ClawHub
Back to skill

Security audit

OpenClaw Task Progress Tracker

Security checks for vulnerabilities and agentic risk

Overview

This is a file-based task progress tracker whose local writes are mostly expected for its stated purpose, with no evidence of hidden execution or data exfiltration.

Install only if you want the agent to create and maintain local progress files. Expect it to write under tasks/ and projects/, update PROGRESS.md files, index or sometimes move named documents into docs/, and record completion summaries in memory files. Ask the agent to confirm before moving existing files if preserving original paths matters.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/readme/hero.svg (reported line 7)May include surrounding context.

text
<rect width="1200" height="360" rx="20" fill="#0d1117"/>

  <!-- left: title block -->
  <g id="title-block" transform="translate(56 40)">
    <text x="0" y="44" font-family="ui-monospace, SFMono-Regular, Menlo, monospace" font-size="20" letter-spacing="4" fill="#8b949e">OPENCLAW · AGENT SKILL</text>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/readme/hero.svg (reported line 24)May include surrounding context.

text
<g id="status-panel" transform="translate(700 44)">
    <rect width="450" height="276" rx="10" fill="#161b22" stroke="#30363d" stroke-width="1.2"/>

    <!-- terminal dots -->
    <circle cx="18" cy="20" r="5" fill="#ff5f56"/>
    <circle cx="36" cy="20" r="5" fill="#ffbd2e"/>
    <circle cx="54" cy="20" r="5" fill="#27c93f"/>

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This manifest-like markdown file includes multiple documentation descriptions entirely in Chinese, such as '设计文档', '用户使用指南', and '技能主体', without indicating that the skill is region-specific or offering a language choice. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README explicitly says the agent may move a user-specified document into a managed docs/ directory, but it does not warn that this operation modifies the original file location. That can cause unintended file relocation, broken references, or loss of expected file placement if the user does not realize the action is destructive rather than a copy/index step.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The language selector presents Chinese as the default and English only as an alternate link, which may indicate a locale preference imposed without user choice. Under the policy, language constraints should be offered as an explicit user choice or clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly instructs the agent to create directories and modify workspace files such as PROGRESS.md, memory logs, and document indexes, but it does not require an explicit warning or confirmation before performing those filesystem changes. In an agent setting, this can lead to unexpected persistent side effects, accidental overwrites, or unauthorized workspace modifications when a user request is ambiguous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The user-facing guide is entirely in Chinese and presents the interaction model as fixed, without offering an alternative language or stating that Chinese is optional. This can violate language/locale policy when users are not given a choice or explicit opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The guide says users can simply 'speak naturally' to the skill, without defining clear trigger boundaries or exclusion conditions. This is ambiguous because everyday phrases about tasks, progress, or documents could overlap with normal conversation and lead to unintended activation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documented workflow includes updating memory/ even though the skill description presents the tool as limited to task and project directory management. This mismatch can mislead reviewers and users about where data will be written, potentially causing unexpected retention of summaries, paths, or outputs beyond the user's intended tracking scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The template explicitly instructs the agent to write to memory/YYYY-MM-DD.md during task completion, which exceeds the declared scope of managing only tasks/ and projects/. This creates an undeclared side effect in another workspace area, increasing the chance of unauthorized or unexpected persistence of task data and cross-skill data contamination.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file specifies that the agent will update PROGRESS.md, append progress logs, and move generated documents into docs/, but it does not mention any user-facing warning or confirmation before altering files. Because these operations affect workspace contents and file locations, the skill description should disclose that behavior to users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The README describes creating task/project directories and updating PROGRESS.md files as automatic outcomes of plain-language requests, but it does not clearly warn that the skill performs filesystem writes. In a file-based agent environment, unclear write behavior can lead to unintended workspace modifications, especially if users interpret the skill as read-only tracking or status reporting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file explains that the agent will automatically create directories and PROGRESS.md cards and update them during normal use. Because these are file-writing operations that affect the user's workspace, the description should include a brief warning or disclosure that the skill will create and modify local files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This file includes prominent user-facing text in Chinese ('目录即容器 · PROGRESS.md 即进度' and '进度日志 · 文档索引 · 零依赖') while the rest of the asset is otherwise English, with no indication that the skill is intentionally region-specific or that users can choose locale. That creates a natural-language locale policy concern because the asset implicitly forces a language for part of the interface without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Several status labels and file names shown in the illustration use Chinese text such as '进行中', '调研报告', and '进度可回溯 · 文档找得回'. In the absence of any documented language-selection behavior or explicit locale targeting, this is a user-facing language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

This markdown template uses Chinese for all visible section headers and maintenance instructions, which imposes a specific language on downstream use. Under the policy, language constraints should either be optional/opt-in or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.