ClawHub
Back to skill

Security audit

OpenClaw Workspace Initializer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed workspace initializer that creates local directories and user-approved workspace rules, with no hidden execution or exfiltration found.

Install this only when you want an agent to standardize a workspace directory. Review the dry-run and any WORKSPACE.md or AGENTS.md diff before approving, because those files can guide future agent behavior in that workspace.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/readme/hero.svg (reported line 7)May include surrounding context.

text
<rect width="1200" height="360" rx="20" fill="#0d1117"/>

  <!-- left: title block -->
  <g id="title-block" transform="translate(56 40)">
    <text x="0" y="44" font-family="ui-monospace, SFMono-Regular, Menlo, monospace" font-size="20" letter-spacing="4" fill="#8b949e">OPENCLAW · AGENT SKILL</text>

Persistent Context Injection

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.

Content

Scanner excerpt · README.en.md (reported line 22)May include surrounding context.

md
- ❌ Forget its own memory system (`memory/`), waking up amnesiac every session
- ❌ In multi-agent shared config setups, use `config.apply` to overwrite the whole `openclaw.json`, **wiping out other agents' changes**

This skill solves it all in one go: **directory structure + persistent rules + config safety**.

## Features

Persistent Context Injection

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.

Content

Scanner excerpt · README.en.md (reported line 84)May include surrounding context.

md
| | openclaw-workspace-starter | **xiaoyaoclaw-workspace-initializer** |
|---|---|---|
| Directory structure | basic template | complete convention system (7 dirs + naming rules + behavior rules) |
| Persistent rules | no WORKSPACE.md | ✅ WORKSPACE.md survives restarts |
| Multi-agent config safety | ❌ | ✅ config.patch / no config.apply (learned from real incidents) |
| Standalone templates | embedded | ✅ templates/ reusable separately |

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The file presents Chinese as the default content and labels it as the primary option, with English only linked out to a separate document. This can be a language/locale policy concern because the skill documentation in this file does not offer an in-context language choice or user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This asset includes Chinese-language text alongside English branding, but the file does not indicate that the language choice is optional or scoped to a specific audience. Under the language/locale policy, forcing or implying a specific locale without user opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.