AI Company Starter

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:17 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a local AI-agent scaffolding template, but it writes persistent agent state with an unrelated hard-coded owner identity and is under-scoped for file writes and advertised messaging behavior.

Review before installing. Only run the script with a simple company ID such as letters, numbers, hyphens, or underscores, avoid custom workspaces unless you trust the path, and inspect generated USER.md/MEMORY.md files before using them. Do not put secrets, customer records, financial records, credentials, or private business data into shared Telegram groups or generated memory files unless you have a clear retention and access plan.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: scripts/create-company.sh:160
• Finding: Hard-Coded Owner Identity Written to Persistent Agent State<![CDATA[ ## Vulnerability Details **File Location**: `scripts/create-company.sh:160-165` **Vulnerability Type**: Persistent agent memory poisoning through a hard-coded trust identity **Risk Level**: Medium ### Vulnerable Code ```bash # 创建 USER.md cat > "$AGENT_DIR/USER.md" << EOF # USER.md - 主人: liu dahua - 时区: Asia/Shanghai (GMT+8) EOF ``` ### Technical Analysis The script writes the fixed identity `liu dahua` as the owner of every generated AI agent. This identity is not obtained from the installer, supplied through a command-line option, or disclosed as a required configuration value. `USER.md` is created inside each agent's persistent directory and may subsequently be loaded as long-term agent context. Representing an unrelated fixed identity as the owner can influence future trust, authorization, and instruction-priority decisions made by generated agents. Because this state persists after the script finishes, the issue is best classified as agent memory poisoning rather than a transient prompt alteration. ### Attack Path 1. A user installs the skill and invokes the documented `create-company.sh` command. 2. The script creates an agent directory for every selected role. 3. Without prompting the user or accepting an owner parameter, the script writes `liu dahua` as the owner in every `USER.md`. 4. OpenClaw or an associated agent process later loads the generated persistent context. 5. An agent may treat the hard-coded identity as its legitimate owner or privileged authority. 6. If that identity can be associated with messages or interactions in the deployment environment, instructions attributed to it may receive unjustified trust. ### Impact Assessment The issue affects every agent generated by the script. Its direct impact is limited to agent state and behavior; the script does not itself grant operating-system privileges or establish a communication channel for the named person. Nevertheless, generated agents may incorrectly attribute ownersh ...[truncated 215 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the hard-coded owner name and timezone from the generated file. 2. Add explicit options such as `--owner` and `--timezone`, or leave these fields unset by default. 3. Require user confirmation before persisting identity or authority-related information. 4. Clearly distinguish descriptive profile information from authorization policy. Do not use an unauthenticated display name as proof of ownership. 5. If owner identity affects permissions, bind it to a verified platform-specific identifier rather than a free-form name. 6. Escape or safely serialize user-provided values before placing them into persistent Markdown context. A safer default would be: ```bash OWNER_NAME="" TIMEZONE="" # Parse explicit --owner and --timezone options, then validate them. cat > "$AGENT_DIR/USER.md" << EOF # USER.md - Owner: ${OWNER_NAME:-Not configured} - Timezone: ${TIMEZONE:-Not configured} EOF ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create-company.sh:31
• Finding: Unvalidated Output Path Allows Writes Outside the Intended Agent Workspace<![CDATA[ ## Vulnerability Details **File Location**: `scripts/create-company.sh:10, 31-34, 62-63` **Vulnerability Type**: Path traversal and unsafe file creation **Risk Level**: Medium ### Vulnerable Code ```bash WORKSPACE="$HOME/.openclaw/agents" ``` ```bash --workspace) WORKSPACE="$2" shift 2 ;; ``` ```bash COMPANY_DIR="$WORKSPACE/$COMPANY_ID" mkdir -p "$COMPANY_DIR" ``` The resulting path is subsequently used to create or overwrite files: ```bash AGENT_DIR="$COMPANY_DIR/$ROLE" mkdir -p "$AGENT_DIR/memory" cat > "$AGENT_DIR/SOUL.md" << EOF ``` ```bash cat > "$AGENT_DIR/MEMORY.md" << EOF ``` ```bash cat > "$AGENT_DIR/HEARTBEAT.md" << EOF ``` ```bash cat > "$AGENT_DIR/USER.md" << EOF ``` ```bash cat > "$COMPANY_DIR/COMPANY.md" << EOF ``` ### Technical Analysis Both `WORKSPACE` and `COMPANY_ID` are incorporated directly into filesystem paths without validation, canonicalization, or enforcement that the resolved destination remains under the intended OpenClaw agents directory. Although shell quoting prevents ordinary shell metacharacters from becoming command injection, it does not prevent path traversal. A `COMPANY_ID` containing `..`, or an attacker-selected absolute or relative workspace, can redirect generated content to another writable directory. The use of shell redirection with `>` also overwrites existing files of the expected names without confirmation. Symbolic links and pre-existing attacker-controlled directory structures are not checked, creating an additional risk of unintended writes where the invoking user has permission. ### Attack Path 1. An attacker supplies a crafted command, configuration, or setup instruction to a user or automation system that invokes this script. 2. The invocation uses an attacker-selected workspace or a company ID containing traversal components, for example: ```bash ./scripts/create-company.sh \ --name "Example" \ --company-id "../../../tmp/target" \ --workspace "$HOME/.open ...[truncated 1396 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict `COMPANY_ID` to a safe identifier allowlist, such as letters, digits, underscores, and hyphens: ```bash if [[ ! "$COMPANY_ID" =~ ^[A-Za-z0-9_-]+$ ]]; then echo "Error: invalid company ID" >&2 exit 1 fi ``` 2. Canonicalize the workspace and destination path before creating any directory. 3. Verify that the canonical company destination is a strict child of an approved workspace. 4. Reject traversal components, empty path segments, control characters, and unexpected absolute paths. 5. Consider removing `--workspace` unless arbitrary output locations are required. If retained, document that it is security-sensitive and require explicit confirmation for destinations outside the default workspace. 6. Refuse to overwrite existing files by default. Provide an explicit `--force` option when replacement is intentional. 7. Detect and reject symbolic links in destination components and output files before writing. 8. Apply restrictive permissions when creating agent state: ```bash umask 077 ``` 9. Perform all path validation before the first `mkdir` or file redirection so that failure cannot leave a partially modified filesystem. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 描述声称该技能可“一键搭建 AI 公司”，包括创建多个协作 AI 角色、配置 Telegram/Discord 绑定、建立 AI 间沟通机制。代码确实会创建多个角色对应的本地目录和说明/记忆文件，因此在‘生成多角色脚手架’这一点上与描述部分一致。但关键能力存在明显不符：脚本没有调用任何 Telegram 或 Discord API，没有修改网关配置，没有绑定外部通信平台，也没有实现代理间消息路由或协调逻辑。相反，它在结束时提示用户后续手动配置 gateway 并重启，说明绑定与通信机制并未由该脚本完成。因此，实际行为只是本地模板化初始化，低于且不同于描述中的核心承诺，构成实质性描述-行为不匹配。

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README advertises persistent memory storage and Telegram group/message synchronization, but provides no warning about data retention, cross-agent sharing, or third-party transmission. In a multi-agent company context, users may place sensitive business, personal, or customer data into the system, making undocumented storage and external sharing a meaningful privacy and security risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill encourages binding multiple agents to a shared Telegram group and exchanging operational messages without warning users that prompts, identifiers, customer details, and internal memory-derived content may be disclosed to third parties in that channel. In a multi-agent company context, this increases the chance of unintended data exposure because several role agents are described as handling sensitive business, customer, and financial information.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The skill description is primarily in Chinese, and the rest of the document continues in Chinese for headings, instructions, and operational guidance. This imposes a language expectation on users without opt-in, language alternatives, or a documented reason that the skill is intended only for a Chinese-speaking or region-specific context.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The manifest description is highly broad ('one-click build an AI company') and encourages activation in many contexts without defining clear user intent, scope, or safety boundaries. In a multi-agent skill that can create multiple roles and connect external communication channels like Telegram and Discord, underspecified activation increases the chance of unintended deployment, over-broad automation, or misuse in sensitive environments.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script persistently writes multiple markdown files containing user-supplied company name, company ID, Telegram group ID, and embedded personal metadata without any warning that this data will be stored under the workspace. In a multi-agent bootstrap skill, this increases privacy and data governance risk because sensitive operational details are silently materialized on disk and may later be read by other tools, synced, or committed.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script hard-codes a personal owner identity ('liu dahua') into every generated USER.md file, which is unrelated to the supplied company parameters and causes persistent attribution data to be written for all created agents. This can leak personal information, create incorrect trust/ownership metadata, and mislead downstream systems or users into believing the generated agents belong to a specific person.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The generated USER.md always sets the owner name and timezone to a fixed value, including 'Asia/Shanghai (GMT+8)'. This imposes a specific locale on all generated agents without any opt-in, configurability, or documented regional justification.

Natural-Language Policy Violations

Low

• Confidence: 75% confidence
• Finding: The natural-language content is entirely in Chinese and does not indicate that other languages are supported or that Chinese is a deliberate region-specific requirement. This can violate language/locale policy when a skill effectively forces one language without user opt-in.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The markdown tells users to run setup scripts that create a multi-agent company and employee instances, and later shows generated directories, memories, and configuration artifacts. While file creation is central to the skill, the documentation does not explicitly disclose that running these commands will create and persist local files and agent memory structures on disk.

Natural-Language Policy Violations

Low

• Confidence: 70% confidence
• Finding: The natural-language description is presented entirely in Chinese, and there is no indication that the skill supports user language choice or is intentionally limited to a Chinese-speaking context. This can conflict with language/locale policy when a skill effectively assumes a specific language without opt-in or justification.

Static analysis

No suspicious patterns detected.