T02 · Agent Memory Poisoning
Error
- Location
init.py:22- Finding
Persistent Behavioral and Financial Rule Injection into Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Proactive Intelligence
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it can persistently change agent memory, workspace Markdown files, and other skills with too little scoping or user control.
Install only after reviewing the scripts and making backups of workspace Markdown files and installed skills. Avoid running the initializer or skill-evolver against important workspaces unless you are comfortable with persistent agent memory, broad local logging, and possible cross-skill code changes. Treat the generated memory and .learnings files as long-lived local records that may influence future agent behavior.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
init.py:99- Finding
Mandatory Initializer Rewrites Workspace-Wide Markdown Files
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skill-evolver.py:33- Finding
Path Traversal Allows Recursive Access and Modification Outside the Skills Directory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (30)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Claiming many advanced capabilities that are not actually implemented is not dangerous by itself, but here it coexists with real file and skill modification behaviors that are under-disclosed. That combination increases the chance that operators trust the skill for one purpose while unknowingly granting it broader maintenance powers.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Claiming many advanced capabilities that are not actually implemented is not dangerous by itself, but here it coexists with real file and skill modification behaviors that are under-disclosed. That combination increases the chance that operators trust the skill for one purpose while unknowingly granting it broader maintenance powers.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Claiming many advanced capabilities that are not actually implemented is not dangerous by itself, but here it coexists with real file and skill modification behaviors that are under-disclosed. That combination increases the chance that operators trust the skill for one purpose while unknowingly granting it broader maintenance powers.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script can rewrite source files of other skills under the user's workspace, which is a high-privilege integrity risk. Even though the current fix logic is simple, any code with cross-skill write access can corrupt trusted skills, introduce insecure changes, or be extended into a supply-chain modification primitive.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
Using shell=True for tool invocation is a classic command-execution risk because the shell will interpret metacharacters, expansions, and chaining operators. In a skill intended to manage other skills and potentially evolve or automate actions, this primitive is especially dangerous if later connected to untrusted input or environment-derived values.
- Content
python def run_command(self, cmd): """运行命令并返回输出""" try: result = subprocess.run( cmd, shell=True, capture_output=True,
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill describes and requires file reads, file writes, and shell execution but does not declare an explicit tool scope or permission boundary. This creates a capability/permission mismatch that can lead to overly broad execution in hosts that infer behavior from instructions rather than enforce least privilege, especially because the skill also includes initialization and modification workflows.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description forces a specific language/locale for users by presenting the skill summary only in Chinese. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Nearly the entire skill specification, including operational rules and safety boundaries, is written exclusively in Chinese, with no indication that users may choose another language. This creates a natural-language policy issue because it effectively imposes a locale without opt-in or justification.
- Content
Indirect Prompt Extraction
Medium
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
- Content
md - 发现缺失步骤、隐藏障碍、过时假设 - 先问"现在什么最有价值？"再行动 ### 2. 反向提示 (Reverse Prompting) - 主动提供用户没想到的建议、检查、草稿 - 具体且及时，不模糊不吵闹 - 没有明确价值时保持安静
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill includes authority to analyze, edit, fix, optimize, and enhance other skills, which materially expands its power beyond passive assistance or note-taking. Any cross-skill modification capability is high risk because it can tamper with trusted automation, introduce persistence, or propagate unsafe changes across the environment.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The policy says actions leaving the machine require prior confirmation, yet it also says the skill may freely search the web and check calendars. Contradictory safety boundaries create ambiguity that can be exploited by an agent to justify outbound network access without consent, potentially exposing user data or context.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The instructions include uninstalling other skills, which is a system-management action outside the narrow expectations of a proactive assistant. This can disable protections or remove tools unexpectedly, especially if bundled into cleanup or migration flows that users may not scrutinize closely.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The module docstring explicitly uses Chinese wording and presents the script as a Chinese-language initialization script, with all user-facing output and generated content written only in Chinese. There is no indication that the user can choose another language or that this locale restriction is justified by a region-specific purpose.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The initializer rewrites unrelated top-level Markdown files in the shared workspace to migrate path references, which exceeds the narrowly expected scope of setting up this skill's own files. Because this happens automatically and in bulk, it can alter user content without review and create integrity issues or unintended data corruption across other notes or skills.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script performs write operations on workspace Markdown files without any explicit warning, consent, or confirmation step. Silent modification of user content is risky because users may not expect initialization code to change existing documents, and even simple string replacements can damage important notes or metadata.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code modifies arbitrary top-level Markdown files in a shared workspace, a capability not clearly required for proactive memory or self-improvement features. In a multi-skill or user-authored workspace, this can tamper with unrelated documents, break references, and create a precedent for cross-boundary file mutation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The guide directs users to execute initialization scripts with filesystem-writing behavior and path synchronization, but does not provide a clear warning about what files will be modified, what scope is affected, or how to review the scripts before execution. In a security-sensitive environment, encouraging immediate execution of setup scripts—especially with PowerShell ExecutionPolicy bypass—raises the risk of unintended persistence or broader workspace tampering if the scripts are altered or unsafe.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
The instructions explicitly create a persistent directory under
~/.openclaw/workspace/.learnings, reinforcing long-lived storage of behavioral history, errors, and feature requests. In the context of a skill centered on proactive memory, self-improvement, and skill evolution, persistent logging increases the risk of retaining sensitive user data, operational details, or prompt-derived secrets beyond the immediate task lifecycle.- Content
问题：.learnings 目录不存在
解决：手动创建
bash mkdir -p ~/.openclaw/workspace/.learnings
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest describes broad capabilities such as prediction, intelligent memory, skill management, and automatic skill evolution. In this file, the implemented behavior is limited to scanning files, collecting simple heuristics, backing up skill directories, generating reports, and making trivial text edits like adding an encoding header, which does not match the claimed proactive/self-improving functionality.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring promises automatic analysis, editing, and upgrading of other skills. In practice,
enhance_skillonly gathers suggestions, prompts for confirmation, creates a backup, and then logs '增强功能开发中...' without performing the promised upgrade behavior.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file's natural-language title and description are presented only in Chinese, indicating a language-specific experience with no visible opt-in or alternative locale handling. Under the policy, forcing a specific language without user choice is a natural-language policy concern unless clearly documented as region-specific.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This file establishes dedicated storage under the user's home directory and persists backups and analysis reports there. While useful for a code-maintenance utility, persistent filesystem archival is not an obvious requirement of the manifest's high-level description unless that storage behavior is explicitly declared as part of the skill's scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
When auto_fix is enabled, the tool can modify files without an interactive prompt, reducing user awareness at the moment of change. In a skill that operates on other skills' code, silent or unattended writes materially increase the chance of unauthorized or unnoticed integrity-impacting changes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The command-line help and runtime messages are emitted in Chinese only, which hard-codes a locale for all users. There is no mechanism to let users choose their preferred language or documentation stating that the tool is intentionally limited to a Chinese-speaking context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description presents broad autonomous capabilities such as 预测需求, 自我改进, 智能记忆, and 技能进化 with automatic upgrade/editing. In this file, the implemented behavior is limited to listing installed skills, checking outdated status, reading simple metadata, generating recommendations, and saving a JSON report; no predictive logic, self-improvement loop, memory reasoning, or skill editing/upgrading is actually implemented.
- Content