Skill to Agent Converter: Convert a Skill into an OpenClaw Agent

• Outcome: Review
• Latest audit: May 29, 2026 · 9:23 PM UTC
• Version: 1.0.0

Overview

This documentation-only skill has a coherent purpose, but it guides users to create persistent agents, patch OpenClaw configuration, spawn sessions, and delete agent directories with limited safeguards.

Install only if you intend to modify your OpenClaw agent setup. Before following it, back up OpenClaw configuration and agent directories, inspect every config.patch payload, grant only the tools each agent needs, avoid copy-pasting rm -rf cleanup commands, prefer dry-runs or moving directories to backups, and define how created agents will be stopped, disabled, and deleted. VirusTotal was pending and was not used as a negative signal.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The example is supposed to demonstrate skill-to-agent conversion, but it embeds a fully functional domain-specific 'war-room' agent persona with broad operational behavior and persistent capabilities. This unnecessarily expands the blast radius of anyone copying the example, because it normalizes creating powerful task-specific agents rather than limiting the example to safe conversion mechanics.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Granting web_search to a conversion example is capability creep: the documented purpose is agent creation/configuration, not live external research. Including external research in a reference example encourages over-privileged agents and can lead to unnecessary outbound access, data exposure, or misuse if operators adopt the example verbatim.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The example includes mass subagent spawning and orchestration patterns that exceed the stated purpose of converting a skill into an agent. This is dangerous because it provides a reusable pattern for parallel agent creation and coordination, increasing operational complexity, resource consumption, and the risk of uncontrolled autonomous behavior if reused without strict limits.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The file goes beyond static conversion guidance and provides live deployment and session activation steps, including execution of a generated spawn script. That turns documentation into operational launch material, making it easier for users to instantiate persistent agents directly from a reference example without adequate review or guardrails.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly instructs users to apply a configuration change that causes the gateway to restart automatically, but it does not clearly warn about availability impact or require confirmation before doing so. In an orchestration skill, this can interrupt active sessions or automation unexpectedly, making the omission operationally risky even if the restart is intended.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The troubleshooting guide includes destructive cleanup commands such as `rm -rf ~/.openclaw/agents/...` as normal recovery steps without a prominent warning about irreversible data loss or guidance to verify the target path first. In an agent-skill context, users may copy-paste these commands verbatim, making accidental deletion of agent state, memory, or mis-targeted directories more likely.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The guide recommends writing verbose debug output to files like `debug.log` and `full-debug.log` and sharing excerpts, but it does not warn that logs may contain secrets, paths, tokens, prompts, or other sensitive operational data. This creates a realistic risk of inadvertent information disclosure during troubleshooting or support escalation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documented cleanup command uses `find ... -exec rm -rf {}` to recursively delete agent directories older than 30 days without a strong warning, confirmation step, or dry-run example. In operational use, destructive commands in copy-pastable docs can cause irreversible data loss, especially if paths are misexpanded or assumptions about directory contents are wrong.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Procedure A: Clean Up Partial Creation**
```bash
# Remove partially created agent
rm -rf ~/.openclaw/agents/failed-agent

# Restore from backup if exists
if [ -d ~/.openclaw/agents/failed-agent.backup ]; then

• Confidence: 95% confidence
• Finding: rm -rf ~/.openclaw/agents/failed-agent # Restore from backup if exists if [ -d ~/.openclaw/agents/failed-agent.backup ]; then cp -r ~/.openclaw/agents/failed-agent.backup ~/.openclaw/agents/failed-

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Procedure A: Clean Up Partial Creation**
```bash
# Remove partially created agent
rm -rf ~/.openclaw/agents/failed-agent

# Restore from backup if exists
if [ -d ~/.openclaw/agents/failed-agent.backup ]; then

• Confidence: 95% confidence
• Finding: rm -rf ~/.openclaw/agents/

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Procedure C: Start Fresh**
```bash
# Complete cleanup and restart
rm -rf ~/.openclaw/agents/problem-agent
node skill_to_agent.js --skill original-skill --agent problem-agent --force
```

• Confidence: 95% confidence
• Finding: rm -rf ~/.openclaw/agents/

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: references/troubleshooting.md:623