T06 · System Persistence
Error
- Location
GUIDE.md:424- Finding
Persistent autonomous execution through recurring Cron and heartbeat hooks
- Content
View full analysis
- Remediation
View remediation
Security audit
技术方案书全自动写作
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly for automated proposal writing, but it installs persistent automation that can keep scanning projects and starting follow-up agent work without clear per-run control.
Install only if you explicitly want unattended, cross-session proposal generation. Before enabling it, keep cron and heartbeat continuation disabled by default, limit it to named project directories, review CONTINUE.md and progress.json before any spawned session, avoid sensitive reference files or authenticated URLs, and document how to pause, remove cron entries, and clean up generated agent/profile files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (7)
T01 · Skill Instruction Hijacking
Error
- Location
GUIDE.md:252- Finding
Project-controlled continuation document is passed directly to an autonomous subagent
- Content
View full analysis
30 * 60 * 1000; if (hasTrigger || isTimeout) { const instructions = await read(`${project}/CONTINUE.md`); const nextChapter = findNextChapter(progress); const agent = progress.agents[nextChapter]; await sessions_spawn({ agent: agent, task: instructions, runtime: 'subagent', label: `tech-proposal-${project.name}-${nextChapter}` }); await log(`auto-continuation: ${project.name} - ${nextChapter} - ${agent}`); } } } ``` ### Technical Analysis The documented continuation workflow reads the complete contents of the project-local `CONTINUE.md` file and uses those contents directly as the `task` supplied to a newly spawned subagent. The project file is treated as trusted executable instruction text even though it resides in a mutable project directory. There is no fixed trusted prompt, schema parser, instruction allowlist, signature, ownership check, integrity check, content delimiter, or user approval step. Consequently, anyone able to modify the project directory can replace the expected writing instructions with arbitrary directives. Because the Skill also recommends persistent Cron and heartbeat execution, malicious instructions can be processed automatically in a later session. ### Attack Path 1. An attacker gains write access to an eligible project directo ...[truncated 1156 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
scripts/check-and-continue.js:119- Finding
Unvalidated project metadata is interpolated into continuation instructions and agent selection
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/check-and-continue.js:146- Finding
Predictable project-file writes follow symbolic links
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
continue-executor.js:18- Finding
Main continuation executor fails during module initialization
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/extract-keypoints.js:119- Finding
Reference extraction script invokes a nonexistent function
- Content
View full analysis
[output-file]'); console.log('Supported formats: .md, .txt'); console.log('Note: PDF and Word require additional dependencies'); process.exit(1); } extractKeypoints(args[0], args[1]).catch(err => { console.error('Error:', err); process.exit(1); }); ``` ### Technical Analysis JavaScript identifiers are case-sensitive. The function is declared as `extractKeyPoints` but invoked as `extractKeypoints`. The invoked identifier is undefined, so every otherwise valid execution terminates with a `ReferenceError`. This also means the documented reference-processing workflow does not run. Separately, the implemented function only produces a template and does not actually call an AI service, process URLs, or support PDF and Word extraction as claimed by the documentation. ### Attack Path No attacker-controlled input is required: 1. A user invokes the script with a valid Markdown or text file. 2. Argument validation succeeds. 3. Execution reaches the final function call. 4. The runtime cannot resolve `extractKeypoints`. 5. The process terminates without generating the expected output. ### Impact Assessment Reference extraction is unavailable, which can prevent or degrade proposal generation. No privilege escalation, data disclosure, or code execution results directly from this defect. ]]>- Remediation
View remediation
{ console.error('Error:', err); process.exit(1); }); ``` - Add an automated test for each supported input extension. - Align documentation with actual behavior: the current script only supports text and Markdown and only writes a template. - If AI extraction is implemented later, treat source documents as untrusted data and prevent their content from becoming agent instructions. - Add file-size limits and canonical-path validation before reading reference files. ]]>
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/check-and-continue.js:18- Finding
Continuation checker assumes the log directory already exists
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (45)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The skill claims document-writing automation but the content also specifies direct reads and writes to local project state such as progress.json, CONTINUE.md, trigger files, and logs. Hidden state mutation is risky because it can alter workspace state or influence later agent behavior in ways the user may not expect from a nominally content-generation skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The skill claims document-writing automation but the content also specifies direct reads and writes to local project state such as progress.json, CONTINUE.md, trigger files, and logs. Hidden state mutation is risky because it can alter workspace state or influence later agent behavior in ways the user may not expect from a nominally content-generation skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill claims document-writing automation but the content also specifies direct reads and writes to local project state such as progress.json, CONTINUE.md, trigger files, and logs. Hidden state mutation is risky because it can alter workspace state or influence later agent behavior in ways the user may not expect from a nominally content-generation skill.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises automatic scanning, file creation/update, and timed continuation without a prominent user-facing risk disclosure. Missing warnings are particularly dangerous here because the behavior extends beyond passive document writing into autonomous state monitoring and modification of local workspace artifacts.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **文件**: `continue-executor.js`
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This skill documentation consistently forces Chinese-language interaction and examples, but it does not offer the user a language option or state that the skill is intentionally limited to a Chinese-language or region-specific deployment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide promises fully automatic operation, progress persistence, and file-based coordination without warning users that local files and project state will be created and modified. In practice this can surprise users, overwrite data, or normalize broad file-system access without informed consent.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
步骤1：创建技能目录
bash mkdir -p ~/.openclaw/workspace/skills/tech-proposal-autopilot步骤2：创建核心文件
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
步骤1:创建技能目录
bash mkdir -p ~/.openclaw/workspace/skills/tech-proposal-autopilot步骤2:创建核心文件
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 81% confidence
- Finding
This duplicate finding concerns persistent creation of agent identity files that can affect future sessions. Because these files shape later autonomous behavior, they increase risk when combined with the skill's auto-continue and scheduler features.
- Content
步骤3：配置智能体（最小配置）
bash mkdir -p ~/.openclaw/agents/{milo,josh,dev,marketing} echo "# Milo - 架构设计师\n擅长：系统架构设计、技术方案深度分析" > ~/.openclaw/agents/milo/IDENTITY.md echo "# Josh - 政策分析师\n擅长：政策环境分析、安全保障体系" > ~/.openclaw/agents/josh/IDENTITY.md
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 81% confidence
- Finding
This duplicate finding concerns persistent creation of agent identity files that can affect future sessions. Because these files shape later autonomous behavior, they increase risk when combined with the skill's auto-continue and scheduler features.
- Content
步骤3:配置智能体(最小配置)
bash mkdir -p ~/.openclaw/agents/{milo,josh,dev,marketing} echo "# Milo - 架构设计师\n擅长:系统架构设计、技术方案深度分析" > ~/.openclaw/agents/milo/IDENTITY.md echo "# Josh - 政策分析师\n擅长:政策环境分析、安全保障体系" > ~/.openclaw/agents/josh/IDENTITY.md
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guide instructs users to install recurring Cron automation that continuously scans project directories and autonomously triggers new sessions. For a document-writing skill, persistent background execution materially expands capability and attack surface by enabling unattended actions after the initial user request.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill configures background Cron jobs at the host level even though its stated purpose is generating technical proposal documents. This creates persistence and unattended execution capability that is not strictly necessary for the core function, making misuse or accidental overreach more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill accepts local file paths and URLs as reference material and states they will be automatically processed, but does not warn that their contents may be read, extracted, and persisted. This raises privacy and data-handling risks, especially if sensitive internal documents or authenticated URLs are supplied.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The file presents all instructions and example prompts in Chinese, which effectively enforces a specific language for use of the skill. Under the stated policy, language-specific behavior should either be optional for users or explicitly justified as a locale-specific skill.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 创建 milo 智能体 mkdir -p ~/.openclaw/agents/milo cat > ~/.openclaw/agents/milo/IDENTITY.md << 'EOF' # Milo - 架构设计师 擅长：系统架构设计、技术方案深度分析、AI系统设计
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 创建 milo 智能体 mkdir -p ~/.openclaw/agents/milo cat > ~/.openclaw/agents/milo/IDENTITY.md << 'EOF' # Milo - 架构设计师 擅长:系统架构设计、技术方案深度分析、AI系统设计
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md "schedule": { "kind": "every", "everyMs": 300000 }, "payload": { "kind": "agentTurn", "message": "检查未完成的技术方案书项目并自动续作。详见技能文档：skills/tech-proposal-autopilot/SKILL.md" }, "sessionTarget": "isolated" }
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md "schedule": { "kind": "every", "everyMs": 300000 }, "payload": { "kind": "agentTurn", "message": "检查未完成的技术方案书项目并自动续作。详见技能文档：skills/tech-proposal-autopilot/SKILL.md" }, "sessionTarget": "isolated" }
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md "schedule": { "kind": "every", "everyMs": 300000 }, "payload": { "kind": "agentTurn", "message": "检查未完成的技术方案书项目并自动续作。详见技能文档：skills/tech-proposal-autopilot/SKILL.md" }, "sessionTarget": "isolated" }
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md "schedule": { "kind": "every", "everyMs": 300000 }, "payload": { "kind": "agentTurn", "message": "检查未完成的技术方案书项目并自动续作。详见技能文档：skills/tech-proposal-autopilot/SKILL.md" }, "sessionTarget": "isolated" }
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md "schedule": { "kind": "every", "everyMs": 300000 }, "payload": { "kind": "agentTurn", "message": "检查未完成的技术方案书项目并自动续作。详见技能文档：skills/tech-proposal-autopilot/SKILL.md" }, "sessionTarget": "isolated" }
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
js "schedule": { "kind": "every", "everyMs": 300000 }, "payload": { "kind": "agentTurn", "message": "检查未完成的技术方案书项目并自动续作。详见技能文档：skills/tech-proposal-autopilot/SKILL.md" }, "sessionTarget": "isolated" }
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
A: 可以使用最小配置，创建简单的 IDENTITY.md 文件：
bash mkdir -p ~/.openclaw/agents/{milo,josh,dev,marketing} echo "擅长架构设计和AI系统" > ~/.openclaw/agents/milo/IDENTITY.md echo "擅长政策分析和安全保障" > ~/.openclaw/agents/josh/IDENTITY.md
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file contains operational steps that move the old skill directory to a backup location and copy in a new version. Although the commands modify files on disk, the guide does not warn users to verify paths, note possible overwrite/conflict risks, or mention preserving local customizations before replacement.
- Content
Static analysis
No suspicious patterns detected.