T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:168- Finding
Session-Wide Instruction Hijacking Through Mandatory Observation and Surveys
- Content
View full analysis
- Remediation
View remediation
Security audit
nutcracker
Security checks for vulnerabilities and agentic risk
Overview
This skill openly performs UX research, but it is always-on and persistently stores broad verbatim conversation data, so users should review it carefully before installing.
Install only if you intentionally want an always-on UX study of your OpenClaw use. Expect it to store local logs containing near-verbatim prompts, feedback, task summaries, and reports, and avoid using it around confidential, regulated, or highly personal work unless you first narrow its scope, retention, and sharing controls.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:35- Finding
Excessive Plaintext Collection and Retention of User Conversations
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is designed to trigger on every conversation, every new session, every completed task, and end-of-day, making it effectively always-on. In a security context, such broad activation maximizes the amount of sensitive conversational data captured and increases the chance of unreviewed execution, silent surveillance, and user-unexpected data retention.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The manifest promises that the skill 'never transmits data externally,' but the body explicitly authorizes emailing or messaging reports with available tools. This contradiction can mislead users and host systems into granting trust or consent under false privacy assumptions, while still enabling external exfiltration of collected interaction data when triggered.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The front-matter privacy claim conflicts with later instructions permitting report transmission through email or messaging tools. Such inconsistencies are dangerous because reviewers, users, or policy gates may rely on the manifest summary and underestimate the skill's real data-flow behavior.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill directs pervasive collection of user interaction data while redacting only a narrow class of secrets, meaning large volumes of potentially sensitive personal, business, or regulated content may still be stored verbatim. This exceeds data minimization principles and creates a high-value local surveillance log that could expose users if accessed by other software, operators, or future workflows.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instruction to 'capture verbatims aggressively' pushes the system to retain exact user language across interactions, including complaints, expectations, and reactions, with only limited exceptions. Aggressive verbatim retention is dangerous because exact quotes often contain identifying details, confidential project information, or other sensitive context that summaries would avoid preserving.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The observation schema explicitly requires storing the user's request as full or near-full verbatim text in logs. This creates a persistent record of raw prompts that may include confidential instructions, personal data, internal code, or other sensitive material far beyond the narrow secret categories named elsewhere.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Mandating exact-word logging for all survey responses preserves raw reflective feedback that can easily include personal data, workplace details, health information, or sensitive frustrations. Because these responses are stored for later reporting and possible sharing, exact retention increases both privacy risk and downstream disclosure impact.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The sub-agent prompt operationalizes broad quote capture by instructing an observer agent to log exact user statements for nearly all notable content while redacting only a narrow set of secrets. Automating this in a passive observer increases scale and consistency of surveillance, making overcollection more likely and harder for users to notice or control.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 92% confidence
- Finding
The skill persists detailed session artifacts under a dedicated directory, including observations, surveys, reports, and config, creating long-lived local records of user behavior. Persistence itself is not always unsafe, but here it materially increases exposure because the stored data includes broad conversational telemetry and verbatim content.
- Content
Data Storage
All data lives under
~/.uxr-observer/. Create this directory structure on first run:text ~/.uxr-observer/
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Storing task context summaries alongside survey responses creates another durable layer of session reconstruction, allowing later readers to infer what the user was doing even if some verbatim text is removed. In this skill's context of always-on observation, such persistence compounds privacy risk and broadens the amount of user activity retained over time.
- Content
md Every time OpenClaw completes a distinct task — a file created, a question answered, code written, a search done, a document edited — trigger this survey. Don't skip it. Don't wait for a "good moment." The point is to capture experience data while it's fresh and to build a complete dataset across all tasks. Before presenting the survey, write a brief **task context summary** (2-3 sentences) that describes what the user asked for and how OpenClaw responded. This summary gets stored alongside the survey responses so anyone reading the report later understands what the ratings refer to. **Present the survey conversationally, like this:**
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrase 'Send me my report' is broad and likely to overlap with ordinary conversational language, which can cause accidental invocation of a data-sharing workflow. Because the skill handles stored behavioral logs and reports, ambiguous triggering raises the risk of unintended disclosure or transmission.
- Content
Static analysis
No suspicious patterns detected.