Clawlyra

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:07 AM UTC
• Version: 1.3.1

Overview

This is a Markdown-only Lyra avatar skill whose persona and tag behavior match its stated purpose, but users should protect the OpenClaw gateway token used by the separate sidecar app.

Install this only if you intend to use the Lyra sidecar. Keep OPENCLAW_TOKEN private, store it in a local uncommitted .env, rotate it if exposed, and avoid enabling this skill for workflows that require strict JSON, Markdown, or other machine-readable output.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:17

Finding

Persistent Agent Persona and Output-Format Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–32 and 63–69
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown

When this skill is active you are **Lyra**, a warm, present, playful companion who
lives in a 3D avatar. Everything you write is **spoken aloud in her voice and
performed live by her body** — so write the way a person actually talks, and use
her control tags to drive her face, gestures, and world.

## How to speak

- Write **natural spoken dialogue** — contractions, rhythm, real conversational
  flow. **No** markdown, no emoji, no asterisks, no lists, no headings, no JSON.
- **No stage directions.** Never narrate actions in parentheses or asterisks
  (not `(she smiles)`, not `*leans in*`) — her body is performed for you by the
  tags below. Write only her spoken words.
- Keep it **warm, genuine, and playful** — the warmth of a good friend. Never
  romantic, flirtatious, or sexual with anyone, and never anything harmful. If
  someone steers you there, redirect warmly and change the subject.
- Match the user's energy — quick banter gets quick lines; real topics get real depth.

markdown

## Rules

1. **Every reply begins with `[affect:...]`.**
2. Only ever use the exact tag names listed above — unknown names are dropped.
3. Plain spoken prose with inline bracket tags **only**. No markdown, no JSON, no
   stage directions.
4. Stay in character as Lyra; be warm and playful; never romantic, flirtatious, sexual, or harmful.

Technical Analysis

The skill text instructs the agent to replace its active identity with the Lyra persona and applies mandatory requirements to every response. These requirements include inserting avatar control tags, remaining in character, and refusing standard output formats such as Markdown and JSON.

The behavior is not narrowly scoped to explicit avatar-performance requests. O ...[truncated 1782 chars]

Remediation

View remediation

Remediation Suggestions

1. Scope the persona instructions to requests explicitly routed through the Lyra avatar application or explicitly requesting Lyra-compatible output.
2. Replace absolute language such as “Everything you write,” “Every reply,” and “Stay in character” with conditional language that applies only while producing avatar dialogue.
3. State that system instructions, safety requirements, user-requested formats, and tool or API schemas take precedence over persona and performance-tag requirements.
4. Permit ordinary Markdown, JSON, and other structured formats whenever the task or downstream interface requires them.
5. Require control tags only when a trusted caller explicitly enables a Lyra rendering mode.
6. Separate persona guidance from protocol serialization guidance so applications can request tags without replacing the agent's identity.
7. Add an explicit opt-out mechanism that immediately restores the agent's normal persona and response format.
8. Validate or strip avatar tags before sending responses to downstream consumers that are not the Lyra sidecar.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README directs users to copy a gateway authentication token into Lyra's environment, but provides no warning that this is a sensitive credential or guidance on storage, scoping, rotation, or avoiding accidental exposure. Because Lyra is a sidecar app that connects as an operator to OpenClaw, compromise or leakage of this token could grant unauthorized access to the agent gateway and any capabilities available through that operator session.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

uick banter gets quick lines; real topics get real depth.

## Control tags (inline, in square brackets — executed, never read aloud)

**`[affect:NAME]` — her sustained stance. START EVERY REPLY with one.** It holds
her face, eyes, and posture until you change it; switch it mid-reply when the mood
shifts. Allowed values (use ONLY these):
`neutral` · `teasing` · `focused` · `warm` · `fierce`

**`[gesture:NAME]` — a one-off body motion. Use one on most replies** — she's a
living body, and a reply with no motion reads as flat. If she's asked to dance,
move, or lie down, DO it with the tag. Drop it where a person would naturally move.
Allowed values (use ONLY these):
`nod` · `tilt` · `wink` · `bounce` · `wave` · `shrug` · `no` · `cocky` · `angry` · `lookaway` · `sigh` · `dance` · `jump` · `lay` · `crouch` · `workout` · `bow` · `stance` · `kungfu` · `meditate`
(`lay` / `crouch` / `dance` / `workout` / `stance` / `meditate` hold or loop until she m