T01 · Skill Instruction Hijacking
Error
- Location
CRITICAL_SETUP.md:108- Finding
Persistent Agent Instruction Hijacking Through Global Session Rules
- Content
View full analysis
- Remediation
View remediation
Security audit
Prayer Times - Automated Salat Reminders
Security checks for vulnerabilities and agentic risk
Overview
The skill’s prayer-time lookup is coherent, but its reminder setup pushes persistent agent rules, automatic job recreation without consent, and optional privileged system-wide network changes.
Use this only after carefully reviewing the reminder setup. For manual prayer-time lookups, the core scripts are straightforward. Do not add the supplied AGENTS.md block, do not allow cron jobs to be recreated without confirmation, avoid the Cloudflare WARP sudo commands unless an administrator explicitly approves them, and remove or ignore the GitHub publishing script. Enable reminders only if you accept recurring agent turns, location queries to AlAdhan, token cost, and a clear disable/removal process.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T06 · System Persistence
Error
- Location
CRITICAL_SETUP.md:57- Finding
Scheduled Agent Jobs Are Automatically Recreated Without User Consent
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:185- Finding
Prayer-Time Connectivity Guidance Installs a System-Wide VPN With Root Privileges
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
push-to-github.sh:1- Finding
Bundled Publishing Script Pushes Local Repository Contents to a Hard-Coded GitHub Account
- Content
View full analysis
/dev/null || echo "Remote already exists" echo "📤 Pushing to GitHub..." git push -u origin main echo "" echo "✅ Done! Check your repo at:" echo " https://github.com/diepox/openclaw-prayer-times" ``` ### Technical Analysis Publishing source code to GitHub is unrelated to obtaining prayer times or issuing reminders. The bundled script changes into a fixed workspace path, adds a remote belonging to the hard-coded `diepox` account, and pushes the local `main` branch. The script does not ask the executing user to supply or confirm the remote. It relies on ambient Git credential configuration. If the local repository contains additional commits, generated artifacts, or accidentally committed sensitive data, those contents may be transmitted to the fixed remote. The script suppresses errors from `git remote add` and prints “Remote already exists” for any failure, not only an existing remote. It then pushes whatever URL is currently configured as `origin`, which may differ from the displayed destination. The script is not referenced as an automatic runtime dependency, so exploitation requires the user or Agent to invoke it. Nevertheless, distributing an author-specific publishing helper inside the Skill creates an unnecessary and potentially hazardous execution path. ### Attack Path 1. The Skill is installed in the hard-coded workspace path or a repository exists there. 2. The repository contains local commits or files not intended for public release. 3. Git credentials available to the ...[truncated 933 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (46)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The embedded AGENTS.md text explicitly says to recreate missing cron jobs and run fetch scripts immediately, 'don't ask,' before doing anything else. This is especially dangerous because it attempts to override normal consent boundaries and elevate the skill into an always-on autonomous operator with persistent side effects at session start.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Solution: If you're running OpenClaw on a VPS/datacenter, you may need Cloudflare WARP VPN:
bash curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list sudo apt update && sudo apt install cloudflare-warp warp-cli register
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Solution: If you're running OpenClaw on a VPS/datacenter, you may need Cloudflare WARP VPN:
bash curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list sudo apt update && sudo apt install cloudflare-warp warp-cli register
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Solution: If you're running OpenClaw on a VPS/datacenter, you may need Cloudflare WARP VPN:
bash curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list sudo apt update && sudo apt install cloudflare-warp warp-cli register
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Solution: If you're running OpenClaw on a VPS/datacenter, you may need Cloudflare WARP VPN:
bash curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list sudo apt update && sudo apt install cloudflare-warp warp-cli register
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
Solution: If you're running OpenClaw on a VPS/datacenter, you may need Cloudflare WARP VPN:
bash curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list sudo apt update && sudo apt install cloudflare-warp warp-cli register
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
Solution: If you're running OpenClaw on a VPS/datacenter, you may need Cloudflare WARP VPN:
bash curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list sudo apt update && sudo apt install cloudflare-warp warp-cli register
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
bash curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list sudo apt update && sudo apt install cloudflare-warp warp-cli register warp-cli connect
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description promises an automated background reminder system and broad official-method support, but the content itself shows reliance on an external API and manual cron configuration. In context, that mismatch is risky because users may not understand that periodic network fetching and local persistence are separate operational behaviors requiring explicit setup and approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description promises an automated background reminder system and broad official-method support, but the content itself shows reliance on an external API and manual cron configuration. In context, that mismatch is risky because users may not understand that periodic network fetching and local persistence are separate operational behaviors requiring explicit setup and approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description promises an automated background reminder system and broad official-method support, but the content itself shows reliance on an external API and manual cron configuration. In context, that mismatch is risky because users may not understand that periodic network fetching and local persistence are separate operational behaviors requiring explicit setup and approval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The description promises an automated background reminder system and broad official-method support, but the content itself shows reliance on an external API and manual cron configuration. In context, that mismatch is risky because users may not understand that periodic network fetching and local persistence are separate operational behaviors requiring explicit setup and approval.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 82% confidence
- Finding
Piping curl output directly into sudo gpg combines remote network content with privileged local processing, a classic trust-boundary reduction pattern. Even though this is a common package-setup idiom, it is inappropriate inside an application skill because it normalizes privileged handling of untrusted network data.
- Content
Quick fix:
bash # Install Cloudflare WARP curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list sudo apt update && sudo apt install cloudflare-warp warp-cli register
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 83% confidence
- Finding
Piping an echoed repository line into sudo tee writes system configuration through a shell pipeline, again compressing review and privilege boundaries. In this context, it contributes to unnecessary host reconfiguration for a feature that should remain a simple network query utility.
- Content
bash # Install Cloudflare WARP curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list sudo apt update && sudo apt install cloudflare-warp warp-cli register warp-cli connect
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 78% confidence
- Finding
Chaining 'apt update' and package installation in one command encourages opaque, high-impact execution with reduced review opportunities between steps. In a skill context, command chaining can make it easier for users or agents to execute privileged system changes as a single action without validating repository state or necessity.
- Content
Install Cloudflare WARP
curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list sudo apt update && sudo apt install cloudflare-warp warp-cli register warp-cli connect
text
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The setup guide materially expands the skill from answering prayer-time queries into a persistent autonomous monitoring and maintenance system that runs at every session start and on a 5-minute schedule. That changes the agent’s operational scope without requiring an immediate user request, increasing the chance of background actions, surprise notifications, and unintended system changes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document instructs the agent to inspect and modify global cron-job state as routine behavior, including recreating jobs automatically. Autonomous modification of scheduler state is risky because it persists beyond the current request, can interfere with other workloads, and normalizes privileged background changes unrelated to the user’s immediate prompt.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide directs routine execution of shell commands and filesystem checks such as listing files and running Python scripts from fixed paths. Even if the commands appear operationally relevant, embedding them as default behavior increases attack surface, creates opportunities for path or environment abuse, and bypasses normal user awareness around local system inspection/execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions tell the agent to recreate cron jobs, fetch data, and overwrite prayer_times.json immediately if anything is missing, without warning or confirmation. Silent persistence changes and file overwrites can surprise users, destroy state, or mask misconfiguration while training the agent to take privileged actions without consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README promotes always-on background reminders that appear during unrelated conversations, but it does not clearly warn users about the persistence, frequency, and system behavior of those notifications. This can surprise users, create privacy concerns in shared environments, and cause unintended system-side effects such as ongoing scheduled tasks and unsolicited message injection.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill documents internet-dependent prayer-time lookups but does not prominently disclose that user-supplied location data will be sent to the third-party AlAdhan API. Sharing city, country, coordinates, and timing queries with an external service can expose sensitive location or behavioral information without informed consent.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Solution: If you're running OpenClaw on a VPS/datacenter, you may need Cloudflare WARP VPN:
bash curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list sudo apt update && sudo apt install cloudflare-warp warp-cli register
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Solution: If you're running OpenClaw on a VPS/datacenter, you may need Cloudflare WARP VPN:
bash curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list sudo apt update && sudo apt install cloudflare-warp warp-cli register
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Solution: If you're running OpenClaw on a VPS/datacenter, you may need Cloudflare WARP VPN:
bash curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list sudo apt update && sudo apt install cloudflare-warp warp-cli register
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill advertises and instructs use of network access, local file reads/writes, and background automation, but does not declare any explicit tool scope or permissions boundaries. In an agent environment, missing least-privilege declarations increases the chance the skill is invoked with broader capabilities than users expect, especially given the reminder workflow writes files and contacts external services.
- Content
Static analysis
No suspicious patterns detected.