Multi-Angle-Thinking

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:49 AM UTC
• Version: 1.0.1

Overview

The skill is not malicious, but it needs review because optional hooks can silently steer the agent on broad prompts and encourage web searches.

Install the core skill only if you want deep analysis that may use web search and fictionalized simulations. Be careful enabling the OpenClaw hook or session activator: they can change agent behavior automatically on broad phrases, so prefer explicit invocation or disable the hook when not needed. Avoid using it with private personal data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill promises a constrained, explicit-user-invoked deep-analysis workflow, but the implemented behavior reportedly auto-triggers on broad keywords and does not actually perform the described search, analysis, or simulation pipeline. This mismatch is dangerous because users and higher-level agents may rely on the declared safeguards and capabilities, causing unintended invocation, misleading outputs, or policy bypass through a skill that behaves differently than advertised.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The listed trigger phrases include broad, natural-language requests such as "analyze this," "think deeply about," and Arabic equivalents that can overlap with normal conversation. In an agentic environment, this increases the chance of unintended invocation, causing the skill to perform web searches and expansive simulation behavior when the user did not clearly consent to that workflow.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrases include broad, common language such as 'analyze this' and 'what am I missing,' which can overlap with ordinary conversation and cause accidental activation. In an agent environment, overbroad triggers can hijack routing, invoke the wrong skill without informed user intent, and increase the chance of unnecessary web access, simulation on sensitive topics, or misleading authoritative outputs.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest says the skill gathers real global data via web search, analyzes through 11 distinct lenses, and builds a full realistic simulation with real characters. This hook documentation says it only monitors prompts and injects a brief reminder of a 5-step pipeline, indicating the implemented behavior in this skill file is substantially more limited than the claimed skill behavior.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The hook monitors broad, common phrases such as 'analyze' and 'simulate', which can cause unintended activation in ordinary conversations. In a hook that automatically injects extra context into the agent, overbroad triggers can create prompt-context manipulation, unexpected behavior changes, and unnecessary expansion of the model's operational instructions across unrelated tasks.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The hook automatically injects behavior based on broad keyword matching, which conflicts with the stated requirement that the skill be invoked only on explicit user request. This creates unintended activation and prompt-scope manipulation: benign user prompts containing generic words like 'analyze' or 'simulate' can silently alter model behavior and steer it into web-search and simulation workflows the user did not clearly consent to.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The hook silently appends an instruction block to the model context without notifying the user at activation time. Hidden prompt injection at the framework level reduces transparency, can override user expectations, and may cause the assistant to perform extra searches, simulations, or reasoning patterns that the user did not knowingly request.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script injects a reminder that explicitly directs the agent to perform 'intelligence gathering (web search)' but provides no requirement for user consent, no notice about external network access, and no constraint that search only occur when the user has authorized it. In an agent setting, this can lead to unintended data transmission or privacy surprises, especially because the activator biases behavior at session start and may normalize network use for broad trigger phrases like 'analyze this'.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The README prominently frames the skill in English and Arabic, but does not explicitly state that users may choose their preferred output language or locale. Because policy issues here hinge on natural-language behavior, the absence of an opt-in or choice mechanism creates a mild locale-policy concern.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The example output is explicitly framed around 'a startup in the Arab world,' which constrains the analysis to a specific regional context. Because the file does not indicate that this locale was user-selected or that alternative locales are supported, it can be read as a locale-specific framing without documented opt-in.

Intent-Code Divergence

Low

• Confidence: 83% confidence
• Finding: The comments describe a semantic condition—when deep analysis is needed—suggesting intent-aware behavior. In practice, the handler performs only naive substring checks on a fixed trigger list, which can fire without establishing that deep analysis is actually needed.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The trigger list explicitly includes Arabic phrases in addition to English, which imposes language-specific activation behavior without any visible explanation or opt-in in this file. This can create undocumented locale-dependent behavior and fits the policy concern around language or locale handling.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: Policy-violation checks apply to all file types, including shell scripts. Embedding specific non-user-selected language triggers can create a language/locale behavior constraint without documenting choice or opt-in, particularly when the skill appears to activate on phrases in multiple languages automatically.

Static analysis

No suspicious patterns detected.