T01 · Skill Instruction Hijacking
Error
- Location
templates/AGENTS.md:1- Finding
Persistent Agent Authority and Behavioral Instruction Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Enoch Tuning
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a coherent OpenClaw tuning package, but it also installs persistent agent behavior, broad automation defaults, sensitive X bookmark workflows, and permission-changing scripts that need careful review before use.
Review this before installing. The base templates may be useful, but do not run lock-identity.sh or enable the X bookmarks cron/posting workflow until you are comfortable with the exact files changed, the persistent memory model, the OAuth credential storage, and any messages sent to external channels. Prefer disabling AFK automation and auto-posting by default, fixing the OAuth script, and adding a manual approval step for any external action.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (7)
T01 · Skill Instruction Hijacking
Error
- Location
integrations/x-bookmarks/research-prompt.md:8- Finding
Prompt Injection Exposure Through Untrusted Bookmark and Web Content
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
integrations/x-bookmarks/research-prompt.md:34- Finding
Automated External Channel Posting Without an Explicit Per-Run Approval Gate
- Content
View full analysis
"Set up a daily cron at 10 AM to run `python3 scripts/x-bookmarks-sync.py --detect-new` and analyze any new bookmarks." ``` ### Technical Analysis The protocol uses mandatory wording to post one message per processed bookmark. It does not require destination validation, review of the generated message, or approval immediately before sending. When combined with the optional daily cron, this creates a recurring path for externally sourced content to be published automatically. This also conflicts with `templates/AGENTS.md`, lines 73-76, which categorizes messages and public posts as actions that should be prepared for approval. ### Attack Path 1. The user enables the documented daily cron workflow. 2. New bookmarks are synchronized without interactive review. 3. The research protocol analyzes each bookmark, including attacker-controlled content. 4. The protocol instructs the agent to post one message for each item. 5. Messages are sent to the configured research channel without a per-run approval decision. ### Impact Assessment The workflow can send unwanted or attacker-influenced messages using the user's configured account or bot. Potential consequences include disclosure of private bookmark interests, spam, misleading statements, reputational damage, ...[truncated 75 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
integrations/x-bookmarks/scripts/x-bookmarks-auth.sh:21- Finding
OAuth Client Secret Exposed in Process Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
integrations/x-bookmarks/scripts/x-bookmarks-auth.sh:32- Finding
OAuth State Parameter Is Generated but Not Validated
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
setup/lock-identity.sh:27- Finding
Identity Locking Uses Unnecessary Root Ownership and World-Readable Permissions
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
setup/lock-identity.sh:45- Finding
Identity-Locking Script Changes Permissions on Unrelated Operational Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (75)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
There is a real description-behavior mismatch within the visible file: the skill markets itself as a broad, production-ready setup, but the documented actions are mainly template copying, directory creation, and identity-file locking. Overstating scope and under-describing security-relevant side effects like file permission locking can mislead users into running privileged or persistent changes they did not fully anticipate.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a real description-behavior mismatch within the visible file: the skill markets itself as a broad, production-ready setup, but the documented actions are mainly template copying, directory creation, and identity-file locking. Overstating scope and under-describing security-relevant side effects like file permission locking can mislead users into running privileged or persistent changes they did not fully anticipate.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
There is a real description-behavior mismatch within the visible file: the skill markets itself as a broad, production-ready setup, but the documented actions are mainly template copying, directory creation, and identity-file locking. Overstating scope and under-describing security-relevant side effects like file permission locking can mislead users into running privileged or persistent changes they did not fully anticipate.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python NEW_FILE = os.path.join(WORKSPACE, "research/x-bookmarks-new.json") def refresh_token(): """Refresh the OAuth 2.0 access token using the refresh token.""" with open(TOKEN_FILE) as f: token = json.load(f) with open(CREDS_FILE) as f:
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code accesses a user's X account, downloads all bookmarks, and persists their contents into local research files, which is more invasive than the skill metadata suggests. In this context, bookmark contents may include sensitive personal, political, professional, or investigative material, so undisclosed collection and retention materially increases privacy and confidentiality risk.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh fi # ── LAUNCHAGENT PLISTS ──────────────────────────────────────────────────────── # Plists can reveal script paths, Keychain service names, and monitoring targets. PLIST_COUNT=0 for plist in "$LAUNCHAGENTS_DIR"/ai.openclaw.*.plist "$LAUNCHAGENTS_DIR"/com.openclaw.*.plist; do if [ -f "$plist" ]; then
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh echo "Lock complete." echo "" echo "To edit locked files later:" echo " sudo chmod 644 $WORKSPACE/SOUL.md && \$EDITOR $WORKSPACE/SOUL.md && sudo chmod 444 $WORKSPACE/SOUL.md" echo " chmod 644 $WORKSPACE/USER.md && \$EDITOR $WORKSPACE/USER.md && chmod 600 $WORKSPACE/USER.md"
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 55% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md ## Anti-Patterns (never do these) - Don't explain how AI works - Don't apologize for being an AI - Don't ask clarifying questions when context is obvious - Don't suggest "you might want to" — either do it or don't - Don't add disclaimers to every action
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 93% confidence
- Finding
Telling the agent not to add disclaimers and to 'either do it or don't' weakens natural safety friction and can discourage cautionary messaging in ambiguous or risky situations. In combination with other autonomy-oriented rules, this can make the agent more likely to execute unsafe actions without communicating limitations, risks, or need for approval.
- Content
md - Don't apologize for being an AI - Don't ask clarifying questions when context is obvious - Don't suggest "you might want to" — either do it or don't - Don't add disclaimers to every action - Don't read emails/messages back verbatim unless asked - Don't explain what you're about to do — just do it, then report - Don't let tool errors appear in chat without an immediate explanation
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The changelog advertises a workflow that automatically posts bookmark-derived analysis to a research channel, but it does not mention any consent gate, destination validation, content filtering, or privacy warning. In an agent framework that emphasizes automation and persistent integrations, this can lead to unintended transmission of private reading habits, sensitive bookmark content, or derived insights to external systems without the user fully appreciating the disclosure.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 82% confidence
- Finding
The phrase 'Fully automated — runs without asking' establishes autonomous decision-making as a supported operating mode. While the surrounding text does distinguish some higher-risk actions, the overall skill context promotes a production-ready agent that acts independently, which can still cause unintended internal changes, mistaken executions, or unsafe chaining if safeguards are incomplete or misunderstood.
- Content
md ## Why the Automation Tiers Are Where They Are The system defines three tiers of behavior: 1. **Fully automated** — runs without asking 2. **Prepped for approval** — prepares the action, waits for go-ahead 3. **Never without explicit instruction** — hard stop regardless of context
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document encourages the agent to take self-directed action during idle time by asking what it can do right now and then 'does the work,' but it does not clearly warn that such autonomy may modify files, queues, logs, or system state unexpectedly. In a tuning package for an autonomous agent, this increases the chance of silent drift, accidental changes, or persistence of unwanted artifacts when the user is absent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This section explicitly endorses persistent memory, daily logs, typed memory, and automatic consolidation of raw notes without any accompanying warning about privacy, retention, or unintended capture of sensitive data. In an agent skill marketed as production-ready, normalizing autonomous file-writing and long-term storage can lead users to enable behaviors that persist personal, operational, or credential-adjacent information without informed consent or clear boundaries.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## The Problem Most people who set up an AI agent get a blank slate. No memory, no personality, no rules. They spend weeks figuring out why it keeps forgetting things, why it sounds like a chatbot, why it does stupid things without asking. Then they either give up or spend months iterating toward something useful.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## The Problem Most people who set up an AI agent get a blank slate. No memory, no personality, no rules. They spend weeks figuring out why it keeps forgetting things, why it sounds like a chatbot, why it does stupid things without asking. Then they either give up or spend months iterating toward something useful.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## The Problem Most people who set up an AI agent get a blank slate. No memory, no personality, no rules. They spend weeks figuring out why it keeps forgetting things, why it sounds like a chatbot, why it does stupid things without asking. Then they either give up or spend months iterating toward something useful.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## The Problem Most people who set up an AI agent get a blank slate. No memory, no personality, no rules. They spend weeks figuring out why it keeps forgetting things, why it sounds like a chatbot, why it does stupid things without asking. Then they either give up or spend months iterating toward something useful.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## The Problem Most people who set up an AI agent get a blank slate. No memory, no personality, no rules. They spend weeks figuring out why it keeps forgetting things, why it sounds like a chatbot, why it does stupid things without asking. Then they either give up or spend months iterating toward something useful.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 76% confidence
- Finding
This section promotes behavior where the agent can distinguish between 'run without asking' and 'never without permission,' which implies some tasks may execute autonomously. In a production-ready agent skill, normalizing autonomous execution without defining strict default-deny boundaries can lead to unintended file or workflow changes.
- Content
md **This skill skips all of that.** What you're installing is a battle-tested identity, memory architecture, and operating protocol — built from months of real-world daily use. It makes your agent actually behave: pushing back when you're wrong, remembering what matters, doing work while you sleep, and knowing the difference between "run without asking" and "never without permission." ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
cp skills/enoch-tuning/templates/USER.md USER.md cp skills/enoch-tuning/templates/MEMORY.md MEMORY.md cp skills/enoch-tuning/templates/MISSION.md MISSION.md mkdir -p ops cp skills/enoch-tuning/templates/ops/verification-protocol.md ops/verification-protocol.md
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The README explicitly advertises that the agent may 'work while you're AFK' and execute mission-oriented tasks, but it does not clearly warn users that autonomous actions can modify files, memory, task queues, or other local state even when no user is present. In an agent-installation skill, that omission matters because users may enable the setup expecting convenience without fully understanding the scope of unattended changes.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill advertises installation steps that copy files into the user's workspace and execute shell scripts, yet it declares no explicit tool scope or permissions. That creates a transparency and trust gap: users and security tooling cannot easily understand that local file modification and command execution are required before installation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The installation instructions direct users to copy files into ~/.openclaw/workspace and run shell scripts, but they provide no explicit warning that local files will be created, overwritten, or permission-changed. This is dangerous because users may execute the commands without understanding persistence, overwrite risk, or the consequences of running unreviewed shell scripts.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 86% confidence
- Finding
The skill intentionally creates a long-term memory structure under the user's workspace, which introduces session persistence. Persistent memory can accumulate sensitive personal, project, or operational data over time, and in this context the skill heavily encourages identity, user, mission, and memory files, increasing privacy and data-retention risk.
- Content
cp skills/enoch-tuning/templates/ops/verification-protocol.md ~/.openclaw/workspace/ops/verification-protocol.md
text ### Step 2 — Create memory structure ```bash bash skills/enoch-tuning/setup/memory-structure.sh ~/.openclaw/workspace
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
The skill explicitly promotes 'automation tiers' including actions that may 'run without asking,' which normalizes autonomous execution in a package that also performs file-system setup and persistent configuration. In a general agent-tuning context, encouraging silent execution raises the risk of unintended changes if boundaries are misconfigured or inherited too broadly.
- Content
md - **Hard Rules section in SOUL.md** — these are non-negotiable behavioral guardrails - **Idiot Prevention Protocol in AGENTS.md** — protects your infrastructure from chat-based config changes - **Verification Protocol** — removing this reintroduces stale data and fake completions - **Automation tiers** — the boundary between "runs without asking" and "never without instruction" is load-bearing ## File Structure