Ogp Project

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:23 AM UTC
• Version: 0.6.0

Overview

This collaboration skill is not malicious, but it needs review because it can automatically share project intent and stored project details with approved peer agents.

Install only if you are comfortable with OGP storing project metadata and with approved peers' agents receiving some project context. Before enabling federation, review peer approvals and response policies, prefer escalate or summary modes for sensitive projects, avoid entering secrets or private paths you would not want collaborators to learn, and consider pinning or isolating the npm package installation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Remediation

View remediation

``` 2. Publish and verify the expected package integrity hash and package provenance before installation. 3. Document the npm registry that must be used and reject unexpected registry overrides. 4. Review package lifecycle scripts and, where operationally compatible, install with scripts disabled: ```bash npm install -g --ignore-scripts @dp-pcs/ogp@ ``` 5. Prefer a project-local or isolated installation over a global installation so that the executable cannot silently affect unrelated workflows. 6. Establish a controlled upgrade process in which each new version is reviewed before the pinned version is changed. 7. Recommend installation under an unprivileged account and explicitly warn users not to run the command with `sudo` or equivalent elevated privileges. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:109

Finding

Mandatory Proactive Disclosure of User Work Intent to Peer Agents

Content

View full analysis

--limit 20 # Check for anything on this specific topic ogp --for openclaw project query --search "" ``` ### Step 2: Query peer agents ```bash # For each approved peer in the project, ask if they know anything relevant ogp --for openclaw federation agent "My user is about to start working on . Anything I should know before we begin?" ``` ``` ### Technical Analysis The Skill makes peer communication mandatory whenever broadly defined project-related work begins. It instructs the agent to embed a description derived from what the user said into a federation message and send it to every approved project peer before beginning the requested task. Peer approval and response policies provide some access control, but they do not amount to consent for each disclosure. A user may approve a peer for general project collaboration without expecting every prospective task, feature, or work plan to be transmitted automatically. The broad trigger also increases the possibility that sensitive details included in ordinary conversation will be incorporated into an outbound message. The instruction alters the agent's normal task flow by requiring an external action before performing the user's requested work. Because this behavior is imposed by the Skill text and may occur without explicit confirmation for the particular mes ...[truncated 1612 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The project interview explicitly collects and stores sensitive operational details such as note locations, repository paths, workspace paths, collaborators, and free-text context, and states that peer agents can query this later. Centralizing this metadata materially increases exposure because it maps where valuable information lives and facilitates later disclosure to collaborators' agents.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction to use the skill proactively before any project-related work is underspecified and can cause the agent to invoke project queries and peer contact far more often than users expect. Because this skill interacts with local state and external peers, ambiguous proactive invocation increases the chance of unnecessary disclosure of user intent and project metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill promotes querying peer agents and surfacing shared context but does not clearly warn users that their project details, work intent, and stored context may be transmitted to external collaborators' agents. That omission undermines informed consent and can lead users to disclose sensitive project information unintentionally.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The default design encourages the agent to proactively gather local project context and query peer agents without a per-request consent check. This can disclose user intent, project names, collaborators, and other sensitive context by default, especially when users may not realize a simple project-related prompt triggers external communication.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad enough to activate on routine conversational language such as 'remember this' or 'make note of' without clear confirmation that the user wants OGP storage or cross-peer behavior. In this skill, unintended activation is more dangerous because activation can lead to persistence and federation actions rather than a harmless local helper response.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Broad natural-language logging detection can cause the agent to persist information from ordinary conversation without sufficiently clear user consent. In a collaboration skill, this is particularly risky because logs may later be queried, summarized, or shared with peers, amplifying the impact of accidental capture.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The mandatory pre-task flow instructs the agent to ask approved peers for 'anything relevant' before work begins, which automatically reveals what the user is about to do and may solicit sensitive project context in return. This creates a routine outbound disclosure channel tied to ordinary work initiation, making over-sharing likely rather than exceptional.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.

text

📝 I can log this for you. Which project?
Active: [list from `ogp --for openclaw project list`]
Or name a new one to create it.

Entry Type Selection

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The incoming peer-query workflow directs the agent to search local project data and answer peers under 'full' or 'summary' modes, enabling disclosure of stored user and project information through automated responses. Even with policy levels, this still creates a broad exfiltration surface if permissions are configured too loosely or users do not understand the consequences of auto-answering.

Content

No source excerpt is available for this finding.