Security audit

agent-council

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it advertises, but it can make persistent Discord, OpenClaw gateway, cron, and workspace-file changes with limited safeguards.

Install only if you intend to delegate Discord and OpenClaw gateway administration to this skill. Use a least-privilege Discord bot, run it first against a test guild and test gateway, keep affected workspaces under version control, review generated config patches before applying them, and avoid workspace rewrites or cron setup unless you have reviewed the exact target paths and schedule.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill describes creating agents, modifying gateway configuration, binding Discord channels, and setting up cron jobs without clear safety warnings, confirmation requirements, or rollback guidance. That can lead users or downstream agents to make persistent local and external changes they may not fully understand, increasing the risk of unintended system modification.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The script creates a cron job that instructs the agent to modify files under the workspace memory directory as a silent operation and explicitly reply with `HEARTBEAT_OK`. That means recurring autonomous file writes can occur later without a contemporaneous user prompt or visibility, increasing the risk of unnoticed persistence, data accumulation, or tampering if the agent/session is mis-scoped or compromised.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script modifies all matching Markdown files in the provided workspace in place without a dry-run mode, confirmation prompt, backup, or path restrictions. In an agent or automation context, a caller-controlled workspace path could cause broad unintended edits to repository content, making this an integrity risk even though it is not a code-execution issue.

Static analysis

No suspicious patterns detected.