Ops Skills Pack

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:00 PM UTC
• Version: 1.0.0

Overview

This skill pack is not clearly malicious, but it deserves review because it promotes unattended scheduled agent work with persistent memory and logs.

Install only if you intentionally want an agent that can resume work unattended. Before enabling cron jobs, start with dry runs, restrict writable directories and external integrations, require approval for dependency installs, deployments, destructive commands, credentials, and production changes, and keep USER.md, MEMORY.md, STATE.md, Todo.md, and progress-log.md free of secrets or private raw logs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (58)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The instruction to record session IDs in progress-log.md can leak internal correlation identifiers or other sensitive operational context into persistent project files. If logs are shared, committed, or exposed to other tools, this creates unnecessary metadata disclosure and may aid cross-session tracking or debugging-data leakage.

Content

Scanner excerpt · skills/cron-orchestration.md (reported line 250)May include surrounding context.

md

integration:
  wake_logging:
    - "Log cron wake in progress-log.md"
    - "Record session ID"
    - "Note tasks picked up"
    - "Document work performed"

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · skills/cron-orchestration.md (reported line 255)May include surrounding context.

• "Document work performed"

  sleep_logging:

  • "Log session end in progress-log.md"
  • "Record tasks in progress"
  • "Note session state for recovery"

text

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The instruction to capture extensive context around an error contributes to context leakage risk because the surrounding operational context may include sensitive prompts, user data, credentials, or proprietary workflow details. In this file, that instruction is paired with broad logging and escalation guidance, making over-collection more dangerous than it would be in a tightly scoped debugging policy.

Content

Scanner excerpt · skills/error-recovery.md (reported line 109)May include surrounding context.

md

2: "Capture full error message"
    3: "Capture stack trace (if applicable)"
    4: "Capture system state"
    5: "Capture context (what was being attempted)"

  required_information:
    - "Error type and code"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/security-hardening.md (reported line 135)May include surrounding context.

md

forbidden:
    - "~/.ssh/"
    - "~/.aws/credentials"
    - "~/.gnupg/"
    - "*.key"
    - "*.pem"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/security-hardening.md (reported line 166)May include surrounding context.

md

forbidden:
      - "rm -rf"
      - "chmod 777"
      - "curl | bash"
      - "wget | sh"
      - "sudo **"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · skills/security-hardening.md (reported line 167)May include surrounding context.

md

forbidden:
      - "rm -rf"
      - "chmod 777"
      - "curl | bash"
      - "wget | sh"
      - "sudo **"
      - "eval **"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · skills/security-hardening.md (reported line 168)May include surrounding context.

md

- "rm -rf"
      - "chmod 777"
      - "curl | bash"
      - "wget | sh"
      - "sudo **"
      - "eval **"

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The cron integration section provides concrete commands to schedule overnight autonomous runs at 2am, 4am, and 6am without clearly warning that the agent will continue acting unattended on a timer. Scheduled autonomous execution materially increases risk because mistakes, destructive actions, or unintended side effects can recur and compound while the user is absent.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · skills/security-hardening.md (reported line 406)May include surrounding context.

Continuous Improvement

• Weekly review of LESSONS.md
• Identify patterns
• Update skills accordingly

text

---

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · templates/workspace-setup.md (reported line 316)May include surrounding context.

Continuous Improvement

• Weekly review of LESSONS.md
• Identify patterns
• Update skills accordingly

text

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly recommends setting up unattended overnight cron-driven agent execution to continue work autonomously, but it does not pair that guidance with clear safeguards, approval boundaries, or warnings about unsupervised file/system modification risk. In the context of an agent skill pack promoting self-expanding tasks, persistent memory, and production operations, this materially increases the chance of unintended destructive changes, runaway actions, or unsafe persistence mechanisms being executed while no human is monitoring.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explicitly promotes unattended overnight autonomous operation ('work while you sleep') but does not pair that capability with prominent warnings about the risks of unsupervised code execution, file modification, dependency changes, or external actions. In a skill pack that is meant to shape agent behavior, normalizing autonomous background work without guardrails materially increases the chance of destructive or unauthorized changes occurring while the user is absent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The workspace setup creates persistent state files such as USER.md, MEMORY.md, Todo.md, progress-log.md, and SOUL.md that are intended to survive across sessions and influence future agent behavior. Persistent memory is not inherently malicious, but in the context of autonomous operations it increases risk because stale, sensitive, or attacker-influenced content can be reused later without fresh user review.

Content

Scanner excerpt · FEATURES.md (reported line 418)May include surrounding context.

md

# Copy workspace templates
cp templates/workspace-setup.md ~/.openclaw/workspace/

# Create individual workspace files
cd ~/.openclaw/workspace

# Create and edit USER.md

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The cron setup section provides ready-to-run scheduled jobs that will wake the agent and continue working automatically, yet it omits a clear safety warning that these jobs may cause the agent to make changes while the user is away. Because the examples explicitly instruct the agent to resume incomplete tasks and continue processing Todo.md, they create a substantial risk of unattended modifications, especially when paired with the rest of the pack's autonomy features.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · QUICKSTART.md (reported line 26)May include surrounding context.

md

# Copy templates
cp /path/to/openclaw-ops-skills/templates/workspace-setup.md .

# Extract and create individual files
# (Create USER.md, MEMORY.md, Todo.md, progress-log.md, SOUL.md)

# Example: Create USER.md

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide explicitly instructs users to schedule unattended overnight autonomous agent runs that can continue tasks and update workspace artifacts without any safety gating, approval step, sandboxing guidance, or monitoring warning. In the context of an agent skill quickstart, this increases the chance of unintended file changes, runaway task execution, or unsafe actions being performed while the user is absent.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · QUICKSTART.md (reported line 151)May include surrounding context.

Skills not loading

bash

# Check skills directory
ls -la ~/.openclaw/workspace/skills/

# Verify file permissions
chmod 644 ~/.openclaw/workspace/skills/*.md

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · QUICKSTART.md (reported line 154)May include surrounding context.

md

ls -la ~/.openclaw/workspace/skills/

# Verify file permissions
chmod 644 ~/.openclaw/workspace/skills/*.md

# Restart OpenClaw
openclaw restart

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 53)May include surrounding context.

md

| Skill | Purpose | Priority |
|-------|---------|----------|
| `memory-persistence.md` | Maintain state across sessions | ⭐⭐ |
| `cron-orchestration.md` | Scheduled task management | ⭐⭐ |
| `error-recovery.md` | Graceful failure handling | ⭐⭐ |
| `security-hardening.md` | Security best practices | ⭐⭐⭐ |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README recommends running auto-remediation commands such as openclaw doctor --deep --fix --yes and openclaw security audit --fix without any warning, dry-run guidance, or explanation of what will be changed. In an agent-operations skill pack, this is risky because users or autonomous agents may execute these commands verbatim, potentially causing unintended configuration changes, service disruption, or masking underlying issues through blind auto-fixes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The quick-start section explicitly instructs users to create a cron job that tells the agent to continue work unattended overnight, but it provides no warning about the risks of autonomous execution, unintended changes, or required safeguards. In an operations-focused skill pack that promotes 'true autonomy' and overnight continuation of work, this omission materially increases the chance of unsafe deployment and unauthorized or destructive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly promotes unattended overnight operation that resumes work, edits files like Todo.md/progress-log.md/STATE.md, and runs maintenance actions without an upfront warning about system or data impact. In an agent-skill context, encouraging persistent scheduled execution materially increases the chance of unintended file changes, resource consumption, and unsafe autonomous actions while the user is absent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes a general-purpose workflow skill but does not specify concrete invocation phrases, boundaries, or negative examples for when the skill should or should not activate. Phrases like enforcing a reconnaissance phase before any code changes could overlap with many ordinary coding tasks, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skills/docs-first.md (reported line 259)May include surrounding context.

❌ WITHOUT Docs-First (What Agents Do)

text

"I'll add JWT authentication. Let me create a new auth module
with custom token handling... [builds from scratch]"

Result: 500 lines of code, reinvents wheel, breaks existing patterns

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs capturing full input data and full system state during error handling without any guidance to redact secrets, tokens, personal data, or other sensitive context. In an agent setting, error logs are often persisted or escalated, so this can unintentionally expose confidential data far beyond what is needed for debugging.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: skills/testing-protocol.md:296