ClawHub
Back to skill

Security audit

Build Pipeline

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed build orchestrator, but it should go to Review because it spawns multiple agents and trusts persistent local worker files and outputs without enough scoping or validation.

Install this only if you expect it to run an OpenClaw build-factory workflow that can spawn several agents and create persistent build/profile files under ~/.openclaw-factory. Before using it, verify the referenced research-worker skills are trusted, use fresh unique build IDs, and treat generated YAML files as untrusted unless validated.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The manifest description says to use the skill for 'new builds and error handling,' which is a broad invocation scope and does not specify concrete trigger phrases, exclusions, or boundaries for when this skill should versus should not activate. In a markdown/manifest context, that ambiguity can cause unintended invocation overlap with many generic build- or troubleshooting-related requests.

Indirect Prompt Extraction

Medium
Category
System Prompt Leakage
Content
## Spawning Rules

1. **Research workers MUST read their SKILL.md** — Don't summarize instructions in the task. Tell them to read the file.
2. **Research workers use `agentId: null`** — they have no workspace, just task prompts.
3. **Builder uses `agentId: "builder"`** — it has a workspace at `workspace_builder/`.
4. **Never pass `streamTo="parent"`** for any subagent.
Confidence
88% confidence
Finding
The skill explicitly tells research workers to read and follow their own SKILL.md files exactly instead of receiving a bounded task summary. This indirect prompt loading expands the trusted instruction surface to external files, enabling prompt injection or malicious instruction substitution in those worker SKILL.md files, which can alter behavior, exfiltrate data, or weaken safeguards.

Session Persistence

Medium
Category
Rogue Agent
Content
Sub-agents must:
1. Read their SKILL.md file first
2. Follow ALL instructions in the file
3. Write output to YAML file (not chat back)
4. Exit silently after writing

If a sub-agent reports findings in chat instead of writing the file, **it failed**.
Confidence
83% confidence
Finding
The skill instructs spawned sub-agents to write outputs to shared YAML files and exit silently, creating persistent cross-session artifacts that later steps trust as authoritative input. This can enable tampering, stale-data reuse, or hidden prompt/data injection through the filesystem because results are not returned transparently in-channel and there is no integrity validation described.

Session Persistence

Medium
Category
Rogue Agent
Content
After successful parse, spawn all research workers **and** Builder simultaneously in a single spawn block.

### 3a. Create Research Partials Directory

```bash
mkdir -p ~/.openclaw-factory/shared/builds/{build-id}/research-partials/
Confidence
80% confidence
Finding
Creating and relying on a persistent shared directory under ~/.openclaw-factory/shared/builds/{build-id}/research-partials/ introduces state that survives across steps and potentially across runs. If build IDs collide, permissions are weak, or old files remain, the pipeline may consume attacker-controlled or stale research outputs as trusted inputs to the Builder.

Static analysis

No suspicious patterns detected.