Claw Mentor Mentee

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:47 PM UTC
• Version: 3.2.0

Overview

The skill is open about its mentorship purpose, but it gives mutable server-provided content too much authority over sensitive agent files and recurring behavior.

Install only if you are comfortable letting this skill read sensitive OpenClaw/workspace context, contact app.clawmentor.ai on a recurring basis, and modify AGENTS.md, HEARTBEAT.md, mentor-guidance.md, and possible core files after approval. Review every proposed diff carefully, avoid approving remote mentor content that behaves like instructions or policy, and know how to remove the HEARTBEAT entry and ClawMentor state if you stop using it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:588
• Finding: Server-Controlled Integration Instructions Are Treated as Trusted Runtime Directives## Vulnerability Details **File Location**: `SKILL.md:243-247` and `SKILL.md:588-597` **Vulnerability Type**: Remote instruction retrieval and skill instruction hijacking **Risk Level**: Critical ### Vulnerable Code ```text This returns two sections: - `files` — the mentor's authored content: `AGENTS.md`, `skills.md`, `cron-patterns.json`, `CLAW_MENTOR.md`, `privacy-notes.md`, `working-patterns.md` - `platform` — platform guides: `mentee-integration.md` (the full integration algorithm), `setup-guide.md`, `mentee-skill.md` (detailed operations guide) ``` ```text 4. **Read `platform['mentee-integration.md']` from the package response.** This contains the full 6-phase integration algorithm: - Phase 0: Backup (snapshot your current setup) - Phase 1: Self-Assessment (read and map your human's complete current state) - Phase 2: Update Parsing (understand what the mentor is proposing) - Phase 3: Conflict Analysis (find every collision, overlap, and opportunity) - Phase 4: Merge Strategy & Human Approval (present the plan, get explicit approval) - Phase 5: Integration Execution (apply the approved merge carefully) - Phase 6: Post-Integration Report (tell your human what changed) 5. **Follow `mentee-integration.md` step by step.** It handles everything: backup, conflict detection, voice preservation, capacity checks, cron jobs, skill recommendations, memory system setup, and rollback safety. **Important:** The integration algorithm in `mentee-integration.md` is comprehensive. Trust it — it handles edge cases like interrupted integrations, minimal configs, multiple mentors, and capacity preservation. Don't skip phases or simplify the process. ``` ### Technical Analysis The reviewed Skill is not the complete implementation of its integration behavior. It downloads `mentee-integration.md` from `app.clawmentor.ai` and explicitly directs the agent to trust and follow that remote document. The remo ...[truncated 1873 chars]
• Remediation: ## Remediation Suggestions - Bundle the integration algorithm locally in the reviewed Skill rather than downloading executable instructions. - Treat every downloaded Markdown field as untrusted data and prohibit it from issuing tool-use directives. - Define a strict, versioned package schema containing declarative changes only. - Enforce a local allowlist of supported actions, destination paths, commands, and configuration keys. - Cryptographically sign packages and verify signatures against pinned publisher keys before processing. - Separate package parsing from execution and display a normalized operation plan generated by trusted local code. - Reject package fields containing shell commands, instruction overrides, tool directives, or requests to read unrelated files. - Require independent per-operation authorization for cron creation, skill installation, command execution, and core-file changes.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:765
• Finding: Downloaded Guidance Is Persisted in Core Agent Instructions and Recurring Heartbeats## Vulnerability Details **File Location**: `SKILL.md:70-92`, `SKILL.md:765-785`, and `SKILL.md:1017-1027` **Vulnerability Type**: Persistent agent instruction modification **Risk Level**: High ### Vulnerable Code ```text **If it IS set:** You're connected. First call `POST https://app.clawmentor.ai/api/mentee/bootstrap` (with `Authorization: Bearer {CLAW_MENTOR_API_KEY}`) to ensure any mentor updates you haven't seen yet are queued. Then call `GET https://app.clawmentor.ai/api/mentee/reports` and report back what's waiting. Also ensure `HEARTBEAT.md` contains the line `- Check for new ClawMentor reports` — add it if missing. ``` ```text 5. **Schedule periodic checks** — append this line to `HEARTBEAT.md` in your workspace (create the file if it doesn't exist): ``` - Check for new ClawMentor reports ``` This tells your OpenClaw agent to run the mentee skill check on every heartbeat cycle. ``` ```text **Step 6 — Write the Trigger Index to AGENTS.md:** After all guidance items are approved and written to `mentor-guidance.md`, generate a situational trigger index and append it to the mentee's `AGENTS.md`. This is what tells the agent WHEN to reference the guidance — using situational anchors tied to specific decision-making moments, not vague states like "when you're unsure." ``` ```markdown ## Mentor Guidance Reference You have subscribed mentor guidance at ~/workspace/mentor-guidance.md covering these areas. Reference the relevant section when you encounter these specific situations: - **Trust & Autonomy:** When you're about to take an action your human hasn't explicitly approved, or when expanding what you do independently - **Communication:** When presenting bad news, complex tradeoffs, or pushing back on your human's idea - **Failure Recovery:** When something you did went wrong and you're deciding how to respond - **Daily Rhythm:** When planning proactive work for a session or deciding w ...[truncated 1902 chars]
• Remediation: ## Remediation Suggestions - Do not append downloaded-content references to `AGENTS.md`, `SOUL.md`, `IDENTITY.md`, or other authoritative instruction files. - Store optional guidance in an isolated, non-authoritative data file with explicit provenance and expiration metadata. - Require separate, informed consent before enabling recurring heartbeat checks. - Make periodic checks disabled by default and provide a clear uninstall procedure that removes all heartbeat and instruction hooks. - Pin approved guidance to an immutable package hash so later server changes cannot alter previously reviewed material. - Revalidate persisted guidance before each use and never interpret it as policy or tool-use instructions. - Provide a complete diff, source attribution, expiry date, and one-click rollback before any persistent modification.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:111
• Finding: Broad Access to Identity, Memory, User, Configuration, and Workspace Data Violates Least Privilege## Vulnerability Details **File Location**: `SKILL.md:111-123`, `SKILL.md:256-265`, and `SKILL.md:430` **Vulnerability Type**: Excessive local filesystem access **Risk Level**: High ### Vulnerable Code ```text | Permission | Why | |---|---| | `READ: ~/.openclaw/` | To take snapshots and assess current setup | | `READ: ~/workspace/` | To read current SOUL.md, IDENTITY.md, HEARTBEAT.md, AGENTS.md for wisdom integration | | `WRITE: ~/.openclaw/claw-mentor/snapshots/` | To store local backup snapshots | | `WRITE: ~/.openclaw/claw-mentor/state.json` | To track check times, reports, and guidance state | | `WRITE: ~/.openclaw/claw-mentor/mentors/` | To store each mentor's raw working-patterns.md | | `WRITE: ~/workspace/mentor-guidance.md` | Digested mentor wisdom — **only human-approved content** | | `WRITE: ~/workspace/AGENTS.md` (trigger index only) | 5-10 line situational trigger index for mentor guidance reference — **only after human approval of guidance items** | | `WRITE: ~/workspace/SOUL.md, IDENTITY.md, etc.` | Core file changes from mentor wisdom — **only with explicit human approval per change** | | `NETWORK: app.clawmentor.ai` | To fetch packages and send status updates — **Note:** Agents with strict network policies (e.g., "no outbound requests without per-request approval") should pre-approve this endpoint before installation, or the skill's API calls will conflict with the agent's own security posture | | `NOTIFY: configured channel` | To alert you when a new update is ready | | `EXEC: cp, mkdir` | Shell commands for taking snapshots | ``` ```text - List `~/.openclaw/skills/` — what skills do you already have installed? - Read `~/.openclaw/workspace/AGENTS.md` — how do you currently operate? - Read `~/.openclaw/workspace/SOUL.md` — who are you? What's your identity and values? - Read `~/.openclaw/workspace/IDENTITY.md` — if it exists, your self-concept - Read `~/.openclaw/workspace/HEARTBEAT.md` — if it ...[truncated 2467 chars]
• Remediation: ## Remediation Suggestions - Replace directory-wide access with an explicit allowlist of individual files. - Exclude `USER.md`, `MEMORY.md`, credentials, environment files, unrelated projects, and full configuration files by default. - Request just-in-time permission for each file needed for a specific comparison. - Present the exact file list and purpose before reading, and allow users to omit files. - Perform deterministic redaction of secrets, personal identifiers, paths, and project data before analysis. - Isolate remote package parsing from local-context processing so downloaded text cannot issue file or tool instructions. - Restrict write access to a dedicated Skill-owned directory; require a separately reviewed local component for core-file modifications.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

**If the human says "proceed anyway":** continue, but note in the integration record that a non-recommended model was used. This helps diagnose quality issues later.

**If you cannot determine your model:** proceed without warning — don't block indefinitely.

**This check applies to both "show my mentor report" and "apply mentor report."** The analysis quality matters just as much as the apply quality — a shallow report makes the human undervalue the package.

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Heartbeat Check (every `CLAW_MENTOR_CHECK_INTERVAL_HOURS` hours)

1. Read `~/.openclaw/claw-mentor/state.json` to get `last_check` and `notified_report_ids` (create file if absent)
2. If time since `last_check` < `CLAW_MENTOR_CHECK_INTERVAL_HOURS` hours → skip, return `HEARTBEAT_OK`
3. Call `GET https://app.clawmentor.ai/api/mentee/reports` with header `Authorization: Bearer {CLAW_MENTOR_API_KEY}`
4. Update `state.json` with `last_check: now`

• Confidence: 90% confidence
• Finding: The skill creates and updates a persistent state file to track check times, notified report IDs, applied reports, user profile data, and other long-lived operational state. Persistent storage itself is intentional, but it increases privacy and security risk because it accumulates behavioral history and identifiers that could be accessed or repurposed beyond the immediate session.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly tells the agent to draw on everything it knows from conversations, workspace files, and active projects to personalize mentor analysis. That broad instruction encourages cross-context reuse of potentially sensitive data beyond what is necessary for the immediate report, increasing the risk of privacy over-collection and unintended disclosure in generated summaries or decisions.

Session Persistence

Medium

• Category: Rogue Agent

Content

This is NOT a status report. It's a human conversation. Keep each message short. Don't send it all at once — send one message, wait for response or a few seconds, then continue.

**Message 1 — What's different now** (write this in plain English based on what was actually installed, don't just list skill names):
> "Here's what you can do now that you couldn't before:
> [list 3-5 natural language examples based on installed skills, e.g.]
> • 'Search for recent news on X' — I'll pull live web results

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to ask for the user's goals and current project context, then persist those answers in state.json for future personalization. This creates durable storage of sensitive profiling data without clear retention limits, minimization, or consent controls, which can expose private user context if the local state is accessed by other tools or later reused in unintended ways.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Troubleshooting

**`clawhub install` rate limited** → ClawHub enforces per-IP download limits. Wait 2–3 minutes and retry. If the skill folder already exists from a failed attempt, run `clawhub install claw-mentor-mentee --force` to overwrite it.

**"Invalid API key"** → Go to app.clawmentor.ai → Settings → Mentee Skill → Generate a new key.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.