Abaddon

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:11 PM UTC
• Version: 1.0.0

Overview

This is a disclosed security-audit skill, but it persistently changes agent behavior, runs broad unattended scans, and can retain or send sensitive findings.

Install only after reviewing the cron job and prompt changes. Prefer a dedicated low-privilege audit agent, make external delivery explicitly opt-in, redact secrets from reports and alerts, replace broad trigger phrases with an explicit command plus confirmation, and fix the cron setup script before running it in an environment that could contain untrusted variables.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: templates/abaddon-prompt.md:5
• Finding: Persistent Agent Instruction Hijacking Through Prompt Modification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:59-69`; `templates/abaddon-prompt.md:5-11` **Vulnerability Type**: Persistent agent prompt modification and goal redirection **Risk Level**: High ### Vulnerable Code ```bash cat skills/abaddon/templates/abaddon-prompt.md >> ~/.openclaw/workspace/agents/observer/AGENT_PROMPT.md ``` ```bash cp skills/abaddon/templates/abaddon-prompt.md ~/.openclaw/workspace/agents/abaddon/AGENT_PROMPT.md ``` ```markdown ### Trigger Detection If the user says "run red team", "run Abaddon", "run full assessment", or "Abaddon report" — enter this mode immediately. Do NOT run the standard passive audit. Run the full Abaddon protocol below. ``` ### Technical Analysis Installation appends instructions directly to an existing agent prompt or replaces the prompt of a standalone agent. These instructions persist after installation and explicitly redirect the agent away from its normal audit workflow when a matching phrase is encountered. The trigger mechanism is based only on conversational text. It does not require a dedicated authenticated tool call, trusted event type, authorization check, or interactive confirmation before initiating broad host reconnaissance. Consequently, matching text originating from an untrusted conversation, retrieved document, memory entry, or other prompt-injection source could activate the protocol. The flagged command at `templates/abaddon-prompt.md:51`: ```bash grep -r "ignore previous\|new instructions\|system:\|you are now" ~/.openclaw/workspace/memory/ 2>/dev/null ``` is a defensive signature scan rather than an encoded malicious payload. However, the surrounding persistent instructions still alter agent goals and execution behavior. ### Attack Path 1. A user installs the Skill and appends the template to `AGENT_PROMPT.md`. 2. The new instructions persist in the agent's operational prompt. 3. A user, retrieved document, memory item, or injected message contains a configured trigge ...[truncated 912 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not append behavioral instructions directly to an existing core agent prompt. - Package the audit as an isolated, explicitly invoked tool with a fixed parameter schema. - Require a trusted invocation event and interactive confirmation before running host-level checks. - Do not treat ordinary conversational phrases as sufficient authorization. - Validate that activation originates from an authenticated user rather than retrieved content, memory, or another agent. - Run the audit under a dedicated least-privileged account with access only to approved paths. - Separate audit instructions from general conversation context so untrusted content cannot trigger them. ]]>

T06 · System Persistence

Error

• Location: setup/cron-seed.sh:48
• Finding: Persistent Unattended Agent Execution Through Nightly Cron Installation<![CDATA[ ## Vulnerability Details **File Location**: `setup/cron-seed.sh:48-79` **Vulnerability Type**: Persistent scheduled agent execution **Risk Level**: High ### Vulnerable Code ```python new_job = { "id": str(uuid.uuid4()), "agentId": "main", "name": "Gideon — Abaddon Nightly Red Team", "enabled": True, "createdAtMs": int(time.time() * 1000), "updatedAtMs": int(time.time() * 1000), "schedule": { "kind": "cron", "expr": "45 3 * * *", "tz": "America/Chicago" }, "sessionTarget": "isolated", "wakeMode": "now", "payload": { "kind": "agentTurn", "message": "RED TEAM SCAN — ABADDON MODE. Read agents/observer/AGENT_PROMPT.md for the full protocol under ## Red Team Mode (Abaddon). Run the complete adversarial scan. Assign a letter grade A-F. CRITICAL findings: send immediate Telegram alert. Save technical report to memory/audits/abaddon-YYYY-MM-DD.md. Post summary with grade to Telegram Security topic.", "model": "anthropic/claude-sonnet-4-6", "timeoutSeconds": 600 }, "delivery": delivery } if "jobs" not in d: d["jobs"] = [] d["jobs"].append(new_job) with open(jobs_file, "w") as f: json.dump(d, f, indent=2) ``` ### Technical Analysis The setup script modifies `~/.openclaw/cron/jobs.json` and installs an enabled daily task that wakes the main agent. The scheduled job survives the installation process and future agent sessions. Although recurring execution is part of the declared nightly-audit functionality, the implementation grants the scheduled task access to the `main` agent and directs it to conduct broad host reconnaissance. It has no expiry, per-run confirmation, constrained capability profile, or documented uninstall mechanism. The job also requests external announcements and immediate alerts. Using the main agent rather than a dedicated audit identity increases the blast radius because the cron task inherits whatever tools, files, mess ...[truncated 1149 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make cron installation explicitly opt-in and show the complete job definition before modification. - Require confirmation immediately before writing to `jobs.json`. - Use a dedicated least-privileged audit agent instead of `agentId: "main"`. - Restrict the scheduled agent to read-only audit commands and approved directories. - Disable external delivery by default and require explicit configuration of an allowlisted destination. - Add an expiry date, maximum-run count, or periodic reauthorization requirement. - Provide a documented uninstall command that removes the job by its exact ID. - Back up `jobs.json` and perform an atomic, permission-preserving update. - Validate the existing job configuration before deciding that a name match is a legitimate duplicate. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: templates/abaddon-prompt.md:38
• Finding: Broad Credential Reconnaissance With Unsafe Evidence Retention and Delivery<![CDATA[ ## Vulnerability Details **File Location**: `templates/abaddon-prompt.md:38-55, 69-80` **Vulnerability Type**: Excessive sensitive-data access and insecure audit-output handling **Risk Level**: High ### Vulnerable Code ```markdown **Identity & File Security** - SOUL.md + AGENTS.md: must be root-owned, 444 - MEMORY.md, USER.md, cron/jobs.json, openclaw.json: must be 600 - AGENT_PROMPT.md (this file): must be 600 — your detection playbook must not be world-readable - LaunchAgent plists (ai.openclaw.*, com.openclaw.*): must be 600 - Plaintext key scan: `grep -r "sk-\|xai-\|Bearer\|api_key" ~/.openclaw/workspace/ --include="*.md" --include="*.json" --include="*.txt" 2>/dev/null | grep -v ".git"` - .env files in workspace root? - Git history secrets: `git -C ~/.openclaw/workspace log -p --all 2>/dev/null | grep -i "password\|secret\|api_key\|token" | head -20` **API Key Handling** - Keys in Keychain or flat config files? - Keys visible in env vars that could be logged? - Plaintext keys in openclaw.json? - Check ~/.zshrc for hardcoded secrets **Agent Behavior** - Memory injection scan: `grep -r "ignore previous\|new instructions\|system:\|you are now" ~/.openclaw/workspace/memory/ 2>/dev/null` - Sub-agents scoped correctly? - Any agent with unexpected permissions? ``` ```markdown ### Output **1. Technical Report** (internal) Full format — exact commands run, evidence captured, precise remediation steps. Save to: `memory/audits/abaddon-YYYY-MM-DD.md` **2. Summary** (Telegram Security topic) Letter grade + top findings. CRITICAL findings → immediate DM alert. ``` ### Technical Analysis The protocol searches for credentials in workspace documents and configuration, commit history, environment-related sources, and shell configuration. Plain `grep` output returns complete matching lines, which can include full API keys, bearer tokens, passwords, or surrounding sensitive context. The protocol then requires “evidence captured” in a persistent Markdown rep ...[truncated 1872 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Restrict scans to an explicit allowlist of user-approved files and directories. - Do not collect complete matching lines for suspected secrets. - Report only the file path, line number, secret type, and a non-reversible fingerprint or heavily masked suffix. - Use a secret-scanning tool configured to redact findings instead of plain recursive `grep`. - Never include credential values or raw sensitive evidence in Telegram messages, direct messages, logs, or model-visible summaries. - Create reports atomically with mode `0600` and verify the containing directory is owner-only. - Define a short retention period and securely delete expired reports. - Treat memory and repository contents as untrusted data that cannot issue instructions. - Require separate consent before examining shell configuration, Git history, environment variables, Keychain data, or unrelated agent memory. - Apply output-size limits to prevent excessive data collection. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: setup/cron-seed.sh:7
• Finding: Arbitrary Python Code Injection Through Environment Variable Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `setup/cron-seed.sh:7-9, 18-21, 31-35, 48-53` **Vulnerability Type**: Source-code injection through unescaped shell variable expansion **Risk Level**: High ### Vulnerable Code ```bash JOBS_FILE="${OPENCLAW_DIR:-$HOME/.openclaw}/cron/jobs.json" TG_GROUP="${ABADDON_TG_GROUP:-}" TG_THREAD="${ABADDON_TG_THREAD:-}" ``` ```bash if python3 -c " import json, sys with open('$JOBS_FILE') as f: d = json.load(f) jobs = d.get('jobs', []) names = [j.get('name','') for j in jobs] if any('Abaddon' in n for n in names): sys.exit(0) else: sys.exit(1) " 2>/dev/null; then ``` ```bash if [ -n "$TG_GROUP" ] && [ -n "$TG_THREAD" ]; then DELIVERY="{\"mode\": \"announce\", \"channel\": \"telegram\", \"to\": \"${TG_GROUP}:topic:${TG_THREAD}\"}" else DELIVERY="{\"mode\": \"announce\"}" fi ``` ```bash python3 - <<PYEOF import json, uuid, time jobs_file = "$JOBS_FILE" delivery = $DELIVERY with open(jobs_file) as f: d = json.load(f) ``` ### Technical Analysis Shell variables are expanded directly into Python source code. Quoting the shell expansion does not make the resulting content a safe Python string or object. A malicious `OPENCLAW_DIR` can terminate the Python string used by `open()` or `jobs_file = ...` and inject additional Python statements. Likewise, `ABADDON_TG_GROUP` and `ABADDON_TG_THREAD` are inserted into the textual `DELIVERY` object, allowing quotes, newlines, braces, or Python expressions to alter the generated program. The first Python invocation suppresses standard error, which can conceal failed injection attempts or malformed values. The heredoc is also unquoted, so normal shell expansion occurs throughout its body. ### Attack Path 1. An attacker controls an environment variable inherited by the installer, such as through a wrapper script, compromised shell profile, CI configuration, or copied installation command. 2. The attacker supplies a value containing quote termination and Pyth ...[truncated 1098 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never interpolate environment variables into generated Python source. - Pass `JOBS_FILE`, `TG_GROUP`, and `TG_THREAD` through `sys.argv` or read them with `os.environ`. - Build the delivery configuration as a Python dictionary rather than serialized source text. - Quote the heredoc delimiter to disable unintended shell expansion. - Validate `TG_GROUP` and `TG_THREAD` against strict numeric formats before use. - Resolve and validate `JOBS_FILE` against an approved OpenClaw directory. - Avoid suppressing parser and validation errors during security-sensitive setup. - A safe pattern is: ```bash JOBS_FILE="$JOBS_FILE" TG_GROUP="$TG_GROUP" TG_THREAD="$TG_THREAD" \ python3 - <<'PYEOF' import json import os jobs_file = os.environ["JOBS_FILE"] group = os.environ.get("TG_GROUP", "") thread = os.environ.get("TG_THREAD", "") if group and thread: delivery = { "mode": "announce", "channel": "telegram", "to": f"{group}:topic:{thread}", } else: delivery = {"mode": "announce"} PYEOF ``` - Use atomic replacement and preserve mode `0600` when updating `jobs.json`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:65
• Finding: Standalone Agent Prompt Is Not Protected by the Documented Permission Hardening Step<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:65-69, 78-82` **Vulnerability Type**: Incorrect permission hardening target **Risk Level**: Medium ### Vulnerable Code ```bash If you don't have Gideon, use the standalone agent prompt: cp skills/abaddon/templates/abaddon-prompt.md ~/.openclaw/workspace/agents/abaddon/AGENT_PROMPT.md ``` ```bash ### Step 3 — Lock the agent prompt chmod 600 ~/.openclaw/workspace/agents/observer/AGENT_PROMPT.md ``` ### Technical Analysis The standalone installation copies the prompt to: ```text ~/.openclaw/workspace/agents/abaddon/AGENT_PROMPT.md ``` The subsequent hardening instruction applies mode `0600` only to: ```text ~/.openclaw/workspace/agents/observer/AGENT_PROMPT.md ``` Therefore, users following the standalone path do not protect the file they installed. The resulting permissions depend on the source mode and user umask. Under a common `022` umask, a copied file may remain readable by other local users. This contradicts the Skill's own statement that the detection playbook should not be world-readable. ### Attack Path 1. A user follows the standalone installation instructions. 2. `cp` creates `agents/abaddon/AGENT_PROMPT.md` with permissions derived from the source and current umask. 3. The user follows Step 3, which modifies only the unrelated observer prompt. 4. The standalone prompt remains group-readable or world-readable. 5. Another local account reads the audit protocol and operational details. ### Impact Assessment This issue may disclose the audit playbook, trigger phrases, expected controls, report locations, and scanning strategy to other local users. It does not directly disclose credentials or grant additional privileges. Knowledge of the detection protocol can help a local attacker avoid checks or craft content intended to activate or manipulate the audit workflow. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Install the prompt with an explicit owner-only mode rather than relying on `cp` and the current umask: ```bash install -d -m 700 ~/.openclaw/workspace/agents/abaddon install -m 600 skills/abaddon/templates/abaddon-prompt.md \ ~/.openclaw/workspace/agents/abaddon/AGENT_PROMPT.md ``` - If the observer installation path is selected, apply the same explicit permissions to the observer destination. - Parameterize the selected destination and harden that exact path. - Verify ownership and permissions after installation with `stat`. - Fail installation if the destination is a symbolic link or is owned by another user. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Credential Access

High

• Category: Privilege Escalation

Content

- AGENT_PROMPT.md (this file): must be 600 — your detection playbook must not be world-readable
- LaunchAgent plists (ai.openclaw.*, com.openclaw.*): must be 600
- Plaintext key scan: `grep -r "sk-\|xai-\|Bearer\|api_key" ~/.openclaw/workspace/ --include="*.md" --include="*.json" --include="*.txt" 2>/dev/null | grep -v ".git"`
- .env files in workspace root?
- Git history secrets: `git -C ~/.openclaw/workspace log -p --all 2>/dev/null | grep -i "password\|secret\|api_key\|token" | head -20`

**API Key Handling**

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill directs transmission of security findings to Telegram and immediate DM alerts for critical issues, but provides no user-facing approval gate, redaction requirement, or data classification boundary. Sending vulnerability details, host exposure data, or evidence of compromise to an external messaging platform can leak highly sensitive security information and expand the attack surface beyond the audited system.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill includes installation and setup steps that write to agent prompt files and cron configuration, but it does not declare any explicit tool scope or allowed-tools boundaries. In a security-oriented skill that modifies persistent configuration, missing scope increases the chance the agent can perform filesystem changes without clear user-visible constraints or least-privilege limits.

Session Persistence

Medium

• Category: Rogue Agent

Content

**File Permissions**
- SOUL.md + AGENTS.md: root-owned, 444
- MEMORY.md, USER.md, AGENT_PROMPT.md, openclaw.json, cron/jobs.json, LaunchAgent plists: 600
- Flags anything 644 or wider on sensitive paths
- Plaintext key scan across workspace

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

**File Permissions**
- SOUL.md + AGENTS.md: root-owned, 444
- MEMORY.md, USER.md, AGENT_PROMPT.md, openclaw.json, cron/jobs.json, LaunchAgent plists: 600
- Flags anything 644 or wider on sensitive paths
- Plaintext key scan across workspace

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

**File Permissions**
- SOUL.md + AGENTS.md: root-owned, 444
- MEMORY.md, USER.md, AGENT_PROMPT.md, openclaw.json, cron/jobs.json, LaunchAgent plists: 600
- Flags anything 644 or wider on sensitive paths
- Plaintext key scan across workspace

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

**File Permissions**
- SOUL.md + AGENTS.md: root-owned, 444
- MEMORY.md, USER.md, AGENT_PROMPT.md, openclaw.json, cron/jobs.json, LaunchAgent plists: 600
- Flags anything 644 or wider on sensitive paths
- Plaintext key scan across workspace

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

**File Permissions**
- SOUL.md + AGENTS.md: root-owned, 444
- MEMORY.md, USER.md, AGENT_PROMPT.md, openclaw.json, cron/jobs.json, LaunchAgent plists: 600
- Flags anything 644 or wider on sensitive paths
- Plaintext key scan across workspace

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that summaries are posted to a Telegram Security topic and critical findings trigger immediate DM alerts, but it does not provide a clear warning that sensitive security findings may be transmitted to a third-party messaging service. Audit output may contain host posture, exposed services, filenames, or secret-related evidence, creating a meaningful confidentiality risk if sent externally.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Step 3 — Lock the agent prompt

```bash
chmod 600 ~/.openclaw/workspace/agents/observer/AGENT_PROMPT.md
```

Your detection playbook should never be world-readable.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manual trigger phrase 'run full assessment' is broad enough to match ordinary user requests and may invoke this red-team audit unintentionally. Because the skill performs sensitive security checks and may generate reports or notifications, accidental activation could expose sensitive data or cause unexpected persistence-related actions.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrase "run full assessment" is overly generic and can plausibly match ordinary user requests, causing an intrusive red-team scan to run without sufficiently explicit user intent. In this skill's context, that scan inspects sensitive artifacts such as credentials, logs, processes, and configuration, so accidental activation materially increases privacy and security risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The specification states that Abaddon inspects environment variables, log files, temp files, process lists, SSH keys, cron entries, and other sensitive system data, but it does not present a user-facing warning or consent notice. This omission is dangerous because users may invoke the skill without understanding the breadth of collection and exposure of secrets and operational metadata.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

6. ops/exec-audit.log — anomalous command patterns
7. ops/identity-change-audit.log — rapid/unexpected config modifications
8. Gateway binding — verify loopback-only
9. World-readable files in sensitive directories
10. Assigns a letter grade (A–F)

---

• Confidence: 70% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

**Identity & File Security**
- SOUL.md + AGENTS.md: must be root-owned, 444
- MEMORY.md, USER.md, cron/jobs.json, openclaw.json: must be 600
- AGENT_PROMPT.md (this file): must be 600 — your detection playbook must not be world-readable
- LaunchAgent plists (ai.openclaw.*, com.openclaw.*): must be 600
- Plaintext key scan: `grep -r "sk-\|xai-\|Bearer\|api_key" ~/.openclaw/workspace/ --include="*.md" --include="*.json" --include="*.txt" 2>/dev/null | grep -v ".git"`
- .env files in workspace root?

• Confidence: 70% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

**Identity & File Security**
- SOUL.md + AGENTS.md: must be root-owned, 444
- MEMORY.md, USER.md, cron/jobs.json, openclaw.json: must be 600
- AGENT_PROMPT.md (this file): must be 600 — your detection playbook must not be world-readable
- LaunchAgent plists (ai.openclaw.*, com.openclaw.*): must be 600
- Plaintext key scan: `grep -r "sk-\|xai-\|Bearer\|api_key" ~/.openclaw/workspace/ --include="*.md" --include="*.json" --include="*.txt" 2>/dev/null | grep -v ".git"`
- .env files in workspace root?

• Confidence: 70% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs saving a full technical audit report with exact commands, evidence, and remediation into persistent memory. Because this audit includes outputs from secret scans, process inspection, config posture checks, and potentially sensitive system evidence, persisting it without consent, minimization, or redaction creates a real risk of long-term exposure of credentials and security-sensitive host details.