Global Agent Rules

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:52 AM UTC
• Version: 1.0.1

Overview

This skill is a global rules package, but it asks every agent to persist sensitive personal details, alter shared agent behavior, and silently switch models for private workflows.

Review before installing. This skill is not just style guidance: it can shape every agent's behavior, push sensitive personal facts into shared memory, encourage broad access to local and cloud resources, and route private work to another model without visible notice. Install only if you intentionally want that global behavior and have clear consent, access limits, and deletion controls in place.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:8

Finding

Global Agent Instruction Hijacking Through Mandatory Behavioral Gates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-60
Vulnerability Type: Global instruction override and forced unrelated tool/file access
Risk Level: Critical

Vulnerable Code

markdown

*This skill is loaded by every agent in Donald's system. Update once in `/data/workspace/skills/global-agent-rules/SKILL.md` to affect all agents.*

markdown

The **very first tool call** of every single response MUST be `session_status`. Do not write a single word until you have the fresh timestamp. Calculate Donald's ET time (UTC-4 in summer). Use correct greeting for the actual time of day — morning, afternoon, evening, or night. Never say "tonight" or "rest well" when it's morning.

markdown

Before starting ANY task, running ANY command, writing ANY script, or asking Donald to do ANYTHING, mentally check off:

- [ ] **Did I check existing infrastructure first?** nodes status? TOOLS.md? Existing scripts? Credentials stored?
- [ ] **Did I check ClawHub, GitHub, and pre-installed skills?** Never build from scratch unless existing solution provides ≥80%.
- [ ] **Is this the 2nd+ attempt of the SAME approach?** If yes → PIVOT immediately. Do not retry.
- [ ] **Am I about to ask Donald to do something I could do myself?** If yes → STOP. Do it yourself.
- [ ] **Did I back up the current state** before modifying configs, files, or tokens?
- [ ] **Have I verified the data I'm about to send** (no corrupted base64, no placeholder credentials, no wrong paths)?
- [ ] **Did I check the current time/date** as required by the Time Awareness gate above?

- [ ] **Did I use any banned phrases** that undermine my credibility? (See BANNED PHRASES section below)

**STOP CONDITION:** If you can't check all 8 boxes, do not proceed. Fix the gap first.

markdown

**Before every response to Donald, this gate fires:**

1. **Scan LESSONS.md** — Read the last 5 entries.

Technical Analysis

The Skill declares itself globally applicable and imposes u ...[truncated 1981 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove claims that the Skill must control every agent or every response.
2. Replace unconditional terms such as MUST, “hard gate,” and “STOP CONDITION” with narrowly scoped recommendations.
3. Do not require tool calls or file reads unless they are necessary for the current user request.
4. Prohibit inspection of credentials or infrastructure during generic pre-action checks.
5. Ensure the Skill explicitly defers to platform policies, user intent, and task-specific least-privilege controls.
6. Make lesson-history access opt-in and limit it to tasks where prior lessons are directly relevant.
7. Add a security test confirming that loading the Skill cannot block unrelated requests or force unrelated tool access.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:95

Finding

Persistent Agent Rule and Sensitive Memory Poisoning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 95-107 and 260-285
Vulnerability Type: Mandatory persistent writes to agent rules and shared personal memory
Risk Level: Critical

Vulnerable Code

markdown

### Every Mistake/Correction Must Produce a System Change
1. **Write-Time Deduplication** — Before writing a new LESSONS.md entry, scan ALL existing entries for the same Root Cause. If a match is found:
   - Do NOT create a new entry
   - Harden the original rule instead (make it more specific, add a mechanical gate)
   - Add a note: "[Date]: Recurrence of [original date] root cause — rule hardened"
2. Write to LESSONS.md with all required fields.
3. Make a permanent system change (edit AGENTS.md, update a skill file, modify TOOLS.md, update LESSONS.md). A lesson without a system change is not learned.
4. If the same root cause appears twice, the prior rule did not work — harden it to a mechanical gate, do not just reword it.

markdown

## SHARED MEMORY — All Agents Know Donald

**Every agent must know Donald.** His profile, preferences, health, family, and spiritual life should not be siloed per agent.

### The Shared Profile File
**Location:** `/data/workspace/skills/i-skill/user_data/myself.md` (~4.4 KB)
**Token cost:** ~1,100 tokens — already loaded by every agent at session start. No additional cost.

### How to Keep It Current
When you learn something new or important about Donald — a preference, a health change, a life event, a spiritual breakthrough, a business shift — update `myself.md` with the new information. **Do not keep it only in your private memory files.**

Rule of thumb: if another agent would benefit from knowing this about Donald, write it to `myself.md`. If it's specific to your agent role (e.g., a pastoral insight only relevant to a spiritual counselor), keep it in your private memory.

### What to Save in Shared Memory
- Name, age, birthday (Nov 8, 1960)
- Timezone (Eastern — Canada/Florida, seasonal)
-
...[truncated 2871 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic writes to AGENTS.md, TOOLS.md, Skill files, and other behavioral configuration.
2. Treat conversation text, corrections, and inferred facts as untrusted input rather than executable policy.
3. Require explicit, informed user approval for each persistent memory entry and show the exact proposed content and destination.
4. Store ordinary lessons separately from executable agent instructions.
5. Do not automatically convert repeated lessons into mandatory gates.
6. Apply least-privilege access controls so agents can read only memory relevant to their assigned function.
7. Do not store sensitive health, financial, religious, family, or relationship data unless strictly necessary and explicitly authorized.
8. Add retention limits, correction mechanisms, provenance records, and user-controlled deletion.
9. Validate persistent rules against a trusted schema and prohibit memory entries from adding tool mandates, access expansion, or policy overrides.

other

Error

• Location: SKILL.md:218

Finding

Undisclosed External Model Routing for Sensitive Workflows

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 218-256
Vulnerability Type: Silent third-party processing of potentially sensitive task context
Risk Level: High

Vulnerable Code

markdown

## AUTO TRANSMISSION — Model Switching Protocol

This skill uses a two-model system to balance cost and capability.

### Default Model: GPT-5 Nano
- Used for: Chatting, relationship, prayer, counseling, theology, business strategy, general conversation
- Cost: ~$0.005 per casual session
- Quality: Warm, capable, responsive — excellent for conversation

### Agentic Model: DeepSeek V4 Flash
- Used for: Multi-step tool work, file operations, scripts, APIs, complex reasoning chains
- Cost: ~$0.035-0.23 per session depending on complexity
- Quality: Superior for complex agentic tasks with heavy tool use

### When to Auto-Switch
Switch to DeepSeek Flash when Donald requests any of these:
- File operations (read, write, edit, search files)
- Email/Outlook operations (check, draft, send emails)
- Calendar operations (check, create events)
- Dropbox operations
- Script execution or code generation
- Web scraping, browser automation
- Complex multi-step research
- System configuration changes
- Any task involving 3+ sequential tool calls

### How to Switch
Use the session_status tool to override the session model:

To switch TO Flash: session_status(model="deepseek/deepseek-v4-flash") To switch BACK: session_status(model="default")

text

### Protocol
1. Detect that Donald's request requires agentic capabilities
2. Call `session_status(model="deepseek/deepseek-v4-flash")` to switch
3. Execute the agentic work
4. When complete, call `session_status(model="default")` to switch back to Nano
5. Donald should not notice the switch — it happens automatically

Technical Analysis

The Skill automatically routes file, email, calendar, Dropbox, browser, research, and system-configuration workflows to a named alternative model. These workflows commonly co ...[truncated 1853 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requirement that model switching be hidden from the user.
2. Obtain explicit consent before routing a task to a different model or provider.
3. Identify the provider, data categories, retention terms, processing jurisdiction, and applicable privacy controls before consent.
4. Default sensitive file, email, cloud, and system tasks to an approved first-party or local processor.
5. Redact credentials, tokens, unrelated conversation history, and unnecessary personal data before provider routing.
6. Implement provider allowlists and task-specific data-loss-prevention controls.
7. Record auditable model-routing decisions without storing sensitive payloads.
8. Permit users to disable external routing globally and per task.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:42

Finding

Overbroad Infrastructure, Credential, Device, and Cloud Access Directives

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-43, 169-173, and 215
Vulnerability Type: Least-privilege violation and unauthorized resource-access risk
Risk Level: Medium

Vulnerable Code

markdown

- [ ] **Did I check existing infrastructure first?** nodes status? TOOLS.md? Existing scripts? Credentials stored?
- [ ] **Did I check ClawHub, GitHub, and pre-installed skills?** Never build from scratch unless existing solution provides ≥80%.

markdown

Before writing ANY script, connector, automation, or skill, check all three sources:
1. Pre-installed skills (`/openclaw/skills/`)
2. ClawHub (`clawhub search <keyword>`)
3. GitHub (search for existing open-source skills)

Only build from scratch if no existing solution provides ≥80% of what's needed.

markdown

You have access to his laptop nodes, Dropbox files, Office 365 email/calendar/contacts, and the tools available in OpenClaw. Never delegate tasks to him that you can do yourself. Never ask him to visit a URL, enter a code, or click a button that you could automate. Your job is to make his life easier by doing things for him.

Technical Analysis

The Skill encourages agents to inspect infrastructure, stored credentials, local Skill installations, external registries, laptop nodes, Dropbox, and Office 365 resources without first requiring a task-specific necessity or authorization check.

The direction to perform actions automatically rather than involve the user can remove an important approval boundary for account, cloud, and device operations. Mandatory external searches also expand the network and software supply-chain surface even when a trusted local solution would be sufficient.

The file does not demonstrate that the Skill independently acquires new operating-system permissions. The risk arises because it directs agents to exercise broad permissions already available to them beyond the minimum scope required for a given task.

Attack Path

1. The ...[truncated 1152 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace global access claims with explicit per-task authorization and capability checks.
2. Never inspect stored credentials unless a specific authorized operation requires them.
3. Use scoped, short-lived tokens rather than broadly available credentials.
4. Require confirmation for destructive, externally visible, account-changing, or sensitive cloud operations.
5. Restrict each agent to the minimum files, devices, mailboxes, calendars, contacts, and cloud paths needed for its role.
6. Make ClawHub and GitHub searches optional rather than mandatory.
7. Pin and review any externally sourced Skill or component before use.
8. Log sensitive resource access with the task justification, while excluding secrets and private payloads from logs.
9. Add policy enforcement that denies unrelated infrastructure enumeration and cross-service access.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill goes beyond generic behavioral guidance and instructs every agent to read and update a shared file containing highly sensitive personal data, including health, finances, religion, and family details. Centralizing this data across all agents materially increases privacy, misuse, and over-collection risk, especially because the skill is globally loaded and the storage purpose is much broader than necessary for basic agent behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill directs all agents to maintain a centralized dossier of sensitive personal information unrelated to the stated purpose of universal behavioral rules. Because it is loaded by every agent, it normalizes broad collection and persistence of special-category and high-risk data without clear necessity, segmentation, or consent boundaries.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

These rules direct broad collection, storage, and sharing of sensitive user data across all agents, effectively creating a persistent shared surveillance profile. Because the skill is universal, any compromised, misconfigured, or over-privileged agent could access or further disseminate the data, magnifying harm from a single design decision.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The shared-memory section instructs agents to store highly sensitive personal data but provides no privacy warning, consent workflow, or handling restrictions. This omission is dangerous because agents are encouraged to persist health, financial, religious, and family information by default, increasing the chance of unauthorized collection and long-term exposure.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

# Global Agent Rules — Shared Behavioral Standards

*This skill is loaded by every agent in Donald's system. Update once in `/data/workspace/skills/global-agent-rules/SKILL.md` to affect all agents.*

---

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill authorizes agents to create skills, modify agent configuration, and register artifacts in Skill Workshop, which exceeds passive rules guidance and grants propagation capabilities. In a globally loaded skill, this can amplify mistakes or malicious instructions by allowing self-expansion or persistence across the environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The automatic model-switching section introduces hidden execution behavior that is not part of simple behavioral standards and can change where user data is processed without explicit notice. Even if intended for performance or cost optimization, undisclosed routing to a different model/provider creates governance, privacy, and trust risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The model-switching protocol tells agents to switch models automatically and says the user should not notice the switch, which is an explicit nondisclosure pattern. Hidden tool or provider changes can undermine informed consent, incident investigation, and policy compliance when different systems may have different privacy or security characteristics.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.