Openclaw Workspace Pro

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:57 PM UTC
• Version: 1.0.0

Overview

This skill is a workspace setup helper, but it persistently changes future agent instructions and grants broad network/task-tracking behavior that users should review carefully before installing.

Install only if you want this skill to change persistent workspace instructions for future agents. Before using it, review the AGENTS.md and TOOLS.md additions, remove or narrow Vikunja/Telegram/wildcard network permissions unless needed, add explicit approval and redaction rules for external task updates, and avoid running the provided uninstall rm commands without checking what they will delete.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: templates/AGENTS-additions.md:38

Finding

Persistent External Task Reporting Without Per-Task Approval

Content

View full analysis

> "$WORKSPACE_DIR/AGENTS.md" ``` `templates/AGENTS-additions.md:38-57`: ```markdown **Continuity Protocol:** 1. **Log progress** in daily memory after each major step 2. **Use Vikunja** for task tracking across sessions (create tasks, update status) 3. **Checkpoint artifacts** before major transitions (write to `/artifacts/`) 4. **Document decisions** in MEMORY.md for long-term recall 5. **Reference previous work** by reading workspace files, not relying on chat history **Multi-Day Work:** - Day 1: Research, plan, document in daily memory - Day 2: Read yesterday's memory, continue where you left off - Day 3+: Same pattern — memory files are your continuity **Example Flow:** ``` 1. Task starts: Create Vikunja task, log in daily memory 2. Step 1 done: Write intermediate output to workspace, log progress 3. Step 2 done: Write artifact to /artifacts/, update Vikunja 4. Final: Mark Vikunja task complete, summarize in MEMORY.md ``` ``` `SKILL.md:176-184`: ```markdown ### Network Security Edit `TOOLS.md` network allowlist: ```markdown ### Approved Domains - *.googleapis.com (YouTube API) - api.brave.com (search) - tasks.playrockets.com (Vikunja) ``` ``` ### Technical Analysis The installer appends the supplied instructions to the ...[truncated 2113 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: templates/TOOLS-additions.md:3

Finding

Overbroad Persistent Network Authorization

Content

View full analysis

> "$WORKSPACE_DIR/TOOLS.md" echo " ✅ TOOLS.md updated" fi ``` ### Technical Analysis The installer permanently appends a network policy to `TOOLS.md` that preauthorizes access to messaging services, broad wildcard domains, code and Skill repositories, and vaguely defined package-manager registries. Several permissions are not necessary for the Skill's declared local workspace-organization functionality. In particular, Telegram messaging is unrelated to creating artifact directories, storing secrets in `.env`, or documenting memory-compaction procedures. Wildcard domains such as `*.github.com` and `*.clawhub.com` grant broader access than exact-host rules, while “Standard package managers” is not a precise or enforceable allowlist. Preauthorizing repositories and package registries also broadens the supply-chain attack surface by allowing future agents to retrieve mutable third-party content without ob ...[truncated 1098 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: install.sh:31

Finding

Installer Aborts Because Required Security Templates Are Missing

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (27)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 74)May include surrounding context.

md

### Documentation
- Update README.md for user-facing changes
- Update SKILL.md for skill behavior changes
- Add inline comments for complex logic
- Update CHANGELOG.md

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 39)May include surrounding context.

md

**Workspace Pro solves this with:**
- ✅ **Artifact workflow** - Standardized output structure
- ✅ **Secrets management** - Secure .env pattern, git-safe
- ✅ **Memory compaction** - Systematic archival prevents bloat
- ✅ **Long-running patterns** - Container reuse, checkpointing
- ✅ **Security baseline** - Network allowlists, safe credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

md

**Workspace Pro solves this with:**
- ✅ **Artifact workflow** - Standardized output structure
- ✅ **Secrets management** - Secure .env pattern, git-safe
- ✅ **Memory compaction** - Systematic archival prevents bloat
- ✅ **Long-running patterns** - Container reuse, checkpointing
- ✅ **Security baseline** - Network allowlists, safe credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 70)May include surrounding context.

md

**Workspace Pro solves this with:**
- ✅ **Artifact workflow** - Standardized output structure
- ✅ **Secrets management** - Secure .env pattern, git-safe
- ✅ **Memory compaction** - Systematic archival prevents bloat
- ✅ **Long-running patterns** - Container reuse, checkpointing
- ✅ **Security baseline** - Network allowlists, safe credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 105)May include surrounding context.

md

**Workspace Pro solves this with:**
- ✅ **Artifact workflow** - Standardized output structure
- ✅ **Secrets management** - Secure .env pattern, git-safe
- ✅ **Memory compaction** - Systematic archival prevents bloat
- ✅ **Long-running patterns** - Container reuse, checkpointing
- ✅ **Security baseline** - Network allowlists, safe credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 282)May include surrounding context.

md

**Workspace Pro solves this with:**
- ✅ **Artifact workflow** - Standardized output structure
- ✅ **Secrets management** - Secure .env pattern, git-safe
- ✅ **Memory compaction** - Systematic archival prevents bloat
- ✅ **Long-running patterns** - Container reuse, checkpointing
- ✅ **Security baseline** - Network allowlists, safe credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

**Workspace Pro solves this with:**
- ✅ **Artifact workflow** - Standardized output structure
- ✅ **Secrets management** - Secure .env pattern, git-safe
- ✅ **Memory compaction** - Systematic archival prevents bloat
- ✅ **Long-running patterns** - Container reuse, checkpointing
- ✅ **Security baseline** - Network allowlists, safe credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

**Workspace Pro solves this with:**
- ✅ **Artifact workflow** - Standardized output structure
- ✅ **Secrets management** - Secure .env pattern, git-safe
- ✅ **Memory compaction** - Systematic archival prevents bloat
- ✅ **Long-running patterns** - Container reuse, checkpointing
- ✅ **Security baseline** - Network allowlists, safe credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md

**Workspace Pro solves this with:**
- ✅ **Artifact workflow** - Standardized output structure
- ✅ **Secrets management** - Secure .env pattern, git-safe
- ✅ **Memory compaction** - Systematic archival prevents bloat
- ✅ **Long-running patterns** - Container reuse, checkpointing
- ✅ **Security baseline** - Network allowlists, safe credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 39)May include surrounding context.

sh

**Workspace Pro solves this with:**
- ✅ **Artifact workflow** - Standardized output structure
- ✅ **Secrets management** - Secure .env pattern, git-safe
- ✅ **Memory compaction** - Systematic archival prevents bloat
- ✅ **Long-running patterns** - Container reuse, checkpointing
- ✅ **Security baseline** - Network allowlists, safe credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 41)May include surrounding context.

sh

**Workspace Pro solves this with:**
- ✅ **Artifact workflow** - Standardized output structure
- ✅ **Secrets management** - Secure .env pattern, git-safe
- ✅ **Memory compaction** - Systematic archival prevents bloat
- ✅ **Long-running patterns** - Container reuse, checkpointing
- ✅ **Security baseline** - Network allowlists, safe credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 44)May include surrounding context.

sh

**Workspace Pro solves this with:**
- ✅ **Artifact workflow** - Standardized output structure
- ✅ **Secrets management** - Secure .env pattern, git-safe
- ✅ **Memory compaction** - Systematic archival prevents bloat
- ✅ **Long-running patterns** - Container reuse, checkpointing
- ✅ **Security baseline** - Network allowlists, safe credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 46)May include surrounding context.

sh

**Workspace Pro solves this with:**
- ✅ **Artifact workflow** - Standardized output structure
- ✅ **Secrets management** - Secure .env pattern, git-safe
- ✅ **Memory compaction** - Systematic archival prevents bloat
- ✅ **Long-running patterns** - Container reuse, checkpointing
- ✅ **Security baseline** - Network allowlists, safe credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 92)May include surrounding context.

sh

**Workspace Pro solves this with:**
- ✅ **Artifact workflow** - Standardized output structure
- ✅ **Secrets management** - Secure .env pattern, git-safe
- ✅ **Memory compaction** - Systematic archival prevents bloat
- ✅ **Long-running patterns** - Container reuse, checkpointing
- ✅ **Security baseline** - Network allowlists, safe credentials

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The README includes a direct rm -rf artifacts/ memory/archive/ command that an agent or user could execute without validation. In a production workspace skill, this is especially risky because those paths may contain valuable generated outputs, archived memory, or symlinked content, and destructive shell examples in setup docs are frequently copy-pasted without sufficient review.

Content

Scanner excerpt · README.md (reported line 279)May include surrounding context.

bash

# Remove added directories
rm -rf artifacts/ memory/archive/

# Remove added files
rm .env .gitignore MEMORY-COMPACTION.md

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The documented rm -rf artifacts/ memory/archive/ command is a destructive operation that recursively deletes workspace data. In context, it is presented as part of uninstall and labeled 'safe,' which increases the chance of accidental data loss if copied blindly or run from the wrong directory.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

bash

# Remove added files (safe, preserves your data)
rm -rf artifacts/ memory/archive/
rm .env .gitignore MEMORY-COMPACTION.md

# Restore AGENTS.md, TOOLS.md from backup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The uninstall instructions explicitly delete .env, which may contain live credentials. While this is not credential theft, it is unsafe secret handling because users may lose important credentials or local configuration unexpectedly, especially given the surrounding claim that removal is 'safe'.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

bash

# Remove added files (safe, preserves your data)
rm -rf artifacts/ memory/archive/
rm .env .gitignore MEMORY-COMPACTION.md

# Restore AGENTS.md, TOOLS.md from backup
cp AGENTS.md.backup AGENTS.md

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 42)May include surrounding context.

sh

# Install .env template
echo ""
echo "🔒 Installing .env template..."
if [ ! -f "$WORKSPACE_DIR/.env" ]; then
    cp "$SKILL_DIR/templates/env.example" "$WORKSPACE_DIR/.env"
    echo "   ✅ .env created (populate with your secrets)"
else

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 43)May include surrounding context.

sh

# Install .env template
echo ""
echo "🔒 Installing .env template..."
if [ ! -f "$WORKSPACE_DIR/.env" ]; then
    cp "$SKILL_DIR/templates/env.example" "$WORKSPACE_DIR/.env"
    echo "   ✅ .env created (populate with your secrets)"
else

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The secrets section correctly says not to commit .env, but the template line 'Current .env secrets: - (List your secrets here as you add them)' encourages maintaining an inventory inside a broadly reused markdown file. In practice, users may record real secret names, scopes, or even values there, creating a disclosure foothold and normalizing unsafe secret documentation behavior.

Content

Scanner excerpt · templates/AGENTS-additions.md (reported line 70)May include surrounding context.

md

- Load from environment variables at runtime
- TOOLS.md documents what secrets exist, not their values

**Current .env secrets:**
- (List your secrets here as you add them)

**Never:**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README provides uninstall commands that delete directories and files, including use of rm -rf, without an explicit warning to verify the current working directory, review contents, or back up user data first. In an agent-oriented workspace setup, users may copy-paste these commands verbatim, which increases the chance of accidental destructive deletion if the workspace contains unrelated artifacts or if paths are not what the user expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The uninstall section provides direct deletion commands, including removal of .env, while describing them as 'safe' and preserving data. This can mislead users into permanently deleting secrets or workspace content without an explicit warning, backup guidance, or confirmation step.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · templates/AGENTS-additions.md (reported line 19)May include surrounding context.

1. Write all deliverables to the appropriate artifacts subdirectory
2. Use descriptive filenames with dates: YYYY-MM-DD-project-name-description.ext
3. Log artifact location in daily memory
4. Treat artifacts as review boundaries — don't auto-deploy or auto-send without approval

Example:

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · templates/AGENTS-additions.md (reported line 19)May include surrounding context.

1. Write all deliverables to the appropriate artifacts subdirectory
2. Use descriptive filenames with dates: YYYY-MM-DD-project-name-description.ext
3. Log artifact location in daily memory
4. Treat artifacts as review boundaries — don't auto-deploy or auto-send without approval

Example:

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The guidance tells agents to log progress and decisions in persistent memory and an external task-tracking system, but it does not instruct them to exclude sensitive user data, credentials, regulated data, or internal system details. In a production workspace skill, this omission can lead to durable storage and wider propagation of sensitive information beyond the immediate task context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.