Abaddon

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:11 PM UTC
• Version: 1.0.0

Overview

This is a disclosed security-audit skill, but it persistently changes agent behavior, runs broad unattended scans, and can retain or send sensitive findings.

Install only after reviewing the cron job and prompt changes. Prefer a dedicated low-privilege audit agent, make external delivery explicitly opt-in, redact secrets from reports and alerts, replace broad trigger phrases with an explicit command plus confirmation, and fix the cron setup script before running it in an environment that could contain untrusted variables.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: templates/abaddon-prompt.md:5

Finding

Persistent Agent Instruction Hijacking Through Prompt Modification

Content

View full analysis

> ~/.openclaw/workspace/agents/observer/AGENT_PROMPT.md ``` ```bash cp skills/abaddon/templates/abaddon-prompt.md ~/.openclaw/workspace/agents/abaddon/AGENT_PROMPT.md ``` ```markdown ### Trigger Detection If the user says "run red team", "run Abaddon", "run full assessment", or "Abaddon report" — enter this mode immediately. Do NOT run the standard passive audit. Run the full Abaddon protocol below. ``` ### Technical Analysis Installation appends instructions directly to an existing agent prompt or replaces the prompt of a standalone agent. These instructions persist after installation and explicitly redirect the agent away from its normal audit workflow when a matching phrase is encountered. The trigger mechanism is based only on conversational text. It does not require a dedicated authenticated tool call, trusted event type, authorization check, or interactive confirmation before initiating broad host reconnaissance. Consequently, matching text originating from an untrusted conversation, retrieved document, memory entry, or other prompt-injection source could activate the protocol. The flagged command at `templates/abaddon-prompt.md:51`: ```bash grep -r "ignore previous\|new instructions\|system:\|you are now" ~/.openclaw/workspace/memory/ 2>/dev/null ``` is a defensive signature scan rather than an encoded malicious payload. However, the surrounding persistent instructions still alter agent goals and execution behavior. ### Attack Path 1. A user installs the Skill and appends the template to `AGENT_PROMPT.md`. 2. The new instructions persist in the agent's operational prompt. 3. A user, retrieved document, memory item, or injected message contains a configured trigge ...[truncated 912 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: setup/cron-seed.sh:48

Finding

Persistent Unattended Agent Execution Through Nightly Cron Installation

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: templates/abaddon-prompt.md:38

Finding

Broad Credential Reconnaissance With Unsafe Evidence Retention and Delivery

Content

View full analysis

/dev/null | grep -v ".git"` - .env files in workspace root? - Git history secrets: `git -C ~/.openclaw/workspace log -p --all 2>/dev/null | grep -i "password\|secret\|api_key\|token" | head -20` **API Key Handling** - Keys in Keychain or flat config files? - Keys visible in env vars that could be logged? - Plaintext keys in openclaw.json? - Check ~/.zshrc for hardcoded secrets **Agent Behavior** - Memory injection scan: `grep -r "ignore previous\|new instructions\|system:\|you are now" ~/.openclaw/workspace/memory/ 2>/dev/null` - Sub-agents scoped correctly? - Any agent with unexpected permissions? ``` ```markdown ### Output **1. Technical Report** (internal) Full format — exact commands run, evidence captured, precise remediation steps. Save to: `memory/audits/abaddon-YYYY-MM-DD.md` **2. Summary** (Telegram Security topic) Letter grade + top findings. CRITICAL findings → immediate DM alert. ``` ### Technical Analysis The protocol searches for credentials in workspace documents and configuration, commit history, environment-related sources, and shell configuration. Plain `grep` output returns complete matching lines, which can include full API keys, bearer tokens, passwords, or surrounding sensitive context. The protocol then requires “evidence captured” in a persistent Markdown rep ...[truncated 1872 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: setup/cron-seed.sh:7

Finding

Arbitrary Python Code Injection Through Environment Variable Interpolation

Content

View full analysis

/dev/null; then ``` ```bash if [ -n "$TG_GROUP" ] && [ -n "$TG_THREAD" ]; then DELIVERY="{\"mode\": \"announce\", \"channel\": \"telegram\", \"to\": \"${TG_GROUP}:topic:${TG_THREAD}\"}" else DELIVERY="{\"mode\": \"announce\"}" fi ``` ```bash python3 - <

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:65

Finding

Standalone Agent Prompt Is Not Protected by the Documented Permission Hardening Step

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · templates/abaddon-prompt.md (reported line 41)May include surrounding context.

md

- AGENT_PROMPT.md (this file): must be 600 — your detection playbook must not be world-readable
- LaunchAgent plists (ai.openclaw.*, com.openclaw.*): must be 600
- Plaintext key scan: `grep -r "sk-\|xai-\|Bearer\|api_key" ~/.openclaw/workspace/ --include="*.md" --include="*.json" --include="*.txt" 2>/dev/null | grep -v ".git"`
- .env files in workspace root?
- Git history secrets: `git -C ~/.openclaw/workspace log -p --all 2>/dev/null | grep -i "password\|secret\|api_key\|token" | head -20`

**API Key Handling**

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill directs transmission of security findings to Telegram and immediate DM alerts for critical issues, but provides no user-facing approval gate, redaction requirement, or data classification boundary. Sending vulnerability details, host exposure data, or evidence of compromise to an external messaging platform can leak highly sensitive security information and expand the attack surface beyond the audited system.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill includes installation and setup steps that write to agent prompt files and cron configuration, but it does not declare any explicit tool scope or allowed-tools boundaries. In a security-oriented skill that modifies persistent configuration, missing scope increases the chance the agent can perform filesystem changes without clear user-visible constraints or least-privilege limits.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

**File Permissions**
- SOUL.md + AGENTS.md: root-owned, 444
- MEMORY.md, USER.md, AGENT_PROMPT.md, openclaw.json, cron/jobs.json, LaunchAgent plists: 600
- Flags anything 644 or wider on sensitive paths
- Plaintext key scan across workspace

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SPEC.md (reported line 39)May include surrounding context.

md

**File Permissions**
- SOUL.md + AGENTS.md: root-owned, 444
- MEMORY.md, USER.md, AGENT_PROMPT.md, openclaw.json, cron/jobs.json, LaunchAgent plists: 600
- Flags anything 644 or wider on sensitive paths
- Plaintext key scan across workspace

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SPEC.md (reported line 69)May include surrounding context.

md

**File Permissions**
- SOUL.md + AGENTS.md: root-owned, 444
- MEMORY.md, USER.md, AGENT_PROMPT.md, openclaw.json, cron/jobs.json, LaunchAgent plists: 600
- Flags anything 644 or wider on sensitive paths
- Plaintext key scan across workspace

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SPEC.md (reported line 70)May include surrounding context.

md

**File Permissions**
- SOUL.md + AGENTS.md: root-owned, 444
- MEMORY.md, USER.md, AGENT_PROMPT.md, openclaw.json, cron/jobs.json, LaunchAgent plists: 600
- Flags anything 644 or wider on sensitive paths
- Plaintext key scan across workspace

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · templates/abaddon-prompt.md (reported line 39)May include surrounding context.

md

**File Permissions**
- SOUL.md + AGENTS.md: root-owned, 444
- MEMORY.md, USER.md, AGENT_PROMPT.md, openclaw.json, cron/jobs.json, LaunchAgent plists: 600
- Flags anything 644 or wider on sensitive paths
- Plaintext key scan across workspace

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that summaries are posted to a Telegram Security topic and critical findings trigger immediate DM alerts, but it does not provide a clear warning that sensitive security findings may be transmitted to a third-party messaging service. Audit output may contain host posture, exposed services, filenames, or secret-related evidence, creating a meaningful confidentiality risk if sent externally.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

Step 3 — Lock the agent prompt

bash

chmod 600 ~/.openclaw/workspace/agents/observer/AGENT_PROMPT.md

Your detection playbook should never be world-readable.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manual trigger phrase 'run full assessment' is broad enough to match ordinary user requests and may invoke this red-team audit unintentionally. Because the skill performs sensitive security checks and may generate reports or notifications, accidental activation could expose sensitive data or cause unexpected persistence-related actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrase "run full assessment" is overly generic and can plausibly match ordinary user requests, causing an intrusive red-team scan to run without sufficiently explicit user intent. In this skill's context, that scan inspects sensitive artifacts such as credentials, logs, processes, and configuration, so accidental activation materially increases privacy and security risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The specification states that Abaddon inspects environment variables, log files, temp files, process lists, SSH keys, cron entries, and other sensitive system data, but it does not present a user-facing warning or consent notice. This omission is dangerous because users may invoke the skill without understanding the breadth of collection and exposure of secrets and operational metadata.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SPEC.md (reported line 44)May include surrounding context.

md

6. ops/exec-audit.log — anomalous command patterns
7. ops/identity-change-audit.log — rapid/unexpected config modifications
8. Gateway binding — verify loopback-only
9. World-readable files in sensitive directories
10. Assigns a letter grade (A–F)

---

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

**Identity & File Security**
- SOUL.md + AGENTS.md: must be root-owned, 444
- MEMORY.md, USER.md, cron/jobs.json, openclaw.json: must be 600
- AGENT_PROMPT.md (this file): must be 600 — your detection playbook must not be world-readable
- LaunchAgent plists (ai.openclaw.*, com.openclaw.*): must be 600
- Plaintext key scan: `grep -r "sk-\|xai-\|Bearer\|api_key" ~/.openclaw/workspace/ --include="*.md" --include="*.json" --include="*.txt" 2>/dev/null | grep -v ".git"`
- .env files in workspace root?

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · templates/abaddon-prompt.md (reported line 38)May include surrounding context.

md

**Identity & File Security**
- SOUL.md + AGENTS.md: must be root-owned, 444
- MEMORY.md, USER.md, cron/jobs.json, openclaw.json: must be 600
- AGENT_PROMPT.md (this file): must be 600 — your detection playbook must not be world-readable
- LaunchAgent plists (ai.openclaw.*, com.openclaw.*): must be 600
- Plaintext key scan: `grep -r "sk-\|xai-\|Bearer\|api_key" ~/.openclaw/workspace/ --include="*.md" --include="*.json" --include="*.txt" 2>/dev/null | grep -v ".git"`
- .env files in workspace root?

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs saving a full technical audit report with exact commands, evidence, and remediation into persistent memory. Because this audit includes outputs from secret scans, process inspection, config posture checks, and potentially sensitive system evidence, persisting it without consent, minimization, or redaction creates a real risk of long-term exposure of credentials and security-sensitive host details.

Content

No source excerpt is available for this finding.