Multi-Perspective Forum

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:42 AM UTC
• Version: 1.0.0

Overview

This skill is coherent, but it can schedule recurring LLM runs that collect and submit sensitive business data without clear consent, redaction, or lifecycle controls.

Review this skill before installing. Use it only if you are comfortable with a hosted model receiving summarized business metrics, and require explicit approval, redaction of logs and customer or lead data, and clear controls to list, pause, and delete any scheduled OpenClaw cron jobs.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Warning

• Location: SKILL.md:76

Finding

Persistent LLM-Enabled Scheduled Tasks Without Explicit Consent or Lifecycle Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 76–81
Vulnerability Type: Persistent scheduled task registration
Risk Level: Medium

Vulnerable Code

markdown

## Cron

- Monday 9 AM ET: `0 13 * * 1` (leverage audit)
- Friday 9 AM ET: `0 13 * * 5` (retro)

Use OpenClaw cron (needs LLM access), not crontab.

Technical Analysis

The Skill instructs the agent to use OpenClaw cron to establish two recurring tasks with LLM access. These tasks can survive the initiating Skill run and continue executing every Monday and Friday.

Scheduling is relevant to the named leverage-audit and retrospective use cases, but it is not required for the Skill's core function of conducting an on-demand, multi-perspective debate. The instructions do not require explicit user confirmation before registration and do not define task identifiers, authorization boundaries, expiration conditions, duplicate-registration protection, cost limits, or removal procedures.

This creates a persistence risk: an agent interpreting the instruction imperatively may register recurring jobs that continue consuming resources and processing workspace data after the original interaction ends.

Attack Path

1. A user or agent loads the Skill to conduct a forum, leverage audit, or weekly retrospective.
2. The agent follows the Cron section as an operational instruction.
3. It registers Monday and Friday OpenClaw cron tasks with LLM access.
4. The tasks survive the original invocation and execute in future weeks.
5. Each execution may collect current operational data, invoke the configured hosted model, and incur additional processing or token costs.
6. Without documented removal or expiration controls, execution continues until the user discovers and manually disables the tasks.

Impact Assessment

The behavior can obtain recurring access to whatever data and tools are available to the scheduled OpenClaw execution context. Potential effects include:

• Persistent, ...[truncated 493 chars]

Remediation

View remediation

Remediation Suggestions

1. Make on-demand execution the default and describe cron scheduling as an optional feature.
2. Require explicit, informed user confirmation immediately before creating each recurring task.
3. Show the exact schedule, model, data categories, estimated cost, execution permissions, and retention behavior before confirmation.
4. Assign stable task identifiers and check for an existing task before registration to prevent duplicates.
5. Apply an expiration date or bounded execution count unless the user explicitly requests indefinite operation.
6. Run scheduled tasks with the minimum available tool and data permissions.
7. Provide commands or documented steps to list, pause, and remove every task created by the Skill.
8. Notify the user after registration and after any material scheduling or permission change.
9. Consider separating scheduling into a distinct setup workflow so invoking the forum itself cannot silently create persistence.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:60

Finding

Unrestricted Submission of Potentially Sensitive Business Data to a Hosted Model

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60–73
Vulnerability Type: Insufficient data minimization and sensitive-data handling controls
Risk Level: Medium

Vulnerable Code

markdown

## Spawn Config

sessions_spawn: task: [formatted prompt] model: "github-copilot/claude-opus-4.6" mode: "run" runTimeoutSeconds: 120

text

## Data Collection Before Forum

**Leverage Audit (Monday):** Resend analytics, lead pipeline counts, revenue/signups, error logs, outreach totals, cron health, cost burn.

**Weekly Retro (Friday):** Sprint target vs actual, emails sent, leads sourced, revenue events, things shipped/broke, blockers hit.

Technical Analysis

The Skill directs the agent to collect broad operational and commercial data and interpolate it into the forum prompt submitted through sessions_spawn to a specifically configured hosted model.

The requested categories include analytics, lead-pipeline information, revenue and signup data, error logs, outreach metrics, cost information, and operational failures. Depending on the source systems, these records may contain customer or lead information, email addresses, internal identifiers, confidential financial information, authentication material accidentally captured in logs, or other sensitive content.

The Skill provides no instructions to:

• Limit collection to metrics necessary for the user's question.
• Prefer aggregate statistics over raw records.
• Detect and remove credentials or tokens from logs.
• Redact personal, customer, or lead information.
• Confirm that the user is authorized to disclose the selected data.
• Obtain approval before transmitting the final payload.
• Account for provider retention, privacy, or organizational data-handling requirements.

Consequently, normal use can disclose more information than is necessary for the declared debate functionality. Recurring execution through the cron workflow can repeat that exposure.

Attack Path

1. Th ...[truncated 1611 chars]

Remediation

View remediation

Remediation Suggestions

1. Collect only the specific metrics required to answer the user's stated question.
2. Use aggregate counts and summaries instead of raw leads, emails, customer records, or logs by default.
3. Add a mandatory sanitization step that removes credentials, API keys, session tokens, authorization headers, personal data, and internal identifiers.
4. Treat error logs as sensitive and extract only relevant error categories and counts unless the user explicitly approves raw excerpts.
5. Present a preview or inventory of the data categories to be submitted and obtain user approval before invoking the hosted model.
6. Verify that the user is authorized to disclose the selected organizational data.
7. Document the model provider, data-processing boundary, applicable retention behavior, and organizational policy requirements.
8. Define maximum payload sizes and reject unexpectedly broad datasets.
9. For scheduled runs, use a preapproved, fixed schema with least-privilege read access rather than unrestricted collection from the workspace.
10. Preserve only the minimum output required and avoid storing complete prompts containing sensitive source data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad and overlap with normal planning language such as 'debate this' and 'weekly retro', which can cause the skill to activate in situations the user did not clearly intend. Because the skill performs a high-token LLM invocation and frames analysis through a fixed debate structure, accidental invocation can lead to unnecessary data processing, cost, and unintended disclosure of business context sent into the forum prompt.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs collection of operational and business metrics including analytics, pipeline counts, revenue, error logs, outreach totals, and cost burn, then sends that material to an external LLM without any privacy, minimization, or sensitivity guidance. In context, this is more dangerous because the skill is explicitly designed for routine scheduled use, increasing the chance that confidential or regulated data is repeatedly transmitted without review or redaction.

Content

No source excerpt is available for this finding.