ClawHub
Back to skill

Security audit

Agent Batch Guard

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent guidance-only skill for keeping large agent batch tasks from overloading the session, with some privacy and configuration cautions but no hidden execution or exfiltration behavior.

Install only if you want persistent batch-task guidance for agents. Before using the ADB or scraping examples, confirm authorization, choose a protected output directory, avoid collecting unnecessary personal fields, delete temporary UI dumps and old archives, and verify OpenClaw configuration options against your installed version.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The guidance repeatedly instructs agents to write scraped output and progress data to disk, but it does not warn that these files may contain personal or otherwise sensitive data. In the context of order-history scraping, local artifacts such as JSON batches and progress metadata can expose private records, persist longer than intended, and be read by other users or processes on the system.

Skill Enumeration

Medium
Category
Agent Snooping
Content
**禁止**在对话中逐页循环。

详细批处理模式请读取：
~/.openclaw/skills/agent-batch-guard/SKILL.md

### 快速规则
1. 超过 5 页的翻页操作 → 写脚本，不在对话里循环
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The ADB scraping example pulls UI dumps from a connected device and archives extracted order data, yet it provides no warning about device-data sensitivity, consent, or local retention risks. Because mobile UI dumps and order histories can contain names, addresses, account details, or purchase records, the omission makes accidental overcollection and insecure storage more likely.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The checklist tells users to set `compaction` to `rolling + maxTurns ≤ 40`, but the earlier text explicitly states OpenClaw currently supports only `"safeguard"`. This contradiction can cause failed or ignored configuration, leaving operators with a false sense of protection and potentially worsening reliability during large batch tasks.

Static analysis

No suspicious patterns detected.