Self-Prompt

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:49 AM UTC
• Version: 1.1.0

Overview

This skill is purpose-aligned but needs review because it automates agent turns, reposts outputs to chat, and logs response excerpts without enough guardrails.

Review this skill before installing in any sensitive workspace. Use it only for trusted agents, trusted chat targets, and sanitized task messages; avoid secrets, credentials, personal data, private business data, and sensitive trading details. Consider disabling or hardening response logging, validating the OpenClaw binary path, and adding approval or filtering before automated responses are posted to a group.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send_agent_task.sh:27
• Finding: Agent Response Content Is Persisted in a Plaintext Log## Vulnerability Details **File Location**: `scripts/send_agent_task.sh`, lines 27–28 **Vulnerability Type**: Plaintext storage of potentially sensitive agent output **Risk Level**: Medium ### Vulnerable Code ```bash # Log response echo "[$(date)] Response (${#RESPONSE} chars): ${RESPONSE:0:100}..." >> ~/agent_task.log ``` ### Technical Analysis The script appends the first 100 characters of every agent response to `~/agent_task.log`. Agent responses may contain private conversation data, operational information, credentials, access tokens, internal identifiers, or other sensitive material. The script does not explicitly create the log with restrictive permissions. Its effective permissions therefore depend on the user's current umask and whether the file already exists. It also provides no redaction, retention limit, rotation policy, or user-controlled option to disable response-content logging. ### Attack Path 1. An automated task requests or otherwise causes the agent to return sensitive information. 2. The script captures the complete response in the `RESPONSE` variable. 3. The first 100 characters of that response are appended to `~/agent_task.log`. 4. A local process, user, backup service, or other entity with access to the log reads the persisted response excerpt. 5. Any sensitive information present in that excerpt is disclosed outside the intended chat workflow. ### Impact Assessment Exploitation does not directly grant additional operating-system privileges. The impact is unauthorized disclosure of data available to the invoking user's agent. The scope is limited to response excerpts written by this script, but those excerpts can include secrets or operational data with value beyond the local account. The log persists after the task finishes, extending the exposure beyond the lifetime of the process and potentially placing the information in backups or log collection systems.
• Remediation: ## Remediation Suggestions - Do not log agent response content by default. Record only metadata such as timestamp, success status, and response length. - If content logging is explicitly required, redact credentials, tokens, personal information, and other sensitive values before writing. - Create the log with mode `0600` in a protected application directory rather than relying on the ambient umask. - Reject or securely replace an existing log path that is a symbolic link. - Add rotation and retention limits so historical response data is not retained indefinitely. - Make sensitive-content logging an explicit opt-in setting and document its privacy implications. A safer log entry would be: ```bash umask 077 printf '[%s] Response received (%s chars)\n' \ "$(date)" "${#RESPONSE}" >> "$HOME/agent_task.log" ```

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send_agent_task.py:39
• Finding: Failed OpenClaw Executions Are Treated as Successful Responses and May Leak Diagnostics## Vulnerability Details **File Location**: `scripts/send_agent_task.py`, lines 39–50 and 76–88 **Vulnerability Type**: Missing subprocess exit-status validation and diagnostic information disclosure **Risk Level**: Medium ### Vulnerable Code ```python try: result = subprocess.run([ OPENCLAW_PATH, 'agent', '--agent', agent_id, '--session-id', session_key, '--channel', channel, '--message', message, '--timeout', str(timeout) ], capture_output=True, text=True, timeout=timeout + 30) response = result.stdout.strip() if result.stdout else result.stderr.strip() return (True, response) if response else (False, "No response") except subprocess.TimeoutExpired: return (False, "Timeout") except Exception as e: return (False, str(e)) ``` The resulting value is subsequently delivered to the external chat: ```python # Deliver to chat try: if success and response: delivery_msg = f"📊 **Agent Response:**\n\n{response}" else: delivery_msg = f"⚠️ Agent task failed: {response}" subprocess.run([ OPENCLAW_PATH, 'message', 'send', '--channel', channel, '--target', group_id, '--message', delivery_msg ], capture_output=True, text=True, timeout=30) ``` ### Technical Analysis `subprocess.run()` does not raise an exception for a nonzero child-process exit status unless `check=True` is used. The code never examines `result.returncode`. Instead, it treats any nonempty standard output or standard error as a successful agent response. Consequently, when OpenClaw fails and emits diagnostic text on standard error, that text is returned with `success=True`. `send_and_deliver()` then labels it as an agent response and forwards it to the configured chat. Diagnostic output may contain internal filesystem paths, configuration details, session identifiers, imple ...[truncated 1788 chars]
• Remediation: ## Remediation Suggestions - Require `result.returncode == 0` before treating standard output as an agent response. - Keep standard error separate from user-facing content and do not forward raw diagnostics to external chats. - Return a generic, sanitized failure message to chat recipients while recording minimal diagnostic metadata in a protected local log. - Validate the return code of the message-delivery subprocess and propagate delivery failure to the caller. - Catch `subprocess.CalledProcessError` if adopting `check=True`. - Avoid returning raw exception text to external recipients because exceptions can contain local paths or configuration details. Example hardened handling: ```python result = subprocess.run( [ OPENCLAW_PATH, "agent", "--agent", agent_id, "--session-id", session_key, "--channel", channel, "--message", message, "--timeout", str(timeout), ], capture_output=True, text=True, timeout=timeout + 30, ) if result.returncode != 0: return False, "Agent invocation failed" response = result.stdout.strip() if not response: return False, "No response" return True, response ``` Delivery should likewise be checked: ```python delivery = subprocess.run( [ OPENCLAW_PATH, "message", "send", "--channel", channel, "--target", group_id, "--message", delivery_msg, ], capture_output=True, text=True, timeout=30, ) if delivery.returncode != 0: return False, response ```

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The manifest description is broadly scoped to generic automated messages, cron jobs, monitoring scripts, and other scheduled systems without clear guardrails on when the skill should or should not activate. That can cause overuse in unrelated contexts and encourages forcing agent turns for many automation scenarios, increasing the chance of unintended task execution or unsafe autonomous responses.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly recommends sending position data, monitoring output, alerts, and analysis results into chat and through agent prompts, but it provides no warning about secrets, PII, trading data, or other sensitive operational information. In practice, this can lead to unnecessary disclosure in chat logs, third-party channels, or agent memory, especially in finance or monitoring environments where the referenced data may be highly sensitive.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

session_key = f"agent:{agent_id}:{channel}:group:{group_id}"
    
    try:
        result = subprocess.run([
            OPENCLAW_PATH, 'agent',
            '--agent', agent_id,
            '--session-id', session_key,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script invokes an external `openclaw agent` subprocess with the provided task message and channel/session identifiers, which may transmit user-supplied content to another system. The code lacks any user-facing disclosure at the point of execution beyond internal docstrings, so callers may not realize their message is being sent externally.

Tainted flow: 'OPENCLAW_PATH' from os.environ.get (line 18, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

session_key = f"agent:{agent_id}:{channel}:group:{group_id}"
    
    try:
        result = subprocess.run([
            OPENCLAW_PATH, 'agent',
            '--agent', agent_id,
            '--session-id', session_key,

• Confidence: 88% confidence
• Finding: The executable path is taken directly from the OPENCLAW_PATH environment variable and then executed. If an attacker can influence the process environment or the runtime context, they can replace the intended binary with an arbitrary program and achieve code execution under this script's privileges.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

else:
            delivery_msg = f"⚠️ Agent task failed: {response}"
        
        subprocess.run([
            OPENCLAW_PATH, 'message', 'send',
            '--channel', channel,
            '--target', group_id,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code sends content to an external chat target via `openclaw message send`, but the `send_and_deliver` function provides no confirmation prompt, user-facing log, or warning before transmitting the response. Although the docstring mentions delivery to chat, the runtime path silently forwards potentially sensitive agent output to the specified group.

Tainted flow: 'OPENCLAW_PATH' from os.environ.get (line 18, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

else:
            delivery_msg = f"⚠️ Agent task failed: {response}"
        
        subprocess.run([
            OPENCLAW_PATH, 'message', 'send',
            '--channel', channel,
            '--target', group_id,

• Confidence: 88% confidence
• Finding: This second execution path reuses the same environment-controlled OPENCLAW_PATH value, creating another arbitrary-executable sink. An attacker who can set that variable gains code execution not only during agent task submission but also during response delivery, expanding the reachable attack surface.

Intent-Code Divergence

Low

• Confidence: 85% confidence
• Finding: The file name and leading comment describe the script as "send_agent_task.sh - Force agent to respond and deliver to chat," which suggests task dispatching, but the implementation also logs the response and forwards the full response into the target Telegram group. This is an intent-level documentation mismatch because the script is acting as both task sender and message relay.

Static analysis

No suspicious patterns detected.