OpenClaw 龙虾灵魂锻造炉

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:43 AM UTC
• Version: 2.2.0

Overview

This skill is a disclosed OpenClaw persona generator with limited local script execution and user-confirmed file output, but users should watch the broad triggers and local file writes.

Install only if you want a Chinese-first OpenClaw persona-generation workflow. Before allowing it to write files, confirm the exact target directory and whether existing SOUL.md or IDENTITY.md files will be overwritten. Treat the optional baoyu-image-gen integration as a separate dependency to review, and prefer a safe temporary path instead of a predictable /tmp filename for avatar prompts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:58

Finding

Predictable and Unsanitized Temporary-File Path

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:58 and duplicated in references/avatar-style.md:87
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Low

Vulnerable Code Snippet:

markdown

1. Write the prompt to the temporary file `/tmp/openclaw-[lobster name]-prompt.md`

The instruction appears in Chinese in the source files and directs the agent to construct a predictable path in the shared /tmp directory by interpolating the character name.

Technical Analysis

The temporary-file name is both predictable and derived from a potentially user-controlled character name. The instructions do not require:

• Sanitizing path separators or traversal sequences in the name.
• Creating the file atomically with exclusive-create semantics.
• Rejecting symbolic links.
• Restricting file permissions.
• Using a private, randomly named temporary directory.
• Deleting the temporary file after image generation.

On a multi-user system, an attacker may pre-create the expected path as a symbolic link. A subsequent agent write could follow that link and overwrite another file writable by the agent process. If path separators or traversal components are accepted in the character name, they could also influence where the prompt is written.

This issue exists in Skill instructions rather than directly executable project code, but an agent following those instructions would perform the unsafe operation.

Attack Path

1. The attacker determines or influences the selected character name.
2. The attacker predicts the resulting path, such as /tmp/openclaw-example-prompt.md.
3. Before the Skill writes the prompt, the attacker creates that path as a symbolic link to another file.
4. The agent follows the Skill instruction and writes the prompt to the predictable path.
5. If the runtime write operation follows symbolic links, the link target is overwritten with the agent's privileges.

Alternatively, a crafted name containing path separa ...[truncated 776 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a private, randomly named temporary directory using a secure facility such as Python tempfile.TemporaryDirectory() or shell mktemp -d.
2. Create the prompt file atomically with exclusive-create semantics and permissions no broader than 0600.
3. Never use a raw character name as a path component. Replace it with a generated identifier, or strictly allow-list safe characters and reject path separators, .., control characters, and absolute paths.
4. Ensure the write operation does not follow symbolic links, using platform facilities such as O_NOFOLLOW where available.
5. Verify that the resolved file remains inside the newly created private temporary directory.
6. Delete the prompt file and temporary directory immediately after image generation, including on error paths.
7. Apply the same correction to the duplicated instruction in references/avatar-style.md:87.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger list includes highly generic phrases such as '抽卡' and '随机', which can cause the skill to activate in unrelated conversations. Unintended activation can lead to unnecessary file writes, script execution via gacha.py, or persona-design workflow taking over a session when the user meant something else.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation table again permits activation from vague phrases like '随机' and '来一发' without requiring topic qualification. In agent environments, such broad matching increases the chance of prompt-routing mistakes and unintended execution of the skill's workflow, including local script invocation and file generation steps.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The instruction says every generation 'must' include the provided English STYLE_BASE and may not modify or omit it. This imposes a fixed language/style choice on outputs without offering the user any language or locale choice or documenting why the constraint is necessary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file hard-codes Chinese output conventions and examples without indicating that the user can choose another language. In a general-purpose agent skill, this can cause unwanted language coercion, reduce usability for non-Chinese users, and lead to outputs that do not match user expectations or platform language settings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The template directs the agent to create SOUL.md and IDENTITY.md files after user confirmation, but it does not require a clear user-facing warning that filesystem writes will occur or any guardrails around path safety. In a skill that may be invoked conversationally, this can normalize silent file creation/modification and increase the risk of unintended writes, especially if the user provides an unsafe or ambiguous target directory.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Lines L279-L280 state the skill does not include any network request or file-sending code, framing the capability as limited. However, elsewhere the document explicitly directs the agent to write a temporary prompt file under /tmp and later generate SOUL.md and IDENTITY.md with a Write tool. While this is not a severe security issue, the documentation understates actual file-writing side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file’s natural-language interface and usage text are entirely in Chinese, and all generated output strings are hard-coded in Chinese. Under the language/locale policy, forcing a specific language without user opt-in can be a policy concern when no alternative or choice is presented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The entire skill template and all prescribed section labels and example phrasing are in Chinese, which implicitly constrains the skill's output language. Because the file does not offer user opt-in or choice of language, this can be a natural-language policy issue under the language/locale rule.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.