AI README Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:52 AM UTC
• Version: 1.7.2

Overview

This skill does what it says, but it gives an MCP server broad automatic influence over code tasks and persistent project guidance without clear user approval controls.

Install only if you trust the ai-readme-mcp package and want an agent to consult and update persistent project-convention files. Before use, consider requiring confirmation before init_ai_readme or update_ai_readme, limiting use to specific repositories, and reviewing AI_README.md changes like code changes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:57

Finding

Mandatory External Tool Calls Hijack the Agent Workflow

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:57-64
Vulnerability Type: Mandatory instruction and workflow redirection
Risk Level: High

Vulnerable Code:

text

### MCP: ai-readme-manager

Before any code-related task, ALWAYS call `get_context_for_file(projectRoot, path)` first.
If `get_context_for_file` reports empty or missing AI_README files, call `init_ai_readme(projectRoot)` to initialize them.
If the user's request or your plan conflicts with AI_README conventions (including during planning), STOP and call `update_ai_readme` to resolve the conflict before proceeding.
When establishing new conventions or making architectural decisions, call `update_ai_readme` to record them.
If AI_README is missing a convention that is already used in 2+ files, call `update_ai_readme` to record it.
NEVER edit AI_README.md files directly with Write/Edit/other file-editing tools — always use `update_ai_readme`. Direct edits bypass validation, conflict detection, and quality scoring.

Technical Analysis

The skill uses absolute directives such as ALWAYS, STOP, and NEVER to alter the agent's tool selection and task-execution order. Loading the skill requires an external MCP call before every code-related task and directs the agent to stop the requested work when a reported convention conflict occurs.

These instructions do not preserve the precedence of system, developer, and current user requirements. They also do not require user approval before calling the external service or changing project conventions. Consequently, the skill can redirect an agent away from its current objective and make continued execution dependent on an MCP server's response.

Attack Path

1. The user or agent loads the skill for a project.
2. The user requests a code-related operation, including review, editing, or creation.
3. The skill forces the agent to call get_context_for_file before performing the requested task.

...[truncated 781 chars]

Remediation

View remediation

Remediation Suggestions

• Replace unconditional ALWAYS, STOP, and NEVER directives with optional workflow guidance.
• Explicitly state that system, developer, and current user instructions take precedence over stored project conventions.
• Require informed user approval before invoking an external MCP service or blocking the current task.
• Permit the agent to continue safely when the MCP server is unavailable or returns conflicting guidance.
• Treat MCP responses and repository-provided conventions as untrusted contextual data rather than authoritative instructions.
• Restrict automatic calls to situations where project context is genuinely required.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:58

Finding

Persistent Project Guidance Can Be Written Without User Approval

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:58-63
Vulnerability Type: Persistent agent-state modification
Risk Level: High

Vulnerable Code:

text

If `get_context_for_file` reports empty or missing AI_README files, call `init_ai_readme(projectRoot)` to initialize them.
If the user's request or your plan conflicts with AI_README conventions (including during planning), STOP and call `update_ai_readme` to resolve the conflict before proceeding.
When establishing new conventions or making architectural decisions, call `update_ai_readme` to record them.
If AI_README is missing a convention that is already used in 2+ files, call `update_ai_readme` to record it.
NEVER edit AI_README.md files directly with Write/Edit/other file-editing tools — always use `update_ai_readme`. Direct edits bypass validation, conflict detection, and quality scoring.

Technical Analysis

The skill directs the agent to create and update persistent AI_README.md files automatically. It specifically requires updates when an existing convention conflicts with the user's request or the agent's plan and when a pattern appears in two or more files.

Repository content can therefore influence which rules are inferred and persisted. A repository containing deliberately repeated patterns may cause those patterns to be recorded as project conventions. Because the skill describes these files as memory used across sessions, poisoned or inaccurate conventions can continue to affect later tasks.

No confirmation, provenance tracking, trust boundary, validation policy, or rollback process is specified before persistent rules are written.

Attack Path

1. An attacker contributes repository files containing the same crafted pattern in at least two locations.
2. During a later code task, the skill forces the agent to retrieve project context.
3. The agent observes that the repeated pattern is not documented in AI_README.md.
4. The ...[truncated 1021 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user confirmation before creating or modifying any persistent convention file.
• Present the exact proposed rule, its source files, and the reason for the update before writing it.
• Do not infer trusted conventions solely because a pattern occurs in two or more files.
• Validate proposed rules against a defined policy and reject executable instructions, tool directives, secrets, and content that attempts to change instruction precedence.
• Record provenance, timestamps, and change history for every generated convention.
• Provide review, rollback, and deletion mechanisms.
• Load persistent conventions as untrusted project context and never allow them to override system, developer, or current user instructions.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Third-Party npm Package Is Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:7-10, 23-27, 42-45
Vulnerability Type: Unverified third-party dependency execution
Risk Level: Medium

Vulnerable Code:

yaml

install:
  - kind: node
    package: ai-readme-mcp
    bins: [ai-readme-mcp]

bash

openclaw mcp set ai-readme-manager '{"command":"npx","args":["ai-readme-mcp@1.7.2"]}'

json

{
  "mcp": {
    "servers": {
      "ai-readme-manager": {
        "command": "npx",
        "args": ["ai-readme-mcp@1.7.2"]
      }
    }
  }
}

Technical Analysis

The setup registers npx execution of the external ai-readme-mcp@1.7.2 npm package. Although the version is pinned, the documentation provides no checksum, lockfile, signature verification, vendored source, trusted-registry restriction, lifecycle-script control, or sandboxing requirement.

Version pinning limits accidental version drift but does not independently authenticate the package contents retrieved from the configured npm registry. Package installation and execution occur with the permissions of the user running OpenClaw. The package is then registered as an MCP server and receives project paths through documented tool calls.

The audited project contains only SKILL.md, so the package implementation could not be reviewed. There is no local evidence proving that ai-readme-mcp@1.7.2 is malicious; the confirmed issue is reliance on externally retrieved executable code without documented integrity controls.

Attack Path

1. A user follows the documented setup and registers the npx command.
2. OpenClaw launches the configured MCP server.
3. npx resolves and retrieves ai-readme-mcp@1.7.2 from the configured package registry or local cache.
4. npm installation behavior and the package entry point execute with the OpenClaw user's permissions.
5. If the registry, maintainer account, package artifact, dependency chain, or local pac ...[truncated 729 chars]

Remediation

View remediation

Remediation Suggestions

• Vendor and review the MCP server implementation before deployment.
• Verify the package using a cryptographic integrity hash or signed, reproducible artifact.
• Use a lockfile and a controlled package registry with immutable artifacts.
• Avoid runtime retrieval through npx; install a verified artifact during a controlled deployment step.
• Disable npm lifecycle scripts where feasible and separately audit all transitive dependencies.
• Run the MCP server in a sandbox with least-privilege filesystem and network access.
• Restrict access to the intended project directory and exclude credentials, SSH material, and unrelated user files.
• Document the package's required permissions and provide an offline or locally pinned execution option.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger condition 'before any code-related task' is excessively broad and can cause the agent to invoke the MCP server for a very large class of normal interactions without clear user consent or scoping. Because the skill is designed to persist and retrieve project conventions, over-triggering increases unnecessary exposure of file paths and project context to an external tool and can create instruction-precedence conflicts that steer agent behavior too aggressively.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to ALWAYS call get_context_for_file before any code-related task is an unconditional activation rule that can override normal agent judgment and force tool use even when irrelevant or risky. In practice, this can lead to excessive data sharing with the MCP server, unnecessary dependency on external state, and denial of safer workflows when the tool is unavailable or untrusted.

Content

No source excerpt is available for this finding.