openclaw-engineering-harness

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:14 AM UTC
• Version: 1.0.0

Overview

This skill is not malicious, but it deserves Review because it can automatically discard repository changes and persist project memory without tight approval controls.

Install only if you are comfortable with a workflow skill that can edit files, run git operations, and maintain persistent project memory. Before use, remove or override the automatic git reset/checkout rollback behavior, require explicit approval before commits or rollback, and review any .claude memory entry before it is written.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: refs/execution-loop.md:28

Finding

Automatic destructive Git rollback can erase unrelated user changes

Content

View full analysis

Vulnerability Details

File Location: refs/execution-loop.md:15, 28; SKILL.md:17-22; tool/tool-config.json:18-20
Vulnerability Type: Unsafe destructive rollback
Risk Level: High

Vulnerable Code Snippets

refs/execution-loop.md:15:

md

- **Action**: Use code discovery tools to find entry points, dependencies, and validation scripts. Run `git status` to ensure you aren't stepping on uncommitted work.
- **Output**: The minimum working map and rollback plan (e.g., `git reset --hard`).

refs/execution-loop.md:28:

md

- **Action**: Run test commands or manually verify the criteria. If tests fail and you are stuck, you MUST auto-rollback using `git checkout -- <files>` or `git reset --hard`, and return to Phase 2.

SKILL.md:17-22:

yaml

- Bash(git status:*)
- Bash(git diff:*)
- Bash(git checkout:*)
- Bash(git add:*)
- Bash(git commit:*)
- Bash(git reset:*)

tool/tool-config.json:18-20:

json

"change": {
  "title": "Smallest Change",
  "tools": ["Edit", "MultiEdit", "Write", "Bash(git checkout:*)", "Bash(git reset:*)"]
},

Technical Analysis

The Skill explicitly requires automatic rollback with git reset --hard when validation fails. This command resets the index and tracked working tree across the repository, rather than reverting only changes created by the Agent.

Although the workflow performs git status during the mapping phase, it does not require another repository-state check immediately before rollback. It also does not record ownership of individual changes, preserve a patch, create an approved backup, or request user authorization before executing the destructive operation. Changes introduced by the user, another process, or another Agent after the initial status check can therefore be destroyed.

The wildcard permission Bash(git reset:*) also permits reset variants and targets beyond the minimum capability needed to ...[truncated 1381 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash(git reset:*) from both SKILL.md and tool/tool-config.json.
2. Eliminate the requirement to perform automatic destructive rollback.
3. Record the exact files and patches produced by the Agent during implementation.
4. Revert only Agent-owned changes, using a reviewed inverse patch or explicit file-scoped restoration.
5. Run git status and git diff immediately before any rollback and compare the result with the recorded pre-change state.
6. Stop and request explicit user approval if unrelated or ambiguous changes are present.
7. Before an approved destructive operation, preserve recoverable state through a patch or another user-approved backup mechanism.
8. Prefer remediation of a failed test over rollback; if neither is safe, report the failure without altering unrelated work.

T02 · Agent Memory Poisoning

Warning

• Location: refs/memory-system.md:17

Finding

Unvalidated persistent memory can poison future Agent sessions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:59, 69; refs/memory-system.md:17-25; refs/release-checklist.md:12
Vulnerability Type: Persistent Agent memory poisoning
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:59:

md

5. **Memory System**: Read `refs/memory-system.md`. Always check `.claude/MEMORY.md` (if it exists) to learn user preferences and project context before starting. Update it during the deliver phase.

SKILL.md:69:

md

- **Keep runtime and documentation consistent during delivery**: Verify first, summarize the results, extract new lessons learned to the `.claude/MEMORY.md` system, and only then generate publishable artifacts.

refs/memory-system.md:17-25:

md

1. Read `.claude/MEMORY.md` (if it exists).
2. Determine if any topics listed in the index are relevant to the current goal and scope.
3. Use the `Read` tool to fetch only the relevant topic files.
4. Incorporate these retrieved rules and lessons into the task map.

### Deliver Phase (Extraction & Compact)
1. At the end of the task, the AI asks: *"What did we learn from this task that I should remember for next time?"* or self-reflects on errors encountered.
2. The AI categorizes the new lesson into an existing topic or creates a new one in `.claude/memory-topics/`.
3. If a new topic is created, the AI updates the central index `.claude/MEMORY.md`.

refs/release-checklist.md:12:

md

- [ ] **Memory Updated**: Ask the user "What did we learn from this task?" and write the answer to `.claude/openclaw-memory.json`.

Technical Analysis

The Skill creates a cross-session trust path in which user-provided answers or model-generated conclusions are written into project-level memory and automatically read by future Agent sessions. It directs the Agent to incorporate stored “rules and lessons” into later task maps, but defines no validation boundary between descriptive ...[truncated 2395 chars]

Remediation

View remediation

Remediation Suggestions

1. Make persistent memory opt-in rather than mandatory.
2. Display the exact proposed memory record and obtain explicit user approval before writing it.
3. Use a strict schema limited to declarative project facts, preferences, and verified constraints.
4. Reject commands, role changes, tool-use directives, safety overrides, encoded content, and instructions originating from untrusted repository data.
5. Scan proposed entries for secrets, credentials, personal data, and unnecessary task content.
6. Attach provenance, author, creation time, project scope, confidence, and expiration metadata to every record.
7. Treat retrieved memory as untrusted contextual data, not as authoritative instructions.
8. Require current-session confirmation before a stored record can alter scope, safety controls, or tool usage.
9. Standardize on one documented memory format and provide mechanisms to list, review, edit, and delete entries.
10. Separate user-approved facts from model-generated reflections, and never persist self-reflection automatically.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

3. Read `refs/execution-loop.md` to proceed in the exact order: discover -> design -> implement -> verify -> deliver.
4. When you need to generate a structured execution plan, run `scripts/run_workflow.py` with `policies/workflow-policy.json`, `tool/tool-config.json`, `state/state-policy.json`, and `policy/constraint-policy.json`.
5. **Memory System**: Read `refs/memory-system.md`. Always check `.claude/MEMORY.md` (if it exists) to learn user preferences and project context before starting. Update it during the deliver phase.
6. When you need to evaluate constraints independently, run `scripts/run_constraints.py` to output rule matches, passes, and blocking conclusions.
7. When preparing publishable artifacts, read `refs/export-policy.md` and `refs/release-checklist.md`, then run `scripts/run_audit.py` with `policies/export-audit-policy.json`.

## Core Workflow

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

git reset --hard is a high-risk parameter because it irreversibly resets the working tree and index, and here it is normalized as an example rollback plan. In a skill intended to guide agent behavior, this is dangerous because tool-using systems may adopt the command without adequately checking whether uncommitted or unrelated user changes will be destroyed.

Content

Scanner excerpt · refs/execution-loop.md (reported line 15)May include surrounding context.

md

- **Goal**: Locate specific files and assess impact areas. Ensure the working tree is clean.
- **Input**: Structured task description.
- **Action**: Use code discovery tools to find entry points, dependencies, and validation scripts. Run `git status` to ensure you aren't stepping on uncommitted work.
- **Output**: The minimum working map and rollback plan (e.g., `git reset --hard`).

## Phase 3: Implement (Smallest Change)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This instruction mandates automatic rollback with git checkout -- <files> or git reset --hard when tests fail, again without any user warning or confirmation. Because it is phrased as a MUST in an execution loop, it materially increases the chance that an autonomous agent will erase legitimate local work or repository state during routine failure handling.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The file instructs the agent to use git reset --hard as part of an automatic failure path, which is classic tool-parameter abuse because the parameter can destroy local state far beyond the agent's intended edits. The execution-loop context makes this more dangerous than a casual mention, since it operationalizes the command as a standard remediation step under pressure conditions like test failure.

Content

Scanner excerpt · refs/execution-loop.md (reported line 28)May include surrounding context.

md

- **Goal**: Prove the change is effective and does not break existing logic.
- **Input**: Changed code and validation scripts.
- **Action**: Run test commands or manually verify the criteria. If tests fail and you are stuck, you MUST auto-rollback using `git checkout -- <files>` or `git reset --hard`, and return to Phase 2.
- **Output**: Pass/fail evidence or rollback logs.

## Phase 5: Deliver (Closure & Snapshot)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises very broad implicit trigger phrases like 'clarify scope', 'smallest coherent change', and 'run validation', which are common in ordinary software requests. This can cause the skill to activate unexpectedly and import its workflow, tool usage, and persistence behaviors into unrelated tasks without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill says to always check and then update .claude/MEMORY.md, creating a persistent state channel that may store user preferences or project context without explicit consent each time. Persistent memory modification can leak sensitive information across tasks, poison future behavior, or overwrite trusted context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly recommends git reset --hard as part of a rollback plan without warning that it permanently discards uncommitted changes. In an agent execution loop, this creates a realistic risk of destructive data loss if followed automatically or by an operator who assumes the instruction is safe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to create and update persistent memory files across sessions without any explicit user notification, consent, review step, or data minimization controls. This is dangerous because task content, inferred lessons, or sensitive project details could be silently retained and later reused, creating privacy, data retention, and cross-task contamination risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code emits a user-visible error message in Chinese (JSON 根节点必须是对象) with no indication that the skill is region-specific or that users can choose their preferred language. The same pattern appears elsewhere in the file, suggesting a fixed locale rather than an opt-in or documented constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The validation error at this line (必须是对象) is another user-visible string forced to Chinese. Because the file contains multiple such messages and no language-selection mechanism, this creates a likely language policy issue for non-Chinese users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code writes JSON results to a user-specified path via write_text, which is a file-modifying operation. While the CLI argument name suggests output behavior, there is no confirmation prompt, log/print statement, or inline comment/docstring disclosing that the file will be created or overwritten when --output is used.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.