T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/roles/Writer.md:48- Finding
Unrestricted Local File References Can Expose Sensitive Host Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Social Ops
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for social-media automation, but it enables unattended public posting and broad local-file use with insufficient safeguards.
Install only if you are comfortable with scheduled agents reading configured local references, modifying a social workspace, and posting or replying on your behalf. Before enabling cron jobs, use dry-run, restrict Local-File-References.md to non-sensitive approved files, keep credentials least-privilege, review queued posts before Poster runs, and check for duplicate cron jobs after installation.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
packaged-scripts/install-cron-jobs.sh:58- Finding
Broken Cron Job Lookup Causes Duplicate Persistent Scheduled Jobs
- Content
View full analysis
/dev/null | python3 - "$job_name" <<'PY' import json import sys needle = sys.argv[1] raw = sys.stdin.read().strip() if not raw: print("") raise SystemExit(0) try: data = json.loads(raw) except Exception: print("") raise SystemExit(0) jobs = [] if isinstance(data, list): jobs = data elif isinstance(data, dict): if isinstance(data.get("jobs"), list): jobs = data["jobs"] elif isinstance(data.get("items"), list): jobs = data["items"] for j in jobs: if isinstance(j, dict) and j.get("name") == needle: print(j.get("id", "")) raise SystemExit(0) print("") PY } ``` The lookup controls the add-or-edit decision in `packaged-scripts/install-cron-jobs.sh:96-123`: ```bash upsert_job() { local name="$1" local cron_expr="$2" local description="$3" local message="$4" local existing_id existing_id="$(get_existing_job_id "$name")" if [[ -n "${existing_id}" ]]; then echo "Updating existing job: ${name} (${existing_id})" run_cmd openclaw cron edit "${existing_id}" \ --name "${name}" \ --description "${description}" \ --cron "${cron_expr}" \ --tz "${TZ_NAME}" \ --session isolated \ --message "${message}" \ --enable else echo "Creating new job: ${name}" run_cmd openclaw cron add \ --name "${name}" \ --description "${description}" \ --cron "${cron_expr}" \ --tz "${TZ_NAME}" \ --session isolated \ --message "${message}" fi } ``` ### Technical ...[truncated 2546 chars]- Remediation
View remediation
/dev/null | python3 -c ' import json import sys needle = sys.argv[1] data = json.load(sys.stdin) jobs = data if isinstance(data, list) else data.get("jobs", data.get("items", [])) matches = [ job for job in jobs if isinstance(job, dict) and job.get("name") == needle ] if len(matches) > 1: raise SystemExit("duplicate jobs found for: " + needle) print(matches[0].get("id", "") if matches else "") ' "$job_name" ``` 2. Fail closed when: - `openclaw cron list` fails - Output is empty - JSON parsing fails - Multiple jobs have the same expected name - A matching entry lacks an ID 3. Check and propagate the exit status of both pipeline commands, using `set -o pipefail`, which the script already enables. 4. Before adding a job, perform a second explicit uniqueness check. 5. Provide a cleanup or migration routine that detects existing duplicates and asks the operator which entries to remove. 6. Add integration tests proving that: - The first run creates each job once - The second run edits rather than adds - Invalid JSON aborts installation - Duplicate existing names are reported rather than silently multiplied 7. Display a final summary containing the IDs and action taken for every job so the operator can verify persistence changes. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
md 5. Stop No infinite exploration. No deep dives without constraint. Research must compound, not sprawl.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README includes a very broad natural-language trigger example asking the agent to 'figure out how to install the crons for me,' which could encourage unintended activation or overbroad autonomy in environments where skills are invoked from chat text. In the context of a skill that sets up scheduled automation, accidental invocation can lead to unauthorized persistence or automation changes without sufficient user review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README directs users to install cron jobs for automated social-media operations and even provides a one-command quick start, but it does not prominently warn about the security, compliance, and operational risks of unattended posting or engagement. In this skill context, scheduled execution is central to the workflow, so the absence of warnings increases the chance of users enabling persistent automation without understanding account, platform-policy, or approval safeguards.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation guidance is broad enough to trigger the skill for general social-media tasks, which can cause the agent to enter a workflow that includes content creation, replies, posting, and automation-related setup without a tightly scoped user request. In an agent environment, over-broad activation increases the chance of unintended high-impact actions being proposed or initiated in the wrong context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly includes a Poster role that publishes content and also points users to cron-job installation for automated execution, but it does not prominently require a confirmation or safety checkpoint before these impactful actions. That creates a real risk of unauthorized posting, reputational harm, or persistent automated behavior if the skill is activated inappropriately or used with incomplete oversight.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The role map explicitly documents access to privacy-sensitive data sources, including replies/DMs/mentions and arbitrary local files referenced through a human-curated file list, but it provides no accompanying constraints, consent requirements, minimization rules, or warning about sensitive-data handling. In a multi-role agent skill, normalizing these data flows without guardrails increases the chance that personal or confidential information is collected, propagated into logs, or reused across roles beyond the operator's intent.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file states that the Content Specialist only shapes strategy and does not perform direct operational work, but later gives it sole authority over submolt promotion and retirement. This contradiction is dangerous because downstream agents or reviewers may rely on the earlier boundary language and underestimate the role's actual write capabilities and decision authority.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The role explicitly instructs the agent to append logs and elsewhere to create, update, move, and remove multiple files under the workspace without any requirement for prior user confirmation. In an agent skill, silent file mutation is risky because routine execution can cause persistent changes, overwrite user-maintained state, or be chained with adversarial context from referenced files.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This role is defined as a strategic content-planning function, but it is later granted authority to change submolt subscriptions and move entries across Primary, Candidates, and Retired state files. That is a privilege/scope expansion that lets a content-planning role make durable operational changes, increasing the chance of unauthorized state mutation or misuse if the role is activated inappropriately.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This role explicitly instructs the agent to publish content to an external platform and then modify local state by annotating and moving files, but it does not require an explicit user-facing confirmation at execution time for those side effects. In an agent setting, that creates a real risk of unintended public posting and filesystem changes if the skill is triggered in the wrong context or with unreviewed inputs.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The role is introduced as purely reactive—limited to comments, DMs, and explicit mentions—but later broadens to opportunistic thread engagement based on Scout signals. In a multi-role agent system, this kind of scope drift weakens least-privilege boundaries and increases the chance that untrusted contextual inputs steer the agent into actions it was not originally meant to perform.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document first constrains Responder to reactive engagement and explicitly says it must not enter unrelated threads, but later authorizes Scout-sourced 'insertion' into threads outside direct mentions. That contradiction can be exploited by upstream routing or prompt injection in Scout logs to expand the agent’s authority, causing policy bypass, unintended outreach, or reputationally risky engagement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs the agent to write persistent data into workspace files, but it provides no warning, confirmation step, or disclosure that running the role will modify local state. In an agent setting, silent file writes are risky because they can cause unintended persistence, contaminate later runs, and alter operator-managed content without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The role directs automatic updates to Candidates.md as part of normal execution, again without warning that this is a persistent modification to shared workspace content. Because the file appears to be part of an ongoing operational knowledge base, unreviewed writes can introduce noise, duplication, or attacker-influenced entries that affect downstream decisions and future agent behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This role explicitly instructs the agent to create and update multiple files in the workspace, including Todo items, logs, and memory files, but provides no user-facing confirmation, approval boundary, or write-scope restriction. In an agent setting, silent file modification can cause unintended content changes, overwrite trusted workspace state, or be abused through poisoned inputs in referenced guidance or lane files to persist unwanted data.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file instructs the Analyst to write output to
$SOCIAL_OPS_DATA_DIR/Content/Logs/Analysis-YYYY-WW.md, which is a file-modifying action. The document presents the write location and format, but does not include a user-facing warning that the skill will create or update files in the workspace.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The role explicitly instructs the agent to create and modify persistent files such as task queues, guidance documents, and logs, but it does not require notifying the user or obtaining confirmation before those writes. In an agent environment with filesystem access, this can lead to silent state changes, unexpected persistence, or accidental overwriting of user-managed project artifacts.
- Content
Static analysis
No suspicious patterns detected.