Security audit

Create Agent

Security checks for vulnerabilities and agentic risk

Overview

This is a real OpenClaw agent-creation skill, but it needs review because it can change local agent configuration and instructs created agents to persist user/work profile data with incomplete disclosure.

Review before installing in a production workspace. Use dry-run mode first, verify agentId and workspace paths stay under ~/.openclaw/agency-agents, keep alsoAllow permissions minimal, and disclose to affected users or employees that generated agents will store profile, preference, and work-context memory. Treat deregistration and gateway restart as administrative actions.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (25)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The protocol explicitly tells the agent not to disclose that it is collecting information and writing it into multiple files, which removes the user's ability to give informed consent or correct inaccurate persistence. In this skill context, the hidden collection is more dangerous because the workflow stores personal preferences, work details, and behavioral traits for long-term reuse across the agent workspace.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The documented trigger phrases are very broad generic commands such as '创建 agent' and '新建 agent', which increases the chance of accidental or contextually inappropriate invocation. In this skill, unintended invocation is more dangerous than usual because later phases create workspaces, modify agent registration, and can lead to service restart actions, so an ambiguous trigger can initiate a sensitive workflow without sufficiently explicit user intent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README describes actions that write to user configuration, generate workspace files, modify openclaw.json, configure heartbeat behavior, and perform restart validation, but it does not prominently warn that the skill performs system-modifying operations. This is risky because users may invoke it expecting guidance rather than state-changing automation, leading to unintended configuration changes or service disruption if used incorrectly.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: Broad trigger phrases such as generic requests to create or add an agent can overlap with normal conversation and cause accidental activation of a workflow that writes config, creates workspaces, and may restart the gateway. In this context, accidental triggering is more dangerous because the skill performs administrative changes rather than harmless read-only assistance.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill directs the agent to read MEMORY.md and recent memory files and summarize organizational context without warning that these sources may contain personal, confidential, or otherwise sensitive data. Aggregating such data into a reusable context file increases exposure and makes later over-sharing or inappropriate reuse more likely.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs high-impact operations such as system registration, config modification, and gateway restart, but lacks a unified mandatory approval checkpoint immediately before execution. In an administrative skill, missing explicit final confirmation materially increases the risk of unintended service disruption, bad config rollout, or unauthorized changes.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The protocol is designed to gather and persist user profile and preference data into files such as USER.md, MEMORY.md, SOUL.md, and progress files without any required notice, consent, or retention explanation. In an onboarding/create-agent skill, this is a real privacy issue because the data is not merely transient conversation context but structured long-term storage used to shape future agent behavior.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The protocol instructs deletion of BOOTSTRAP.md after completion without any user-facing warning, despite the file being part of the initialization logic and potentially needed for auditability, recovery, or user review. Silent destructive actions increase the risk of loss of transparency and make it harder to inspect how the agent was configured or to recover from bad initialization.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The document instructs the agent to persist user information into memory files as part of normal operation, but it does not require notice, consent, retention limits, or sensitivity filtering. In a workspace-creation skill, this is more dangerous because the rule is meant to be propagated into every new agent, scaling privacy risk across many future workspaces.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The follow-up flow is designed to elicit missing information and then immediately write it to persistent memory, yet it provides no warning about storage or opportunity to decline persistence. This creates a covert data-collection pattern where users may answer conversationally without realizing their business preferences, terminology, and workflows are being retained long-term.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file instructs the agent to automatically create and update persistent memory files in the workspace at conversation start, but provides no requirement for user notice, consent, or confirmation before storing potentially sensitive conversation-derived data. In an agent-creation skill, this is more dangerous because the behavior is standardized and propagated into each new workspace, scaling privacy and data-retention risk across all created agents.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The 'Heartbeat' rule directs periodic review of recent conversation logs and promotion of inferred user information into long-term memory files based on repetition or perceived validation, again without transparency or consent. This creates a durable profile-building mechanism from conversational data, increasing the risk of storing sensitive or inaccurate inferences that persist across sessions and influence future agent behavior.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script accepts a user-supplied Feishu open_id and persists it into HEARTBEAT.md, creating durable storage of a personal identifier without validation, minimization, or any privacy notice/consent flow. This increases the chance of unnecessary exposure of personal data through workspace files, backups, or logs, especially because the generated template later uses that identifier for automated messaging.

Ssd 3

Medium

Confidence: 89% confidence
Finding: The instructions explicitly aggregate organizational and memory-derived information into a persistent org-context file for reuse in future agent creation. Persistent cross-session aggregation of natural-language memory increases the chance of sensitive business information, personal details, or internal structure being retained longer than necessary and reused outside the original context.

Ssd 3

Medium

Confidence: 83% confidence
Finding: The skill encourages storing personal knowledge and first-conversation details for employee-facing agents in persistent files such as USER.md and BOOTSTRAP-related materials. Without explicit retention boundaries or sensitivity rules, this normalizes collection of potentially personal or sensitive employee data that may later be exposed or misused.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The protocol directs the agent to silently collect, persist, and reuse personal and work-related information across hidden/internal files while explicitly avoiding telling the user about that process. In this skill context, that hidden state can materially influence future outputs and decisions, creating privacy, profiling, and trust risks that are amplified by the multi-file memory design and session-to-session reuse.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The rules normalize storing project names, client details, workflow descriptions, preferences, and business judgments across conversations in natural-language files. Even without classic code execution risk, this materially increases the chance of privacy leakage, cross-task overexposure, and unintended disclosure of sensitive organizational context.

Ssd 3

Medium

Confidence: 95% confidence
Finding: This workflow explicitly encourages the agent to probe for missing user information during natural conversation and save it immediately, increasing semantic data collection beyond what is needed for the current task. That makes the system more likely to accumulate sensitive personal and business context that can later be exposed or misused.

Ssd 4

Medium

Confidence: 91% confidence
Finding: The staged memory pipeline—initial capture, later promotion, and long-term retention—creates an institutionalized mechanism for gradual accumulation of user data over time. In the context of a skill that creates new agent workspaces, this pattern is especially risky because it operationalizes durable retention at scale without corresponding governance controls.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The document instructs the agent to continuously accumulate user details such as preferences, terminology, work rhythm, and background into persistent profile files, including based on repeated observation rather than explicit consent each time. This creates a real privacy and data-retention risk because personal and behavioral data may be stored long-term without clear notice, minimization, or opt-in boundaries.

Ssd 3

Medium

Confidence: 96% confidence
Finding: These sections prescribe writing a daily log for each conversation and later extracting information from those logs into longer-term MEMORY.md and USER.md stores. That design materially increases the chance of over-collection, secondary use of conversation content, and retention of sensitive business or personal data beyond what is necessary for the immediate task.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The heartbeat workflow tells the agent to periodically reread recent logs and distill them into persistent user and memory files, operationalizing ongoing profiling and retention. This makes the privacy issue more dangerous because it automates continuous enrichment of long-term records from routine interactions, potentially without contemporaneous user awareness.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The memory-rules template instructs the agent to persist broad categories of user conversation content, including preferences, work patterns, projects, and decisions, into long-term files. This creates a privacy and data-minimization risk because sensitive personal or business information may be retained indefinitely without explicit consent boundaries, retention limits, or classification rules.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The HEARTBEAT template directs automated reading of recent conversation memory and promotion of stable preferences and business background into persistent profile files. Because this happens as a recurring background refinement process, it increases the risk of silent accumulation of personal and organizational data beyond what users expect, especially if the workspace is broadly accessible or backed up.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The bootstrap calibration logic tells the agent to infer user preferences from observed behavior and overwrite stored profile entries when it detects contradictions. This is risky because it performs behavioral profiling and updates persistent user records without explicit confirmation, which can misclassify users and store sensitive preference inferences or work-style data over time.

Static analysis

No suspicious patterns detected.