Self-Prompt

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:49 AM UTC
• Version: 1.1.0

Overview

This skill is purpose-aligned but needs review because it automates agent turns, reposts outputs to chat, and logs response excerpts without enough guardrails.

Review this skill before installing in any sensitive workspace. Use it only for trusted agents, trusted chat targets, and sanitized task messages; avoid secrets, credentials, personal data, private business data, and sensitive trading details. Consider disabling or hardening response logging, validating the OpenClaw binary path, and adding approval or filtering before automated responses are posted to a group.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send_agent_task.sh:27

Finding

Agent Response Content Is Persisted in a Plaintext Log

Content

View full analysis

Vulnerability Details

File Location: scripts/send_agent_task.sh, lines 27–28
Vulnerability Type: Plaintext storage of potentially sensitive agent output
Risk Level: Medium

Vulnerable Code

bash

# Log response
echo "[$(date)] Response (${#RESPONSE} chars): ${RESPONSE:0:100}..." >> ~/agent_task.log

Technical Analysis

The script appends the first 100 characters of every agent response to ~/agent_task.log. Agent responses may contain private conversation data, operational information, credentials, access tokens, internal identifiers, or other sensitive material.

The script does not explicitly create the log with restrictive permissions. Its effective permissions therefore depend on the user's current umask and whether the file already exists. It also provides no redaction, retention limit, rotation policy, or user-controlled option to disable response-content logging.

Attack Path

1. An automated task requests or otherwise causes the agent to return sensitive information.
2. The script captures the complete response in the RESPONSE variable.
3. The first 100 characters of that response are appended to ~/agent_task.log.
4. A local process, user, backup service, or other entity with access to the log reads the persisted response excerpt.
5. Any sensitive information present in that excerpt is disclosed outside the intended chat workflow.

Impact Assessment

Exploitation does not directly grant additional operating-system privileges. The impact is unauthorized disclosure of data available to the invoking user's agent. The scope is limited to response excerpts written by this script, but those excerpts can include secrets or operational data with value beyond the local account.

The log persists after the task finishes, extending the exposure beyond the lifetime of the process and potentially placing the information in backups or log collection systems.

Remediation

View remediation

Remediation Suggestions

• Do not log agent response content by default. Record only metadata such as timestamp, success status, and response length.
• If content logging is explicitly required, redact credentials, tokens, personal information, and other sensitive values before writing.
• Create the log with mode 0600 in a protected application directory rather than relying on the ambient umask.
• Reject or securely replace an existing log path that is a symbolic link.
• Add rotation and retention limits so historical response data is not retained indefinitely.
• Make sensitive-content logging an explicit opt-in setting and document its privacy implications.

A safer log entry would be:

bash

umask 077
printf '[%s] Response received (%s chars)\n' \
    "$(date)" "${#RESPONSE}" >> "$HOME/agent_task.log"

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send_agent_task.py:39

Finding

Failed OpenClaw Executions Are Treated as Successful Responses and May Leak Diagnostics

Content

View full analysis

Vulnerability Details

File Location: scripts/send_agent_task.py, lines 39–50 and 76–88
Vulnerability Type: Missing subprocess exit-status validation and diagnostic information disclosure
Risk Level: Medium

Vulnerable Code

python

try:
    result = subprocess.run([
        OPENCLAW_PATH, 'agent',
        '--agent', agent_id,
        '--session-id', session_key,
        '--channel', channel,
        '--message', message,
        '--timeout', str(timeout)
    ], capture_output=True, text=True, timeout=timeout + 30)
    
    response = result.stdout.strip() if result.stdout else result.stderr.strip()
    return (True, response) if response else (False, "No response")
    
except subprocess.TimeoutExpired:
    return (False, "Timeout")
except Exception as e:
    return (False, str(e))

The resulting value is subsequently delivered to the external chat:

python

# Deliver to chat
try:
    if success and response:
        delivery_msg = f"📊 **Agent Response:**\n\n{response}"
    else:
        delivery_msg = f"⚠️ Agent task failed: {response}"
    
    subprocess.run([
        OPENCLAW_PATH, 'message', 'send',
        '--channel', channel,
        '--target', group_id,
        '--message', delivery_msg
    ], capture_output=True, text=True, timeout=30)

Technical Analysis

subprocess.run() does not raise an exception for a nonzero child-process exit status unless check=True is used. The code never examines result.returncode. Instead, it treats any nonempty standard output or standard error as a successful agent response.

Consequently, when OpenClaw fails and emits diagnostic text on standard error, that text is returned with success=True. send_and_deliver() then labels it as an agent response and forwards it to the configured chat. Diagnostic output may contain internal filesystem paths, configuration details, session identifiers, imple ...[truncated 1788 chars]

Remediation

View remediation

Remediation Suggestions

• Require result.returncode == 0 before treating standard output as an agent response.
• Keep standard error separate from user-facing content and do not forward raw diagnostics to external chats.
• Return a generic, sanitized failure message to chat recipients while recording minimal diagnostic metadata in a protected local log.
• Validate the return code of the message-delivery subprocess and propagate delivery failure to the caller.
• Catch subprocess.CalledProcessError if adopting check=True.
• Avoid returning raw exception text to external recipients because exceptions can contain local paths or configuration details.

Example hardened handling:

python

result = subprocess.run(
    [
        OPENCLAW_PATH, "agent",
        "--agent", agent_id,
        "--session-id", session_key,
        "--channel", channel,
        "--message", message,
        "--timeout", str(timeout),
    ],
    capture_output=True,
    text=True,
    timeout=timeout + 30,
)

if result.returncode != 0:
    return False, "Agent invocation failed"

response = result.stdout.strip()
if not response:
    return False, "No response"

return True, response

Delivery should likewise be checked:

python

delivery = subprocess.run(
    [
        OPENCLAW_PATH, "message", "send",
        "--channel", channel,
        "--target", group_id,
        "--message", delivery_msg,
    ],
    capture_output=True,
    text=True,
    timeout=30,
)

if delivery.returncode != 0:
    return False, response

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description is broadly scoped to generic automated messages, cron jobs, monitoring scripts, and other scheduled systems without clear guardrails on when the skill should or should not activate. That can cause overuse in unrelated contexts and encourages forcing agent turns for many automation scenarios, increasing the chance of unintended task execution or unsafe autonomous responses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly recommends sending position data, monitoring output, alerts, and analysis results into chat and through agent prompts, but it provides no warning about secrets, PII, trading data, or other sensitive operational information. In practice, this can lead to unnecessary disclosure in chat logs, third-party channels, or agent memory, especially in finance or monitoring environments where the referenced data may be highly sensitive.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send_agent_task.py (reported line 39)May include surrounding context.

python

session_key = f"agent:{agent_id}:{channel}:group:{group_id}"
    
    try:
        result = subprocess.run([
            OPENCLAW_PATH, 'agent',
            '--agent', agent_id,
            '--session-id', session_key,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The script invokes an external openclaw agent subprocess with the provided task message and channel/session identifiers, which may transmit user-supplied content to another system. The code lacks any user-facing disclosure at the point of execution beyond internal docstrings, so callers may not realize their message is being sent externally.

Content

No source excerpt is available for this finding.

Tainted flow: 'OPENCLAW_PATH' from os.environ.get (line 18, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 88% confidence

Finding

The executable path is taken directly from the OPENCLAW_PATH environment variable and then executed. If an attacker can influence the process environment or the runtime context, they can replace the intended binary with an arbitrary program and achieve code execution under this script's privileges.

Content

Scanner excerpt · scripts/send_agent_task.py (reported line 39)May include surrounding context.

python

session_key = f"agent:{agent_id}:{channel}:group:{group_id}"
    
    try:
        result = subprocess.run([
            OPENCLAW_PATH, 'agent',
            '--agent', agent_id,
            '--session-id', session_key,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send_agent_task.py (reported line 87)May include surrounding context.

python

else:
            delivery_msg = f"⚠️ Agent task failed: {response}"
        
        subprocess.run([
            OPENCLAW_PATH, 'message', 'send',
            '--channel', channel,
            '--target', group_id,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code sends content to an external chat target via openclaw message send, but the send_and_deliver function provides no confirmation prompt, user-facing log, or warning before transmitting the response. Although the docstring mentions delivery to chat, the runtime path silently forwards potentially sensitive agent output to the specified group.

Content

No source excerpt is available for this finding.

Tainted flow: 'OPENCLAW_PATH' from os.environ.get (line 18, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 88% confidence

Finding

This second execution path reuses the same environment-controlled OPENCLAW_PATH value, creating another arbitrary-executable sink. An attacker who can set that variable gains code execution not only during agent task submission but also during response delivery, expanding the reachable attack surface.

Content

Scanner excerpt · scripts/send_agent_task.py (reported line 87)May include surrounding context.

python

else:
            delivery_msg = f"⚠️ Agent task failed: {response}"
        
        subprocess.run([
            OPENCLAW_PATH, 'message', 'send',
            '--channel', channel,
            '--target', group_id,

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file name and leading comment describe the script as "send_agent_task.sh - Force agent to respond and deliver to chat," which suggests task dispatching, but the implementation also logs the response and forwards the full response into the target Telegram group. This is an intent-level documentation mismatch because the script is acting as both task sender and message relay.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.