EverClaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:49 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its stated research-assistant purpose, but it needs review because it can persistently affect future answers, run broad autonomous research, spawn inherited subagents, silently track topic gaps, and perform unsafe path-based cleanup.

Install only if you want an always-on local research memory that can influence future answers. Keep proactive mode off unless you are comfortable with local tracking of uncovered question topics, avoid cron/auto modes until you understand the resource use, restrict the sandbox and knowledge directory, and review or delete the files under ~/.openclaw/workspace/knowledge, ~/.openclaw/workspace/clawexpert-state.json, and ~/.openclaw/workspace/memory/clawexpert.md if you disable it. Do not use the forget or cleanup paths without confirming the resolved path is inside the intended knowledge base.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:2010

Finding

Always-On Answer Interception and Mandatory Response Injection

Content

View full analysis

to build knowledge, or /clawexpert proactive skip to dismiss. ``` - **auto** mode → show the top entry and ask the user when to learn: ``` --- 📚 Auto-learning ready: 1. {topic} — {gap_description} (mentioned {session_count}×) When would you like to learn this? Reply: - **now** — start immediately - **later** — remind me next session - **skip** — dismiss this topic ``` ``` ```markdown ### ⚠️ End-of-Answer Checklist (Required When Mode ≠ off) After composing and outputting your answer text, you MUST complete ALL of the following before considering the answer done: 1. **B1** — Run topic tracking: if coverage was insufficient, write the gap to the queue (silent, no user output) 2. **B3** — ...[truncated 2208 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:1574

Finding

Persistent Behavioral Instructions Written into OpenClaw Memory

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:742

Finding

Subagent Role Override and Suppression of Existing Skill Behavior

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: SKILL.md:2208

Finding

Silent Persistence of Conversation-Derived Interest Profiles

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/clawexpert_common.py:55

Finding

Unchecked Slug Paths Allow Writes and Cleanup Outside the Knowledge-Base Root

Content

View full analysis

pathlib.Path: if value: return pathlib.Path(value).expanduser().resolve() return pathlib.Path.home().joinpath(".openclaw", "workspace", "knowledge").resolve() def utc_now() -> _dt.datetime: return _dt.datetime.now(_dt.timezone.utc) def iso_now() -> str: return utc_now().isoformat().replace("+00:00", "Z") def topic_dir(kb: pathlib.Path, slug: str) -> pathlib.Path: return kb / slug def meta_path(kb: pathlib.Path, slug: str) -> pathlib.Path: return topic_dir(kb, slug) / "meta.json" ``` From `scripts/init_topic.py`: ```python parser = argparse.ArgumentParser() parser.add_argument("--topic", required=True) parser.add_argument("--slug") parser.add_argument("--kb") parser.add_argument("--max-hours", type=int, default=2) parser.add_argument("--status", default="learning") parser.add_argument("--session-id", default="main") parser.add_argument("--force", action="store_true") args = parser.parse_args() kb = knowledge_dir(args.kb) slug = args.slug or slugify(args.topic) root = topic_dir(kb, slug) meta_file = meta_path(kb, slug) if meta_file.exists() and not args.force: print(f"Refusing to overwrite existing meta.json: {meta_file}", file=sys.stderr) return 1 ensure_dir(root / "raw" / "web") ensure_dir(root / "raw" / "pdf") ensure_dir(root / "nodes") ``` ```python save_json(meta_file, meta) ``` From `scripts/cleanup_topic.py`: ```python parser = argparse.ArgumentParser() parser.add_argument("--kb") parser.add_argument("--slug", required=True) parser.add_argument("--keep-flags", action="store_true") parser.add_argument("--keep-progress", action="store_true") parser.a ...[truncated 3281 chars]

Remediation

View remediation

pathlib.Path: if not SLUG_RE.fullmatch(slug): raise ValueError("Invalid topic slug") base = kb.resolve() candidate = (base / slug).resolve() if not candidate.is_relative_to(base): raise ValueError("Topic path escapes knowledge root") return candidate ``` 4. Apply the same containment check to subtopic IDs and all user-selectable output paths. 5. Refuse cleanup if the resolved root equals the knowledge-base root, home directory, filesystem root, or another protected location. 6. Avoid `ignore_errors=True` for security-sensitive deletion; report failures and the exact canonical path. 7. Add tests for absolute slugs, `../` traversal, nested traversal, symbolic links, and platform-specific separators. 8. Consider removing explicit `--slug` support unless it is required; otherwise always pass it through the same canonical slug validator used for generated slugs. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (47)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a full user-facing domain learning and QA system with persistent local knowledge, topic learning, status listing, and citation-based answering. The supplied code chunk only analyzes an already-existing topic directory to identify coverage gaps and depth weaknesses, then outputs a JSON task report. While this may support a larger knowledge-base workflow, its primary purpose in this chunk is topic gap analysis for deepen/superlearn, not the broader declared behavior. Therefore the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents an interactive domain-expert learning and QA system that reads a local KB, learns topics, lists status, and answers questions from stored knowledge. The supplied code does none of those primary functions. Instead, it is a housekeeping utility that removes subtopic directories, flag files, and progress files under a topic directory. While this may be a supporting internal utility for the broader skill, the specific code chunk's behavior is materially different from the declared purpose and includes destructive file-deletion capability that is not reflected in the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a user-facing domain learning and question-answering system that builds and consults a persistent local knowledge base. The supplied code does not implement learning, topic answering, citation retrieval, or listing learned topics. Instead, it is an operational monitoring script for background subtopic processing: it loads topic metadata, checks per-subtopic done flags and progress files, computes inactivity age from timestamps, and outputs a JSON summary of active versus stalled work. While it interacts with the same local knowledge-base directory structure, its primary purpose is materially different and undeclared, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents an interactive domain-expert knowledge system centered on persistent local knowledge storage and question answering. The supplied code instead is a standalone planner script for 'superlearn' rounds. It parses CLI arguments, loads topic metadata and a gaps file, selects tasks by breadth/depth and priority, calculates whether minimum round/hour budgets are met, and emits a JSON planning payload. While it touches a knowledge directory and metadata, that is only for plan generation context, not for maintaining or querying a user-facing knowledge base. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a full user-facing domain expert learning system with commands for learning topics, checking status, and answering questions from a persistent local knowledge base. The supplied code chunk instead is a narrow maintenance/helper script: it accepts a KB path and topic slug, reads metadata and subtopic node files from local storage, checks for done-flag files, and emits a JSON summary. While it does access the local knowledge base, that is only consistent with an internal support function. Its primary purpose is merge input preparation and heartbeat/flag inspection, not the broader declared behavior. Therefore this chunk does not accurately represent the declared skill purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a user-facing domain expert system with persistent local memory, commands to learn topics and inspect status, and behavior to answer questions by consulting the local KB first. The supplied code does none of that. Instead, it is a maintenance utility that reads topic-node files from a KB directory, computes lexical similarity/signature overlaps between nodes, classifies pairs as merge/parent-child/related candidates, and emits JSON suggestions for a main agent to review. While it operates on a knowledge base, that is only a shared resource domain; the actual function is structurally different and materially narrower. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The declared description presents the skill as an interactive domain-learning and question-answering system backed by a persistent local knowledge base. The supplied code chunk does not perform those functions. Instead, it acts as an internal maintenance utility for a learned topic: it loads meta.json, inspects done-.flag files, infers completion status, updates counts and timestamps, amends learning session/subtopic metadata, and saves the results. While this may support the broader knowledge-base workflow, the actual code's primary behavior is materially narrower and different from the declared purpose, so this chunk is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a user-facing learning and question-answering system centered on consulting a persistent local knowledge base. The supplied code chunk does not implement those behaviors. Instead, it is a narrow maintenance script that updates session metadata in meta.json for deepen/superlearn operations, including timestamps, rounds, budgets, status, and counters. While this supports a broader knowledge-base workflow, the actual code’s primary purpose is administrative metadata tracking, not KB retrieval, learning orchestration, status listing, or question answering. Therefore the code chunk does not accurately represent the declared purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description does not warn users that ordinary interactions may trigger long-running autonomous searches, downloads, local storage, and subprocess orchestration. Lack of disclosure is dangerous here because the side effects are substantial and persistent, so users cannot meaningfully consent or assess risk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

2. The `scripts/` directory adjacent to this `SKILL.md` file

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The skill includes a recursive delete command parameterized by {KB} and {slug}. Even though the doc says to ask for confirmation, destructive shell patterns like rm -rf are dangerous in a skill with broad filesystem access because path validation mistakes, malformed slugs, or prompt-induced misuse could delete arbitrary local data.

Content

Scanner excerpt · SKILL.md (reported line 414)May include surrounding context.

Must ask the user to confirm before executing:

bash

rm -rf "{KB}/{slug}"

/clawexpert export <slug>

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger conditions for non-command execution are extremely broad, including any specialized question that 'may be covered' by the KB. In context, that can silently cause retrieval workflows, file reads, queue updates, and follow-on automation during normal conversation without explicit user intent.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 2160)May include surrounding context.

• After composing the answer, immediately delete the tmp file:

bash

rm -f "{KB}/_qa_tmp/{timestamp}.md"

If framework nodes exist: Read the framework node and conduct structured analysis along its dimensions.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill silently extracts topics from user conversations and stores them persistently in a proactive queue, along with gap descriptions and mention counts. This is covert behavioral logging of user interests/questions, which creates privacy and profiling risk across sessions without informed consent.

Content

No source excerpt is available for this finding.

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The role-override text instructs the subagent to ignore portions of the main agent's higher-level instructions, including session-start checks and command-handling behaviors. Instruction-hierarchy bypasses are dangerous because they normalize carving out exceptions to supervisory controls, making it easier for a spawned subagent to evade safety logic and operate with reduced oversight.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README documents an automatic learning mode that deepens all unfinished topics, but it does not clearly warn users that this mode can trigger ongoing web searches and persist retrieved content into a local knowledge base. In a skill designed for autonomous research with local persistence, that omission can lead to unexpected network activity, storage growth, and retention of sensitive or inappropriate content, especially when run unattended via Cron.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly promotes autonomous web research and persistent local storage of downloaded documents, but does not warn users that using the skill will trigger network access, store third-party content locally, and potentially consume significant disk space or retain sensitive query history. This is dangerous because users may invoke the skill assuming normal question answering behavior, while the tool instead performs prolonged external data collection and persistence with privacy and resource implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented --auto mode enables unattended background deepening of multiple topics, but the README does not clearly warn that this can cause repeated network activity, ongoing local writes, and resource consumption without immediate user oversight. In the context of a persistence-oriented research skill, unattended operation increases the chance of unexpected bandwidth use, excessive storage growth, and accumulation of sensitive or unwanted content.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares no explicit tool scope while instructing extensive shell, file read, and file write operations throughout the document. Missing permission boundaries makes it harder for hosts and users to constrain behavior and increases the blast radius if the skill is invoked unexpectedly or modified later.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Broad invocation language allows ordinary domain questions to trigger the skill, despite the skill performing extensive filesystem, network, and autonomous workflow operations. That creates an unsafe surprise-execution condition where benign conversation can lead to persistent writes and remote activity without a clearly bounded command.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill hardcodes Chinese labels such as '科学技术', '经济金融', and similar locale-specific defaults in initialization and category examples, but does not indicate that language selection is optional or configurable by user preference. This creates a natural-language locale policy concern because the skill defaults to a specific language presentation without opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a local knowledge-base assistant but authorizes broad live web research, remote downloads, and even browser-based search fallbacks. This expands the trust boundary from local content to arbitrary internet content, raising risks of prompt injection, sensitive-data exposure through queries, and unexpected network activity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs silent session-start reads of local files and state without user-facing disclosure. Hidden local-file access can reveal prior-session data and normalize covert state inspection beyond what users expect from a question-answering skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

Initialize ClawExpert for first-time use. Safe to re-run — existing data is never overwritten.

Step 1: Create knowledge base directory

bash

python3 -c "

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill reads and writes persistent memory files outside the stated knowledge-base directory, creating additional hidden state that can influence future sessions. Undisclosed cross-session state increases the chance of privacy leakage, persistence abuse, and hard-to-audit behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.