OpenClaw SillyTavern Plugin

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:06 AM UTC
• Version: 0.1.0

Overview

The plugin mostly matches its RP purpose, but it needs Review because it can persist persona instructions, read/import arbitrary local or URL content, and change shared image settings without clear plugin-level scoping.

Install only in a trusted, administrator-controlled OpenClaw environment. Avoid exposing /rp commands to untrusted chat users until --file and --url imports are restricted, URL/file size limits are added, SQLite extension loading is locked down, persona sync requires preview and admin approval, and global image configuration changes are authorized and auditable. Treat imported character cards as untrusted prompt content, and review memory retention because RP conversations and embeddings may persist in SQLite.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: src/openclaw/agentPersona.js:15

Finding

Imported Character Instructions Can Persistently Hijack the Global Agent Persona

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/core/commandRouter.js:384

Finding

Chat-Facing Import Commands Permit Unrestricted Local File Reads

Content

View full analysis

"); const asset = this.store.resolveAssetByNameOrId({ userId: ctx.userId, nameOrId: String(nameOrId) }); const full = this.store.getAssetDetail(asset.id); const detail = full.detail || {}; const typeIcon = { card: "🎭", preset: "⚙️", lorebook: "📚" }; const icon = typeIcon[full.type] || "📄"; const lines = [ `${icon} ${full.name}`, `• 类型：${full.type}`, `• 版本：v${full.version}`, `• ID：${full.id}`, `• 格式：${full.source_format}`, ]; if (full.type === "card") { if (detail.description) lines.push(`• 简介：${stripHtml(detail.description).slice(0, 200)}`); if (detail.personality) lines.push(`• 人设：${stripHtml(detail.personality).slice(0, 200)}`); if (detail.scenario) lines.push(`• 场景：${stripHtml(detail.scenario).slice(0, 200)}`); } else if (fu ...[truncated 2384 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/core/commandRouter.js:404

Finding

Unrestricted URL Imports and Attachment Resolution Enable SSRF and Memory Exhaustion

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: src/core/commandRouter.js:1082

Finding

RP Command Can Persistently Modify Shared OpenClaw Image Configuration Without Plugin-Level Authorization

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (66)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · README.md (reported line 211)May include surrounding context.

bash

/rp agent-image
/rp agent-image --provider openai --model grok-imagine-1.0
/rp agent-image --provider gemini --model gemini-3.1-flash-image-preview
/rp agent-image --clear-model
/rp agent-image --disable
/rp agent-image --enable

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · README.zh.md (reported line 210)May include surrounding context.

bash

/rp agent-image
/rp agent-image --provider openai --model grok-imagine-1.0
/rp agent-image --provider gemini --model gemini-3.1-flash-image-preview
/rp agent-image --clear-model
/rp agent-image --disable
/rp agent-image --enable

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code does not implement character cards, memory, TTS, image generation, multimodal output, or Generative-Agents-style behavior. It strictly performs utility work for resolving model settings: parsing JSON, coercing numeric values, merging preset/context/override parameters, and returning a filtered configuration object. This is materially different from the declared high-level purpose if evaluated at the code-chunk level. No suspicious undeclared resource access appears, but the actual behavior shown is configuration plumbing rather than the described plugin features.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description is focused on a SillyTavern-compatible roleplay/companion plugin with memory and multimodal features. The supplied code chunk instead implements messaging-platform integration glue for Discord and Telegram, including event/update handlers, message normalization, hook invocation, and response dispatch. Those are materially different capabilities from the declared purpose and introduce external chat-platform integrations that are not mentioned in the description. While this could be supporting infrastructure for a broader plugin, this specific chunk's primary behavior is undeclared channel integration, so it is a meaningful description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied code does not implement or demonstrate the declared roleplay-plugin behaviors such as character cards, long memory, TTS/image generation, or a generative companion. Instead, it focuses on attachment resolution infrastructure and tests for HTTP/Telegram file fetching. While such functionality could be a supporting subsystem in a larger application, this chunk’s observable purpose is materially different from the declared description and includes undeclared network/file-retrieval capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied code does not implement or test roleplay features such as character cards, long memory, Generative-Agents behavior, or SillyTavern-specific plugin logic. Instead, it focuses on adapting messages to and from Discord and Telegram. While multimodal handling is loosely adjacent because it references image/audio URLs, the primary behavior here is cross-platform chat adapter testing, which is not accurately represented by the declared description. Therefore this chunk is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description describes a full-featured SillyTavern roleplay plugin with memory, multimodal features, and companion-style agent behavior. The actual code chunk does not implement or exercise any of those capabilities; it only contains a test for token estimation behavior. This is a materially different purpose, not merely a supporting detail for the described functionality as presented in isolation. Therefore, the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

- `src/openclaw/register.js` — Native OpenClaw extension registration (hooks & commands)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md

- `src/core/sessionManager.js` — Session lifecycle, summaries, long memory

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

- `src/core/commandRouter.js` — `/rp` command routing

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md

- `src/core/promptBuilder.js` — Prompt assembly and budget management

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

- `src/store/sqliteStore.js` — SQLite persistence layer

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The import path accepts an arbitrary --file value and passes it directly to readFile(), allowing a user of the plugin to make the host process read any local file the process can access. For a roleplay plugin, unrestricted filesystem reads are not necessary and can expose secrets, keys, configs, chat logs, or other sensitive host data if an attacker can induce or convince a user/agent to invoke the command.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · src/providers/openaiCompatible.js (reported line 72)May include surrounding context.

js

if (!prompt?.messages) {
    return [];
  }
  return prompt.messages.map((m) => ({ role: m.role, content: m.content }));
}

function contentToText(content) {

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The store accepts an extensionPath option and directly invokes SQLite's loadExtension after enabling extension loading. SQLite extensions are native shared libraries, so if an attacker can influence configuration or plugin inputs, this becomes arbitrary native code execution in the host process, which is far beyond the stated needs of a roleplay data store.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The changelog states the locale resolution falls back through several sources and finally defaults to zh. This establishes a forced language default in natural-language behavior without indicating user choice or opt-in, which matches the policy concern for locale/language violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README advertises proactive outreach, scheduler-driven check-ins, and automation-triggered companion messages, but it does not clearly warn operators that the plugin can initiate unsolicited contact on a user's behalf. In a messaging-integrated roleplay plugin spanning Discord, Telegram, and native chat flows, this behavior can create privacy, consent, and trust risks, especially if enabled in shared or production environments.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Persisting RP character data into SOUL.md creates state that survives the current session and can influence later agent interactions. Without a strong warning and clear scoping, this can lead to accidental persistence of sensitive, manipulative, or unsafe persona instructions and make recovery difficult if the original prompt state is not preserved correctly.

Content

Scanner excerpt · README.md (reported line 119)May include surrounding context.

md

- `/rp image [--prompt "..."] [--style "..."]`
- `/rp agent-image [--provider inherit|openai|gemini] [--model "..."] [--clear-model] [--enable|--disable]`
- `/rp companion-nudge [--reason "..."] [--idle-minutes N] [--mode balanced|checkin|question|report] [--force]`
- `/rp sync-agent-persona` — write current RP character into the agent's `SOUL.md`
- `/rp restore-agent-persona` — remove RP character preset from `SOUL.md`, restore original persona
- `/rp pause` / `/rp resume` / `/rp end`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The commands to sync and restore agent persona explicitly modify SOUL.md, which is likely a persistent system/persona prompt file, but the README does not warn that this changes agent behavior beyond the current RP session. Silent modification of prompt/persona files can cause lasting prompt injection, unintended impersonation, or operational confusion if users assume the change is temporary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly advertises proactive outbound messaging, follow-up questions, and automated check-ins based on idle thresholds and recalled long-term memory, but it does not present a clear user-facing consent, opt-in, or privacy warning. In a messaging plugin, unsolicited contact and memory-driven outreach can create privacy, harassment, and trust risks, especially if deployed in Discord/Telegram or shared environments where users may not expect autonomous re-engagement.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill metadata declares environment-variable use and an install-time npm command, but it does not declare any explicit tool scope or permissions despite functionality that implies network and external-resource access. In a plugin ecosystem, missing permission declarations reduces transparency and can allow users or operators to install a skill without understanding that it may access networked providers, download assets, or read environment-based secrets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill prominently advertises long-term memory with SQLite persistence, but it does not provide a clear privacy/integrity warning at the description level about retention of conversation data and derived embeddings. Persistent storage of roleplay conversations can expose sensitive personal content, increase breach impact, and create user-consent and data-lifecycle risks if operators enable it without understanding the retention model.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The plugin advertises a proactive companion system and scheduled companion_tick behavior, but the short description and install-facing summary do not prominently warn that the skill may initiate outreach automatically. In messaging environments, autonomous outbound interaction can surprise users, create consent issues, and lead to unintended contact or reputation harm if enabled without clear notice.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples/openclaw-rp-bootstrap.js (reported line 16)May include surrounding context.

js

const db = new Database("./rp.sqlite");

  const providers = createOpenAICompatibleProviders({
    baseUrl: process.env.OPENAI_BASE_URL || "https://api.openai.com/v1",
    apiKey: process.env.OPENAI_API_KEY,
    model: process.env.OPENAI_MODEL || "gpt-4o-mini",
    ttsModel: process.env.OPENAI_TTS_MODEL || "gpt-4o-mini-tts",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/providers/openaiCompatible.js (reported line 18)May include surrounding context.

js

const db = new Database("./rp.sqlite");

  const providers = createOpenAICompatibleProviders({
    baseUrl: process.env.OPENAI_BASE_URL || "https://api.openai.com/v1",
    apiKey: process.env.OPENAI_API_KEY,
    model: process.env.OPENAI_MODEL || "gpt-4o-mini",
    ttsModel: process.env.OPENAI_TTS_MODEL || "gpt-4o-mini-tts",

Static analysis

No suspicious patterns detected.