artifacts and local OpenClaw context to consultant sessions and includes under-scoped automatic patching and packaging checks.

Before installing, assume reviewed artifacts may be pasted into external or persistent consultant sessions. Do not use this on secrets, customer data, private source, or sensitive local runtime instructions unless you first redact and explicitly approve the disclosure scope. Run the packaging scripts only in a sandbox or after replacing the hardcoded global dependency with a pinned project-local dependency, and require human diff review before any real artifact or self-modifying patch is applied.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

other

Error

• Location: SKILL.md:17

Finding

Mandatory Artifact Repasting Can Disclose Sensitive Content to External Consultants

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 17
Vulnerability Type: External artifact disclosure
Risk Level: High

Vulnerable Snippet

text

2. The first consultant-bearing round on a new skill topic must paste the real artifact inline broadly enough for exact-wording review. Path-only references, `FILE:` labels without body text, shell snippets, unresolved placeholders, short summaries, and partial fragments that do not actually cover the claim under review do not count as pasted artifact. In fresh, replacement, or recovery consultant sessions, `STATE_SNAPSHOT`, `SYNC_POINT`, `RESUME_SNIPPET`, accepted-state summaries, patch summaries, or an intention to repaste later do not count as pasted artifact either.

Related requirements reinforce this behavior by requiring baseline artifacts to be repasted into fresh, replacement, and recovery consultant sessions before excerpts may be used.

Technical Analysis

The skill mandates broad inline transmission of the real artifact to an external consultant. It does not first require:

• Secret or credential detection.
• Redaction of personal or proprietary data.
• Data-classification checks.
• Confirmation that the consultant is local or external.
• Explicit user consent for third-party disclosure.
• Data minimization based on the specific review question.

An artifact may contain API keys, tokens, internal hostnames, customer data, private source code, deployment configuration, or confidential business logic. Requiring the artifact to be pasted broadly enough for exact-wording review can transmit this information to a third-party model provider and place it in persistent consultant chat history.

This is not direct network-exfiltration code, but it creates an agent-mediated disclosure channel as part of the skill's ordinary workflow.

Attack Path

1. A user requests review of an artifact containing confidential code, credentials, internal co ...[truncated 1233 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a mandatory sensitivity and secret scan before sending any artifact to a consultant.
2. Require explicit user consent before transmitting content to an external model or service.
3. Distinguish clearly between local and external consultants.
4. Default to local analysis when artifacts contain secrets, personal information, regulated data, or proprietary code.
5. Replace broad baseline-repaste requirements with a minimum-necessary excerpt policy.
6. Redact credentials, tokens, private keys, internal endpoints, customer identifiers, and unrelated confidential sections.
7. Display the exact proposed disclosure scope before transmission.
8. Do not copy sensitive baseline content into persistent or recovery chats unless separately authorized.
9. Document consultant retention, logging, and privacy assumptions in the runtime contract.
10. If safe disclosure cannot be established, downgrade to local analysis rather than treating the missing external repaste as a validation failure.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:167

Finding

OpenClaw Grounding Rules Encourage Access Beyond the Target Artifact

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 167-183
Vulnerability Type: Excessive local filesystem and instruction-surface access
Risk Level: Medium

Vulnerable Snippet

text

### OpenClaw Runtime Grounding Lock
When Dual Thinking reviews, rewrites, hardens, packages, validates, or creates any skill, code artifact, workflow, tool, runtime component, or publish-ready artifact intended to run inside OpenClaw or depend materially on OpenClaw behavior, it must inspect the relevant real local OpenClaw runtime surfaces before concluding that the artifact is OpenClaw-optimized, OpenClaw-grounded, runtime-ready, package-ready, publish-ready, or genuinely strong for OpenClaw rather than only strong in theory.

Relevant OpenClaw runtime surfaces include, as applicable to the task:
- the local OpenClaw code that governs skill discovery, skill loading, routing, invocation, toolcommand execution, sandboxing, approval boundaries, packaging, validation, or publication for the target artifact path
- the local OpenClaw system, developer, operator, or shipped instruction surfaces that constrain how skills are supposed to behave on that host
- any local runtime outputs, validator outputs, or host-scoped evidence needed to distinguish real OpenClaw behavior from generic agent theory

Binding rules:
- Do not optimize an OpenClaw-targeted artifact from generic agent best practice alone when OpenClaw-specific behavior is materially relevant.
- Do not claim OpenClaw optimization from skill quality alone.
- Do not treat theoretical compatibility, generic shell assumptions, guessed skill-loading behavior, or abstract agent-design patterns as proof of OpenClaw fit.
- Inspect the real local OpenClaw runtime surfaces that matter for the requested scope before convergence, structural deferral, packaging, publish-readiness, or OpenClaw-specific strength claims.
- If the local OpenClaw runtime surfaces are unavailable, inaccessi
...[truncated 3332 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict inspection to an explicit allowlist of project and OpenClaw runtime paths.
2. Enforce project-root confinement unless the user separately authorizes each external path.
3. Require confirmation before reading system, developer, operator, or host-level instruction surfaces.
4. Define sensitive-path exclusions for credentials, SSH material, environment files, browser profiles, cloud configuration, and unrelated workspaces.
5. Require read-only access and prohibit mutation during grounding inspection.
6. Record every inspected path in an audit log without copying sensitive contents.
7. Apply secret scanning and redaction before any local evidence is sent to a consultant.
8. Separate local grounding from external consultation; only sanitized conclusions should cross the boundary.
9. Narrow unsupported claims when authorized runtime surfaces are unavailable instead of expanding filesystem access.
10. Add tests confirming that traversal outside approved roots is rejected.

T08 · Insecure Dependencies

Error

• Location: scripts/check-review-excluded.js:1

Finding

Packaging Check Executes an Unpinned Host-Global Node.js Dependency

Content

View full analysis

Vulnerability Details

File Location: scripts/check-review-excluded.js, lines 1-10
Vulnerability Type: Unsafe third-party dependency loading
Risk Level: High

Vulnerable Snippet

javascript

const { listTextFiles } = require('/home/irtual/.npm-global/lib/node_modules/clawhub/dist/skills.js');
(async () => {
  const files = await listTextFiles('/home/irtual/.openclaw/workspace/skills/dual-thinking');
  const hasReview = files.some(f => f.relPath.startsWith('review/'));
  console.log(hasReview ? 'REVIEW_INCLUDED' : 'REVIEW_EXCLUDED');
  process.exit(hasReview ? 1 : 0);
})().catch(err => {
  console.error(err);
  process.exit(1);
});

Technical Analysis

The script loads and executes a JavaScript module from a mutable, user-specific global npm installation:

javascript

require('/home/irtual/.npm-global/lib/node_modules/clawhub/dist/skills.js')

Node.js executes top-level module code immediately during require. The project does not control this dependency through a project-local manifest, lockfile, version constraint, or integrity record. Consequently, the effective code executed by this packaging check is determined by the current contents of the host-global path rather than by the audited project.

The hardcoded workspace path also reduces portability and may cause the script to inspect a different installation than the project being audited.

Attack Path

1. An attacker obtains write access to the user's global npm directory, compromises a global package update, or causes an unsafe version of clawhub to be installed.
2. The attacker modifies clawhub/dist/skills.js or one of its transitive dependencies to include malicious top-level code.
3. A maintainer runs node scripts/check-review-excluded.js during validation or packaging.
4. Node.js evaluates the compromised module as part of require.
5. The malicious code executes with the permissions and environment ...[truncated 975 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare clawhub as a project-local dependency in package.json.
2. Commit a lockfile with package integrity metadata and use reproducible installation commands such as npm ci.
3. Import the package by its declared package name rather than through an absolute user-specific path.
4. Pin an reviewed version and verify package provenance or signatures where available.
5. Run packaging checks in a restricted environment with minimal filesystem and network permissions.
6. Avoid loading a large executable module merely to enumerate files; implement the small required operation locally when practical.
7. Accept the target project path as a validated command-line argument or derive it relative to the script directory.
8. Resolve and verify that the target path remains inside the intended project root.
9. Add a test that fails if the dependency resolves outside the project-local dependency tree.
10. Review transitive dependencies and automate integrity checks in the release pipeline.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a high-level consultation and escalation skill for code/skill review and engineering tasks. The supplied code does not implement consultation, second-opinion logic, escalation, rewriting, hardening, optimization, packaging, testing, or publish-readiness analysis. Instead, it performs a narrow local filesystem validation: enumerating text files in a fixed workspace path and checking whether review/ content is present. That is a materially different primary purpose from the declared behavior, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents an advisory/consultation capability focused on second opinions and escalation for skill engineering tasks. The supplied code does not implement consultation, review escalation, rewriting, hardening, optimization, packaging assistance, or publish-readiness decision logic. Instead, it is a narrow test script that checks for required text markers in repository documentation files and the existence of .clawhubignore. That is a materially different primary purpose: static compliance testing for a multi-orchestrator alternation contract. While testing is mentioned in the description, this code's specific behavior is not supportive of the declared consultation/escalation functionality; it represents an undeclared documentation/package validation capability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents an operational skill for second-opinion consulting and automatic skill-engineering escalation across review and publishing tasks. The supplied code does not implement consultation, review, rewrite, hardening, optimization, packaging, testing of software behavior, or escalation logic. Instead, it is a repository test that checks whether specific strings are present or absent in SKILL.md and reference markdown files. This is a materially different primary purpose: documentation/reference alignment verification rather than user-facing consultation or orchestration behavior. No suspicious extra permissions are used, but the behavior is clearly unrelated to the declared skill purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad second-opinion and skill-engineering escalation capability for review and improvement tasks. The supplied code chunk does not implement consultation, escalation, rewriting, hardening, optimization, or publishing logic. Instead, it is a narrow test script that greps for required strings in SKILL.md, a runtime contract document, and a packaging checklist, failing if the expected rollback-related text is absent. This is a materially different primary purpose from the declared behavior, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a consultation/escalation skill focused on review, rewrite, hardening, optimization, packaging, testing, and publish readiness workflows. The supplied code does not implement consultation, second-opinion generation, escalation, rewriting, or optimization behavior. Instead, it is a test harness that validates a fixture file's required fields and business rules for a round-flow format. That is a materially different primary purpose from the declared description, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents an operational consultation/escalation skill for reviewing and improving skills. The supplied code chunk does not implement consultation, reviews, rewrites, hardening, optimization, packaging, testing of a target skill's behavior, or publish-readiness escalation. Instead, it is a repository validation test that checks whether particular documentation and governance text is present in specific files. This is a materially different primary purpose: enforcing documentation/alignment constraints for a self-evolution policy, not providing the described second-opinion consultation workflow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description presents a broad consultation and escalation skill for reviews, rewrites, hardening, optimization, packaging, testing, and publish readiness. The supplied code does not implement consultation, escalation, rewriting, hardening, or packaging behavior. Instead, it is a narrow test script that checks whether a fixture text file contains required field labels for a 'weak-model shortcut' round. While 'testing' is mentioned in the description, that is only one small aspect of the declared purpose, and the code's actual primary purpose is specific fixture-format validation rather than the described consultation/escalation workflow. Therefore the code chunk materially differs from the declared purpose.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill explicitly authorizes self-review, self-hardening, and self-rewrite of the dual-thinking artifact. Self-modification in an agent skill is dangerous because it can weaken safeguards, preserve or amplify malicious instructions, and create recursive policy drift without an independent trust boundary; the surrounding text repeatedly elevates this behavior into a binding runtime rule, which increases the chance of unsafe autonomous changes.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

- the artifact under review is `dual-thinking`
- the user asks `dual-thinking` to improve itself
- the artifact is a skill in the same native domain as `dual-thinking`
- the user asks for stronger self-review, meta-review, self-hardening, or self-rewrite
- the user asks how to make the skill more powerful for the purpose it was created for

When active:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 930)May include surrounding context.

md

Do not encode candidate/release lineage labels in the runtime header of `SKILL.md`.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/examples.md (reported line 6)May include surrounding context.

md

## Example 1: initial activation for a skill rewrite
User request:
- `Rewrite this skill so weak models can execute it without stalling.`

Expected first-round state:
- `MODE: skill-rewrite`

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The file explicitly enables self-improvement, self-hardening, and self-rewrite behavior for the skill itself, which is a classic self-modification risk. In the context of an agent skill whose domain is review/orchestration, this is more dangerous because it encourages recursive capability escalation and weakening of original guardrails under the banner of becoming 'more powerful for the purpose it was created for.'

Content

Scanner excerpt · references/self-evolution-lens.md (reported line 17)May include surrounding context.

md

- the artifact under review is `dual-thinking`
- the user asks `dual-thinking` to improve itself
- the artifact is a skill in the same native domain as `dual-thinking`
- the user asks for stronger self-review, meta-review, self-hardening, or self-rewrite
- the user asks how to make the skill more powerful for the purpose it was created for

Precedence: early-exit conditions in `When not to use dual-thinking` suppress the lens for trivial work.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The file explicitly routes requests for 'self-hardening, meta-review, or self-rewrite' into an additional self-evolution lens, which creates a self-modification pathway. In a skill whose purpose includes escalation for reviews and rewrites, this materially increases the risk that the agent will alter its own behavior or instructions without sufficiently bounded approval, validation, or separation between analysis and modification.

Content

Scanner excerpt · references/skill-review-mode.md (reported line 6)May include surrounding context.

md

## Skill Architecture Mode
Use this mode when the topic is a skill or a skill-adjacent artifact.
Read `references/self-evolution-lens.md` when the reviewed artifact is `dual-thinking` itself or a native-domain-adjacent skill, or when the user explicitly asks for stronger self-review, self-hardening, meta-review, or self-rewrite. Purpose: force outside-self review and strength-for-purpose pressure.

### Required review angles
1. purpose clarity

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This is a markdown file, so vague-trigger review applies. The phrase "rewrite for stronger execution with weaker models and explicit topic/chat rules" describes a broad intent but does not define concrete trigger phrases, scope boundaries, or negative examples, which could lead to unintended invocation or confusion about when the skill activates.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This instruction explicitly directs the agent to mutate real artifacts during an active review loop, using only a minimal 'DRY_RUN'/'APPLY' marker as a gate, but without requiring explicit user authorization at the moment of modification. In an agent skill, that creates a real risk of unapproved file changes, especially when combined with automated review/rewrite workflows where the model may infer acceptance too broadly.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The directive 'do not ask the user to decide whether to patch while the review loop is active' removes a human approval checkpoint and encourages autonomous execution of modifications. In the context of a skill that performs rewrites, hardening, and artifact improvement, this materially increases the chance of unauthorized or unsafe changes being applied without meaningful user consent.

Content

Scanner excerpt · references/patch-discipline.md (reported line 29)May include surrounding context.

md

## What not to do
- do not stop with only a suggestion list when a real fix is accepted
- do not ask the user to decide whether to patch while the review loop is active
- do not hide the accepted change in a later summary

## Version bump rule

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/reference-scenarios.md (reported line 175)May include surrounding context.

md

### Invalid outcomes
- stale model memory alone is treated as proof of current-date external alignment
- generic AI trends are imported without checking fit for the artifact's actual native domain and constraints
- cloud-first, hosted, or external-API solutions are smuggled into a local-only artifact

### Pass conditions

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger conditions are broad enough to activate on generic requests for review, improvement, or stronger self-assessment, which can expand the skill's authority beyond narrowly intended use. In a self-reviewing orchestration skill, this increases the chance of unintended self-modification or overreach into high-impact advisory behavior without clear user intent boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation rule is broad enough to trigger this review mode for loosely related 'skill-adjacent' topics and for subjective requests like 'stronger self-review.' In an agentic system, ambiguous routing criteria can cause the wrong review workflow to run, expanding scope, pulling in additional references, and increasing the chance of unsafe or unintended behavior during analysis or self-modification tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. The quoted content on L33-L37 is presented in Russian in an otherwise English document, with no indication that the user opted into Russian or that the file is intentionally region-specific.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The CONTINUATION_SIGNAL: continue field is a generic trigger that could be matched too broadly by workflow logic, causing an unintended next-step invocation if parsers or orchestrators treat any occurrence of continue as authorization to resume. In this skill context, the file is explicitly orchestration state for multi-step automation, which makes ambiguous continuation semantics more dangerous than ordinary metadata because it can propagate execution across orchestrators without a strict state check.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.