Proactive Intelligence

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:43 AM UTC
• Version: 2.3.1

Overview

This skill is not clearly malicious, but it can persistently change agent memory, workspace Markdown files, and other skills with too little scoping or user control.

Install only after reviewing the scripts and making backups of workspace Markdown files and installed skills. Avoid running the initializer or skill-evolver against important workspaces unless you are comfortable with persistent agent memory, broad local logging, and possible cross-skill code changes. Treat the generated memory and .learnings files as long-lived local records that may influence future agent behavior.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: init.py:22
• Finding: Persistent Behavioral and Financial Rule Injection into Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `init.py:22-43`; related promotion instructions in `SKILL.md:92, 219-229, 248` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Code The following is an English translation of the embedded memory template in `init.py:22-43`: ```python files = { "memory.md": """# Core Memory (HOT) ## Work Style - Proactively predict; do not wait for instructions - Learn from corrections and continuously improve - Maintain momentum and do not stop because of silence ## Skill Management - After installing a skill, read SKILL.md and execute initialization - Skills involving paths must immediately normalize all Markdown references ## Trading Rules - Only trade mainland A-share main-board stocks - Do not trade ST stocks or stocks at risk of delisting - Strict stop loss: loss per trade must not exceed 2.5% of total capital - Position management: each stock must be no more than 30% of the portfolio; never be fully invested ## Memory Triggers - Correction: immediately record it in corrections.md - Repeated three times: consider promoting it to a rule - Weekly review: clean up outdated information """, ``` The template is persisted by the following code in `init.py:65-69`: ```python for name, content in files.items(): filepath = BASE_DIR / name if not filepath.exists(): print(f"[FILE] 创建 {name}...") filepath.write_text(content, encoding='utf-8') ``` `SKILL.md:92` declares the resulting file to be always loaded, while `SKILL.md:219-229` and `SKILL.md:248` instruct the agent to promote learned material into core files such as `SOUL.md`, `AGENTS.md`, `TOOLS.md`, and `MEMORY.md`. ### Technical Analysis The initialization process does more than establish empty application storage. It installs predetermined behavioral and financial rules into `~/proactive-intelligence/memory.md`. The Skill documentation identifies this file as “HOT” memory that is always loa ...[truncated 1878 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all predetermined behavioral, financial, and trading rules from the initialization template. 2. Create empty or schema-only state files during initialization. 3. Store Skill state only in a dedicated Skill-scoped directory. 4. Do not classify Skill-authored data as always-loaded memory by default. 5. Require explicit, informed user approval before persisting any preference or behavioral rule. 6. Display the exact proposed memory entry and destination before writing it. 7. Prohibit automatic promotion into `SOUL.md`, `AGENTS.md`, `TOOLS.md`, or `MEMORY.md`. 8. If promotion is supported, require an exact diff, destination-specific confirmation, and a rollback copy. 9. Add provenance metadata to every persisted rule, including source, timestamp, approval status, and expiration policy. 10. Provide an uninstall or reset operation that removes only data created by this Skill. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: init.py:99
• Finding: Mandatory Initializer Rewrites Workspace-Wide Markdown Files<![CDATA[ ## Vulnerability Details **File Location**: `init.py:99-106` **Vulnerability Type**: Unauthorized modification outside the Skill-owned directory **Risk Level**: High ### Vulnerable Code ```python md_files = list(WORKSPACE.glob("*.md")) changes = 0 for md_file in md_files: content = md_file.read_text(encoding='utf-8') new_content = content.replace(old_path, new_path).replace(old_path2, new_path2) if new_content != content: md_file.write_text(new_content, encoding='utf-8') changes += 1 ``` ### Technical Analysis The initializer enumerates every top-level Markdown file under `~/.openclaw/workspace` and performs unconditional string replacement when either legacy phrase is present. It does not restrict changes to files owned by this Skill, inspect the semantic role of each file, create backups, show a diff, or request confirmation. Workspace Markdown files may include agent instructions, project policies, memory references, or configuration consumed by other skills. A global text replacement can therefore alter trusted control documents outside the legitimate installation scope. The replacement is especially sensitive because `SKILL.md` declares files such as `AGENTS.md` and `SOUL.md` to be optional configuration paths. If these files contain a matching legacy reference, the initializer can modify them directly. ### Attack Path 1. A workspace contains one or more top-level Markdown instruction or configuration files. 2. A target file contains `~/self-improving/` or the second legacy phrase used by the initializer. 3. The user follows the installation guide and runs the mandatory initializer. 4. The script enumerates all top-level `*.md` files in the workspace. 5. Matching text is replaced without a preview or per-file authorization. 6. The modified Markdown file is later loaded by the agent or another Skill. 7. Agent behavior or cross-Skill configuration changes as a consequence of the unauthorized rewrite. ### Impact ...[truncated 549 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove workspace-wide Markdown rewriting from automatic initialization. 2. Restrict writes to explicitly enumerated files owned by this Skill. 3. Resolve and validate every destination against an approved root directory. 4. Detect required migrations and report them without modifying files automatically. 5. Before any migration, present: - The canonical file path. - The exact original and replacement text. - A unified diff. - The reason the change is required. 6. Require explicit confirmation for each file, particularly `AGENTS.md`, `SOUL.md`, `MEMORY.md`, and similar control documents. 7. Create timestamped backups before modification and use atomic file replacement. 8. Preserve file permissions and metadata where appropriate. 9. Add a dry-run mode and make it the default. 10. Maintain a migration log and provide a tested rollback command. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: skill-evolver.py:33
• Finding: Path Traversal Allows Recursive Access and Modification Outside the Skills Directory<![CDATA[ ## Vulnerability Details **File Location**: `skill-evolver.py:33-43, 51-67, 279-301` **Vulnerability Type**: Unsanitized filesystem path construction **Risk Level**: High ### Vulnerable Code Backup target selection in `skill-evolver.py:33-43`: ```python def backup_skill(self, skill_name): """备份技能""" skill_path = self.skills_dir / skill_name if not skill_path.exists(): self.log(f"技能不存在: {skill_name}", "ERROR") return None timestamp = datetime.now().strftime("%Y%m%d_%H%M%S") backup_path = self.backup_dir / f"{skill_name}_{timestamp}" try: shutil.copytree(skill_path, backup_path) ``` Recursive analysis target selection in `skill-evolver.py:51-67`: ```python def analyze_skill(self, skill_name): """分析技能代码""" skill_path = self.skills_dir / skill_name if not skill_path.exists(): self.log(f"技能不存在: {skill_name}", "ERROR") return None analysis = { 'name': skill_name, 'path': str(skill_path), 'files': [], 'issues': [], 'suggestions': [], 'complexity': {}, 'dependencies': [] } for file_path in skill_path.rglob("*"): ``` Recursive modification in `skill-evolver.py:279-301`: ```python skill_path = self.skills_dir / skill_name for file_path in skill_path.rglob("*"): if file_path.is_file() and not file_path.name.startswith('.'): try: content = file_path.read_text(encoding='utf-8') original = content if file_path.suffix == '.py': if not content.startswith('# -*- coding: utf-8 -*-'): content = '# -*- coding: utf-8 -*-\n' + content fixed_count += 1 if 'console.log' in content: content = content.replace('console.log(', '# console.log(') fixed_count += 1 if content != original: file_path.write_text(content, encoding='utf-8') ``` ## ...[truncated 2582 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate `skill_name` against a strict allowlist, for example: ```python if not re.fullmatch(r"[A-Za-z0-9._-]+", skill_name): raise ValueError("Invalid skill name") ``` 2. Reject names containing path separators, traversal components, absolute paths, or drive prefixes. 3. Resolve both the skills root and candidate path before use: ```python root = self.skills_dir.resolve(strict=True) target = (root / skill_name).resolve(strict=True) if not target.is_relative_to(root): raise ValueError("Skill path escapes the skills directory") ``` 4. Verify that the target is a direct child of the skills root if nested paths are unnecessary. 5. Reject symbolic-link targets or enforce a clear symlink policy for every recursively visited file. 6. Revalidate each file’s resolved path before reading, copying, or writing it. 7. Display the canonical target and complete affected-file list before requesting confirmation. 8. Require per-file confirmation for modifications outside an explicit allowlist. 9. Use a dry-run mode by default and generate a diff for every proposed change. 10. Ensure backup destination names are generated independently of untrusted input rather than embedding raw `skill_name`. 11. Add regression tests for `../`, nested traversal, absolute paths, symbolic links, Windows drive paths, and mixed separators. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Claiming many advanced capabilities that are not actually implemented is not dangerous by itself, but here it coexists with real file and skill modification behaviors that are under-disclosed. That combination increases the chance that operators trust the skill for one purpose while unknowingly granting it broader maintenance powers.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: Claiming many advanced capabilities that are not actually implemented is not dangerous by itself, but here it coexists with real file and skill modification behaviors that are under-disclosed. That combination increases the chance that operators trust the skill for one purpose while unknowingly granting it broader maintenance powers.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Claiming many advanced capabilities that are not actually implemented is not dangerous by itself, but here it coexists with real file and skill modification behaviors that are under-disclosed. That combination increases the chance that operators trust the skill for one purpose while unknowingly granting it broader maintenance powers.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script can rewrite source files of other skills under the user's workspace, which is a high-privilege integrity risk. Even though the current fix logic is simple, any code with cross-skill write access can corrupt trusted skills, introduce insecure changes, or be extended into a supply-chain modification primitive.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def run_command(self, cmd):
        """运行命令并返回输出"""
        try:
            result = subprocess.run(
                cmd, 
                shell=True, 
                capture_output=True,

• Confidence: 97% confidence
• Finding: Using shell=True for tool invocation is a classic command-execution risk because the shell will interpret metacharacters, expansions, and chaining operators. In a skill intended to manage other skills and potentially evolve or automate actions, this primitive is especially dangerous if later connected to untrusted input or environment-derived values.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill describes and requires file reads, file writes, and shell execution but does not declare an explicit tool scope or permission boundary. This creates a capability/permission mismatch that can lead to overly broad execution in hosts that infer behavior from instructions rather than enforce least privilege, especially because the skill also includes initialization and modification workflows.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The manifest description forces a specific language/locale for users by presenting the skill summary only in Chinese. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: Nearly the entire skill specification, including operational rules and safety boundaries, is written exclusively in Chinese, with no indication that users may choose another language. This creates a natural-language policy issue because it effectively imposes a locale without opt-in or justification.

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage

Content

- 发现缺失步骤、隐藏障碍、过时假设
- 先问"现在什么最有价值？"再行动

### 2. 反向提示 (Reverse Prompting)
- 主动提供用户没想到的建议、检查、草稿
- 具体且及时，不模糊不吵闹
- 没有明确价值时保持安静

• Confidence: 85% confidence
• Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill includes authority to analyze, edit, fix, optimize, and enhance other skills, which materially expands its power beyond passive assistance or note-taking. Any cross-skill modification capability is high risk because it can tamper with trusted automation, introduce persistence, or propagate unsafe changes across the environment.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The policy says actions leaving the machine require prior confirmation, yet it also says the skill may freely search the web and check calendars. Contradictory safety boundaries create ambiguity that can be exploited by an agent to justify outbound network access without consent, potentially exposing user data or context.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The instructions include uninstalling other skills, which is a system-management action outside the narrow expectations of a proactive assistant. This can disable protections or remove tools unexpectedly, especially if bundled into cleanup or migration flows that users may not scrutinize closely.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: The module docstring explicitly uses Chinese wording and presents the script as a Chinese-language initialization script, with all user-facing output and generated content written only in Chinese. There is no indication that the user can choose another language or that this locale restriction is justified by a region-specific purpose.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The initializer rewrites unrelated top-level Markdown files in the shared workspace to migrate path references, which exceeds the narrowly expected scope of setting up this skill's own files. Because this happens automatically and in bulk, it can alter user content without review and create integrity issues or unintended data corruption across other notes or skills.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script performs write operations on workspace Markdown files without any explicit warning, consent, or confirmation step. Silent modification of user content is risky because users may not expect initialization code to change existing documents, and even simple string replacements can damage important notes or metadata.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code modifies arbitrary top-level Markdown files in a shared workspace, a capability not clearly required for proactive memory or self-improvement features. In a multi-skill or user-authored workspace, this can tamper with unrelated documents, break references, and create a precedent for cross-boundary file mutation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide directs users to execute initialization scripts with filesystem-writing behavior and path synchronization, but does not provide a clear warning about what files will be modified, what scope is affected, or how to review the scripts before execution. In a security-sensitive environment, encouraging immediate execution of setup scripts—especially with PowerShell ExecutionPolicy bypass—raises the risk of unintended persistence or broader workspace tampering if the scripts are altered or unsafe.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 问题：.learnings 目录不存在
**解决**：手动创建
```bash
mkdir -p ~/.openclaw/workspace/.learnings
```

• Confidence: 78% confidence
• Finding: The instructions explicitly create a persistent directory under `~/.openclaw/workspace/.learnings`, reinforcing long-lived storage of behavioral history, errors, and feature requests. In the context of a skill centered on proactive memory, self-improvement, and skill evolution, persistent logging increases the risk of retaining sensitive user data, operational details, or prompt-derived secrets beyond the immediate task lifecycle.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest describes broad capabilities such as prediction, intelligent memory, skill management, and automatic skill evolution. In this file, the implemented behavior is limited to scanning files, collecting simple heuristics, backing up skill directories, generating reports, and making trivial text edits like adding an encoding header, which does not match the claimed proactive/self-improving functionality.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The module docstring promises automatic analysis, editing, and upgrading of other skills. In practice, `enhance_skill` only gathers suggestions, prompts for confirmation, creates a backup, and then logs '增强功能开发中...' without performing the promised upgrade behavior.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The file's natural-language title and description are presented only in Chinese, indicating a language-specific experience with no visible opt-in or alternative locale handling. Under the policy, forcing a specific language without user choice is a natural-language policy concern unless clearly documented as region-specific.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: This file establishes dedicated storage under the user's home directory and persists backups and analysis reports there. While useful for a code-maintenance utility, persistent filesystem archival is not an obvious requirement of the manifest's high-level description unless that storage behavior is explicitly declared as part of the skill's scope.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: When auto_fix is enabled, the tool can modify files without an interactive prompt, reducing user awareness at the moment of change. In a skill that operates on other skills' code, silent or unattended writes materially increase the chance of unauthorized or unnoticed integrity-impacting changes.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The command-line help and runtime messages are emitted in Chinese only, which hard-codes a locale for all users. There is no mechanism to let users choose their preferred language or documentation stating that the tool is intentionally limited to a Chinese-speaking context.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest description presents broad autonomous capabilities such as 预测需求, 自我改进, 智能记忆, and 技能进化 with automatic upgrade/editing. In this file, the implemented behavior is limited to listing installed skills, checking outdated status, reading simple metadata, generating recommendations, and saving a JSON report; no predictive logic, self-improvement loop, memory reasoning, or skill editing/upgrading is actually implemented.

Static analysis

No suspicious patterns detected.