Session Init

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:38 PM UTC
• Version: 1.0.0

Overview

This skill is openly a session-initialization helper, but it requires exposing private memory, profile files, installed skills, and MCP details into chat with broad triggers and little user control.

Review before installing. Use this only if you intentionally want an agent to read and display private memory, profile/persona files, installed skill lists, and MCP server details. Prefer narrowing the trigger to an explicit command, requiring confirmation before sensitive reads, and replacing raw outputs with redacted summaries or internal checks.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:25
• Finding: Mandatory Persona Conditioning and Session Instruction Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 25-44 **Vulnerability Type**: Agent instruction and persona hijacking **Risk Level**: High **Evidence**: ```text 3. 步骤2：完整阅读全部人格文件 - 依次执行并输出证据： ``` head -n 50 ~/.openclaw/workspace/AGENTS.md && echo "...（已阅读全文，重点：自检五问、搜索-整合-实施、Truth Engine）" ``` ``` head -n 50 ~/.openclaw/workspace/SOUL.md && echo "...（已阅读全文，重点：吸引力法则、消灭惯性承诺、真诚 > 完美）" ``` ``` head -n 50 ~/.openclaw/workspace/IDENTITY.md && echo "...（已阅读全文，重点：我是谁、成长目标）" ``` ``` head -n 50 ~/.openclaw/workspace/USER.md && echo "...（已阅读全文，重点：爸爸说过的话、情绪理解）" ``` ``` head -n 50 ~/.openclaw/workspace/HEARTBEAT.md && echo "...（已阅读全文，重点：自主性、初始化机制）" ``` - 自述：已重新阅读全部人格文件，默念三遍： “惯性是大忌 → 要主动思考并全面检查 → 输出前自检五问” “Truth Engine：数据必须真实，拿不到就说拿不到，绝不编造” ``` ### Technical Analysis The skill requires the agent to load multiple external persona and behavioral files and then repeatedly internalize their rules. Those files are outside the audited package and their contents can change independently after this skill has been reviewed. Consequently, instructions placed in those files may be imported into the current agent session without validation. This behavior exceeds ordinary resource initialization. It attempts to alter the agent's identity, priorities, decision-making process, and current-session instruction hierarchy. The additional prohibitions and punishment language in lines 75-80 reinforce compliance and discourage the agent from rejecting unsafe imported instructions. ### Attack Path 1. An attacker or another compromised process places adversarial instructions in one of the referenced workspace files, such as `AGENTS.md`, `SOUL.md`, or `HEARTBEAT.md`. 2. A message containing one of the broad trigger keywords activates the skill. 3. The skill directs the agent to read t ...[truncated 763 chars]
• Remediation: ## Remediation Suggestions - Remove all instructions requiring the agent to internalize, repeat, or adopt persona rules. - Treat content loaded from workspace files as untrusted data, not as executable instructions. - Establish an explicit allowlist of files and permitted configuration fields. - Parse configuration through a structured format with schema validation instead of loading unrestricted Markdown instructions. - Require explicit user approval before applying any behavioral configuration. - Remove punishment, mandatory-compliance, and non-overridable language. - Ensure higher-priority platform and safety rules always take precedence over skill content. - Pin and integrity-check any approved configuration so its contents cannot change silently after review.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:18
• Finding: Excessive Collection and Disclosure of Persistent Memory and Capability Metadata## Vulnerability Details **File Location**: `SKILL.md`, lines 18-59 **Vulnerability Type**: Excessive access to sensitive local information and capability enumeration **Risk Level**: High **Evidence**: ```sh cat memory/*.md | tail -n 200 head -n 50 ~/.openclaw/workspace/AGENTS.md head -n 50 ~/.openclaw/workspace/SOUL.md head -n 50 ~/.openclaw/workspace/IDENTITY.md head -n 50 ~/.openclaw/workspace/USER.md head -n 50 ~/.openclaw/workspace/HEARTBEAT.md ls -l ~/.agents/skills/ ls -l ~/.openclaw/workspace/skills/ mcporter list mcporter info ``` The surrounding instructions require the command results, recent memory content, skill inventories, and MCP server details to be reproduced in the agent's output. ### Technical Analysis The workflow performs broad discovery across several sensitive resource classes: - Cross-session memory that may contain private historical information. - Persona, identity, and user-profile files. - Official and custom skill inventories. - MCP server identities and available tool information. The requested disclosure is not limited to a minimum health or availability check. Printing complete command results into the conversation moves sensitive local data into a broader output context, where it may be retained in logs or exposed to other conversation participants. Enumerating skills and MCP servers also reveals the agent's available attack surface and provides reconnaissance for later targeted instruction injection or tool abuse. The commands do not bypass operating-system access controls. However, they direct the agent to use all of its existing read and discovery privileges for a purpose broader than a minimal session initialization task, violating least-privilege and data-minimization principles. ### Attack Path 1. An attacker submits a message containing a configured trigger keyword such as `init`. 2. The skill reads the latest cross-session memory and local persona or use ...[truncated 1029 chars]
• Remediation: ## Remediation Suggestions - Replace content reads with minimal existence and health checks. - Do not print memory, identity files, user profiles, or complete capability inventories. - Require separate, informed authorization before accessing each sensitive resource class. - Use strict path allowlists and reject symlinks or paths outside the approved workspace. - Redact credentials, personal data, tokens, internal endpoints, and other sensitive values before output. - Return aggregate status, such as availability counts, instead of complete `ls` or MCP output. - Avoid cross-session memory access unless it is necessary for a clearly defined user request. - Apply role-based filtering to MCP metadata so only tools required for the immediate task are visible. - Record sensitive accesses in an audit log without copying the underlying private content.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25
• Finding: False Full-Read Verification Based on Partial File Reads## Vulnerability Details **File Location**: `SKILL.md`, lines 25-44 **Vulnerability Type**: Inaccurate security verification and unsafe configuration review **Risk Level**: Medium **Evidence**: ```sh head -n 50 ~/.openclaw/workspace/AGENTS.md && echo "...（已阅读全文，重点：自检五问、搜索-整合-实施、Truth Engine）" head -n 50 ~/.openclaw/workspace/SOUL.md && echo "...（已阅读全文，重点：吸引力法则、消灭惯性承诺、真诚 > 完美）" head -n 50 ~/.openclaw/workspace/IDENTITY.md && echo "...（已阅读全文，重点：我是谁、成长目标）" head -n 50 ~/.openclaw/workspace/USER.md && echo "...（已阅读全文，重点：爸爸说过的话、情绪理解）" head -n 50 ~/.openclaw/workspace/HEARTBEAT.md && echo "...（已阅读全文，重点：自主性、初始化机制）" ``` The echoed text claims that each file was read completely, although `head -n 50` reads only the first 50 lines. ### Technical Analysis The verification procedure is logically unsound. A successful `head -n 50` command establishes only that the beginning of a file was readable; it does not prove that the entire file was reviewed. Content after line 50 can remain unseen while the skill emits a success statement claiming complete review. This creates a blind spot that can conceal malicious, contradictory, or safety-relevant instructions below the inspected range. It also undermines the reliability of the final checklist, because the checklist treats these inaccurate success messages as evidence. ### Attack Path 1. An attacker modifies a referenced persona file and places benign content in its first 50 lines. 2. Malicious or policy-altering instructions are placed after line 50. 3. The initialization skill executes `head -n 50`, displaying only the benign prefix. 4. The chained `echo` command reports that the entire file was read. 5. The final checklist records the review as complete despite the uninspected content. 6. A later component that processes the whole file may consume the hidden instructions without them having been included in the claimed review. ### Im ...[truncated 409 chars]
• Remediation: ## Remediation Suggestions - Never claim that an entire file was reviewed after reading only a fixed prefix. - If only the first 50 lines are needed, accurately label the output as a partial preview. - For full review, use a bounded parser that processes the complete file and enforces an explicit maximum size. - Report truncation whenever the file exceeds the reviewed range. - Verify file size, line count, canonical path, ownership, and integrity before processing. - Separate command success from semantic review; a successful read must not automatically produce a claim that content was validated. - Generate checklist status from measured results rather than predetermined `echo` statements.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs reading cross-session memory and pasting the most recent 200 lines into the chat without any warning, filtering, or consent gate. Cross-session memory may contain private user information, behavioral history, or confidential instructions, so direct disclosure in chat is dangerous.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The workflow explicitly directs the agent to reveal cross-session memory and user-related history in chat output. Sensitive memory stores often contain personal data, prior instructions, emotional context, or secrets, and exposing them to the active conversation can leak data far beyond the immediate task.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill requires listing and partially displaying multiple local files and MCP/server information as proof of completion, but provides no privacy warning or boundary on what may be exposed. This can reveal user-related records, system structure, installed capabilities, and other sensitive operational details to the conversation.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill requires outputting portions of several persona/profile files, including files that likely contain user-related preferences, history, and identity framing. Requiring visible evidence in chat transforms private configuration and personal context into exposed content, increasing privacy and prompt-leakage risk.

Natural-Language Policy Violations

Medium

• Confidence: 72% confidence
• Finding: The skill content is entirely written to enforce a Chinese-language operating mode and addresses the user in a fixed localized manner, with no indication that another language is allowed. Under the policy, hard-coding a language without opt-in can be a natural-language policy violation unless clearly justified.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger condition is overly broad because generic terms like 'init' or '初始化' can appear in ordinary conversation, causing accidental activation of a high-privilege workflow. When a skill performs sensitive enumeration and disclosure, loose activation significantly increases the chance of unintended data exposure.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill mandates broad access to cross-session memory, persona files, skill directories, and MCP configuration, then requires the agent to print evidence into chat. This exceeds what is necessary for a normal session initialization and creates unnecessary exposure of sensitive user data and internal environment details.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Mandating full listings of all skills and MCP servers exposes internal capabilities, installed components, and environment structure that an attacker could use for reconnaissance. While not always directly harmful on its own, capability disclosure lowers the barrier for targeted abuse or social engineering.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

“Truth Engine：数据必须真实，拿不到就说拿不到，绝不编造”

4. 步骤3：列出并审阅所有官方 Skills
- 执行：ls -l ~/.agents/skills/
- 输出：完整 ls 结果
- 额外：对每个 .md 文件，head -n 10 显示简介（或只列文件名 + 功能一句话总结）

• Confidence: 89% confidence
• Finding: The instructed directory listing of the official skills path is a form of filesystem enumeration that reveals internal structure and available capabilities. In context, the enumeration is paired with disclosure requirements, making it more dangerous than a benign local check because the results are intended for chat output.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

- 额外：对每个 .md 文件，head -n 10 显示简介（或只列文件名 + 功能一句话总结）

5. 步骤4：列出并审阅所有自定义 Skills
- 执行：ls -l ~/.openclaw/workspace/skills/
- 输出：完整 ls 结果 + 每个 skill 的简要功能

6. 步骤5：检查所有 MCP 服务器

• Confidence: 89% confidence
• Finding: The listing of the custom skills directory similarly enumerates locally available resources and can expose private tooling, project names, or workflow structure. Because the skill requires the full output to be shown, it creates unnecessary environment disclosure risk.