Security audit

LoongFlow — PEES Iterative Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is an optimization workflow, but it asks for broad background execution, mutable remote code installation, cross-workspace monitoring, and notification behavior that users should review carefully before installing.

Install only if you are comfortable with a skill that can launch autonomous optimization work, write .loongflow task records, install a remote engine from GitHub, create a recurring OpenClaw cron, read task/log content across configured workspaces, and send progress summaries. Before use, pin the engine source, remove the API-key prefix echo, require explicit approval for cron creation, and scope monitoring to one approved workspace and recipient.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T06 · System Persistence

Error

Location: references/monitoring.md:15
Finding: Persistent Cross-Session Monitoring Agent Installed as a Scheduled Cron Job
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: references/engine-mode.md:85
Finding: Mutable Remote Source Is Downloaded, Installed, and Executed Without Integrity Verification
Content: View full analysis
/dev/null; then uv venv .venv --python 3.12 uv pip install -e . --python .venv/bin/python else python3.12 -m venv .venv || python3 -m venv .venv .venv/bin/pip install -e . fi .venv/bin/python -c "import loongflow; print('loongflow ok')" ``` ### Technical Analysis The engine installation procedure clones an external GitHub repository and explicitly updates it from the mutable `main` branch. It then installs the fetched project in editable mode and imports it with Python. No reviewed commit hash, release tag, artifact checksum, signature, dependency lockfile, or integrity verification is required. Consequently, the effective code executed by the skill can change after the skill package itself has been reviewed. Python installation can execute package build hooks and backend code. Importing the installed package may also execute module-level code. In addition, `uv venv --python 3.12` is documented as being permitted to download a Python runtime automatically, increasing the amount of externally retrieved executable material. Although the remote project is used as a dependency, the direct retrieval and execution of a mutable remote branch makes T03 the strongest classification. The behavior also presents a broader supply-chain risk. ### Attack Path 1. A user selects LoongFlow Engine mode. 2. The agent clones the remote repository or updates an existing checkout with `git pull origin main`. 3. An upstream maintainer account, repository, dependency, build configuration, or distribution channel is compromised. 4. Malicious code is added to the mutable branch after this sk ...[truncated 945 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/engine-mode.md:62
Finding: API Key Prefix Is Disclosed Through Prerequisite Check Output
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/monitoring.md:28
Finding: Global Monitoring Agent Enumerates and Reads Unrelated Agent Workspaces
Content: View full analysis
/.loongflow/tasks.json. 3. Merge all tasks whose status is running. ``` For native tasks, the monitor reads task indexes, scores, plans, and insights. For engine tasks, it reads the last 100 lines of the configured log, extracts plans and errors, reads PID files, and checks process liveness. ### Technical Analysis A monitor created while handling one task is instructed to read the global OpenClaw configuration and enumerate every configured agent workspace. It then accesses task registries and artifacts belonging to other workspaces. This exceeds the least-privilege boundary required to monitor the initiating task. A task-specific monitor needs access only to the task identifier, its task directory, and its own registry entry. Global enumeration exposes unrelated agent state to a shared isolated session. The risk is amplified because paths and recipients are taken from writable task registry data. If another task or local process can modify a registry entry, it may be able to direct the monitor toward additional readable files through fields such as `logFile`, `pidFile`, or `taskDir`. The documented workflow does not require canonical-path validation or enforcement that these paths remain beneath an approved workspace. ### Attack Path 1. A task causes the shared monitoring cron to be installed. 2. The cron reads `/root/.openclaw/openclaw.json`. 3. It enumerates all configured agent workspace paths, including workspaces unrelated to the initiating user or task. 4. It reads every available `.loongflow/tasks.json`. 5. For running tasks, it follows task-controlled file paths and reads plans, summaries, logs, and PID ...[truncated 981 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description is extremely broad and encourages activation for generic optimization, coding, algorithm, and prompt-improvement tasks across multiple agent environments. This can cause the skill to trigger on many ordinary requests, unexpectedly introducing background subagents, downloads, or iterative workflows that the user did not explicitly ask for, increasing the chance of unintended actions and scope expansion.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The Chinese usage guidance says to use the skill whenever a user wants repeated polishing or multi-round iteration, which is ambiguous and covers a very large fraction of normal assistant work. In this skill's context, that broad activation is more dangerous because later instructions include async subagents, registry writes, cron-based monitoring, and possible framework downloads, so accidental invocation can lead to unnecessary autonomous execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Several headings and imperative instructions are presented only in Chinese, effectively imposing a language choice in the skill guidance. The file does not offer an alternative language or explain a justified locale restriction.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/engine-mode.md (reported line 17)May include surrounding context.

实际执行时，agent 应直接用 Python 查询 openclaw.json 确定 workspace，不要照搬 $0 那行。

bash
# 示意：SKILL.md 在 <workspace>/skills/loongflow/SKILL.md，向上两级即 workspace # 实际执行时请改用下方 Python fallback，不要使用 $0 # fallback（推荐）：从 openclaw.json 查当前 agent 的 workspace

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions tell the agent to read /root/.openclaw/openclaw.json and environment-derived identifiers such as OPENCLAW_AGENT_ID to resolve the current workspace. That accesses host-specific configuration beyond the minimum needed for a portable optimization skill and can expose filesystem layout and agent metadata to the skill logic.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructions explicitly print the first 10 characters of ANTHROPIC_API_KEY to the terminal. Even partial credential disclosure is sensitive, can end up in logs or transcripts, and normalizes unsafe handling of secrets.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs outbound connectivity checks and cloning code from GitHub at runtime. This expands the skill from optimization guidance into arbitrary network retrieval and supply-chain activity, creating risk of unreviewed code intake, external data exposure, and behavior that exceeds user expectations for a local agent skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: These instructions launch a background process, persist a PID file and log file, and then direct the operator to set up recurring cron-based monitoring. That creates durable autonomous execution on the host, which is materially more invasive than a one-shot optimization workflow and can continue operating outside the user's immediate awareness.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The task registration script mutates host state by creating .loongflow/tasks.json, recording workspace paths, log locations, and notification identity derived from environment or whoami. This bookkeeping is not essential to core optimization and introduces privacy and integrity risk through persistent host-side metadata collection and modification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The monitoring cron is instructed to scan all discovered workspaces, read task files and logs, extract plans, insights, and progress details, and automatically send summaries to recipients. That creates a real privacy and data-disclosure risk because potentially sensitive content from user projects or prompts may be redistributed without explicit user notice, consent, scoping, or sanitization.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Using notifyUser with a fallback to BAIDU_CC_USERNAME or whoami allows automatic delivery to an environment-derived account even when no recipient was explicitly configured. This can send internal progress summaries to unintended recipients and makes disclosure behavior implicit rather than user-authorized.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instructions and user-facing messages throughout the file are presented in Chinese, including the prescribed completion notice. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is documented and justified.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to ensure a shared monitoring cron exists and to create one if missing. Creating or modifying persistent scheduled tasks is an operational side effect outside the core optimization function, increases persistence on the host, and can affect other tasks or users if misconfigured or abused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The background execution step writes logs and PID/task state files without prominently warning that task content, outputs, and possibly sensitive prompts may be persisted on disk. This is a real data-handling concern, though lower impact than direct credential exposure because persistence is local and somewhat expected for long-running jobs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This markdown file directs the operator to create and execute a script that appends entries to .loongflow/tasks.json, altering persistent workspace state. While the document explains the mechanics, it does not clearly warn the user that running the skill will modify local files and task-tracking metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 74% confidence
Finding: The spawned subagent is explicitly told to use tools for file reads/writes and command execution, which can affect user data or system state. Although these actions are part of the workflow, the markdown does not provide a concise warning to the user that background execution may modify files and run commands autonomously.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest describes an iterative optimization/evolution workflow for code, algorithms, or prompts, but does not mention messaging or outbound user-notification behavior as part of the skill's purpose. While background execution is aligned with the description, sending messages to a user account is an additional capability beyond the core optimization loop.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.