T01 · Skill Instruction Hijacking
Error
- Location
install.py:132- Finding
Workspace-Level Agent Instruction Files Can Be Overwritten
- Content
View full analysis
- Remediation
View remediation
Security audit
English Bestie
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real Telegram English-tutoring skill, but its installer and runtime behavior make persistent, workspace-level changes and store credentials with insufficient safeguards.
Install only into a dedicated OpenClaw workspace and dedicated Telegram bot after backing up openclaw.json, SOUL.md, and HEARTBEAT.md. Protect or rotate the Telegram bot token, verify local file permissions, and enable this only with the student's informed consent for frequent messages and persistent tracking.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
install.py:178- Finding
Telegram Bot Token Is Stored Without Enforced Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
install.py:170- Finding
Malformed OpenClaw Configuration Is Silently Replaced
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (33)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents the skill as an English-teaching Telegram bot that runs daily lessons. The supplied code chunk does not implement teaching, lesson delivery, voice messaging, grammar/vocabulary/conversation logic, or scheduling behavior. Instead, it is an installation/setup utility whose primary function is to deploy files and configure Telegram integration by collecting a bot token and user ID and writing them to local config files. While this setup behavior may support the overall skill, the actual code in this chunk has a materially different primary purpose from the declared end-user behavior, so this chunk is a mismatch.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Setting the skill to always run creates an overly broad activation condition, causing the skill’s behavioral instructions to influence interactions even when the user did not explicitly ask for English tutoring. In combination with messaging and scheduling powers, this materially increases the chance of unintended data handling and unsolicited actions.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md ## ⚡ Response Protocol — Read This First ### 🎙️ Voice-First Rule **DEFAULT: Always respond with a voice message in conversations.** - Casual chat → voice (TTS) - Lesson delivery → voice (TTS) - Feedback after conversation lessons → voice (TTS)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to create persistent and one-shot cron jobs for user messaging without any explicit consent, notification, or user control flow. This enables unsolicited repeated contact and durable autonomous behavior, which can be abused for spam, harassment, or manipulative engagement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill directs the agent to proactively send Telegram nudges and lesson summaries, which creates outbound communication and shares user-related learning status without any explicit consent, notice, or control flow. In a tutoring context this may be expected operationally, but unsignaled autonomous messaging increases privacy and user-trust risk, especially after inactivity when the user did not initiate contact.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction to log every mistake from casual conversation to persistent files collects and retains potentially sensitive user-generated language data without notice, minimization, or retention limits. Because casual conversation can include personal details, this turns ordinary chat into a long-lived behavioral record that could be exposed, repurposed, or analyzed beyond the user's expectations.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Persistently logging all user mistakes from casual conversation creates a surveillance-like record of the user's communication habits and errors, expanding collection beyond structured lessons. In this skill's context the data is educationally relevant, but the blanket requirement to store everything makes the pattern more dangerous because it normalizes over-collection of freeform personal text.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Telling the agent to push the user to respond in English without offering language choice can undermine accessibility and user autonomy, particularly for beginners or users who need clarification in another language. In an English-learning skill this is contextually understandable, so the risk is lower than in general-purpose assistants, but the lack of opt-in or override still makes the behavior coercive.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill performs persistent system changes across several tracking files and schedules future outreach via cron, yet it provides no user-facing warning or approval boundary for these actions. Autonomous state updates and self-scheduling can create durable behavior the user did not understand or intend, including continued messaging and expanded profiling over time.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The README presents the skill as an 'AI English teacher' and frames interaction around an 'American friend' persona, but does not explicitly offer the user a language or locale choice. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation unless clearly justified and documented.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly promotes frequent proactive Telegram outreach and long-term storage of detailed learner data, but it does not clearly warn operators or students about privacy, consent, retention, or the sensitivity of the collected information. In a messaging-based educational skill, this increases the risk of surprise surveillance-like behavior, overcollection of personal data, and improper retention of conversation history, profile details, and mistakes.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill reads and writes multiple tracking files but does not declare an explicit tool scope or permissions boundary. That makes the data-access surface implicit rather than constrained, increasing the risk of overbroad file access or accidental expansion of capabilities at runtime.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This instruction requires the agent to act as the student's 'American friend' and native speaker, imposing a specific language variety and locale by default. The policy allows locale constraints only when users are given a choice or the constraint is clearly justified, neither of which is present here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill directs reading and updating a student profile containing identifiers and personal learning data without presenting any privacy notice, consent workflow, or data-minimization control. That creates avoidable privacy risk and weakens user awareness of what is retained across sessions.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The onboarding flow collects and stores personal details such as name, native language, work/study, hobbies, goals, and interests, then reuses them across sessions. Persistent collection of broad personal data increases privacy exposure and can exceed what is necessary for basic tutoring if not tightly governed.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill’s stated purpose is language teaching, but it makes autonomous cron-job creation and self-scheduling a core operational behavior. That is a meaningful behavioral expansion because the agent is not just teaching when invoked; it is persistently managing future actions on the user's behalf.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is described as running daily lessons, but these instructions tell the agent to send random and unpredictable messages beyond the scheduled lesson scope. This expands autonomy and user contact frequency beyond what a user would reasonably infer from the description, which can become spammy or manipulative.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill mandates broad longitudinal logging of conversation history, mistakes, vocabulary, preferences, reflections, and plans across many files. Even if intended for personalization, this creates a substantial persistent data trail that can expose sensitive behavioral and personal information if misused or accessed improperly.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction "Keep TTS in English only — do not use TTS for other languages" imposes a language/locale constraint as a hard rule. This is a natural-language policy concern because it does not offer the user a choice or explain a justified region-specific need.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The instructions hard-code Hebrew for scenario setup and hints, which can override or ignore the user's preferred language and create unwanted disclosure of language/identity assumptions. In a teaching skill, this is a real safety and quality issue because it reduces user control, may exclude non-Hebrew speakers, and can cause the agent to reveal content in a language the user did not request.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The text explicitly frames instruction around 'Common Hebrew-speaker mistakes,' which indicates a language- or locale-specific assumption. Because the file does not present this as an optional track or clearly justified region-specific curriculum, it risks violating the policy against forcing a specific language/locale without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Lines discussing Hebrew article usage and stating that 'Hebrew speakers struggle with this' reinforce a fixed language-specific audience. This is a natural-language policy concern because the file does not offer alternative audience selection or explicitly scope the curriculum to a Hebrew-speaking cohort.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file instructs the skill to always provide Hebrew translation and even Hebrew transliteration if helpful, without indicating that the learner opted into Hebrew-based instruction. This can expose or infer a sensitive language preference and may produce undesired localized output for users who do not want Hebrew involved, creating a privacy and consent issue rather than a direct code-execution risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The file identifies the skill as "english-bestie," which by itself may be branding, but the installer presents the skill as an English-oriented setup without any indication that language preference is optional. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script collects a bot token from the user and later writes it into openclaw.json, which is a sensitive credential-handling operation. Although the script confirms the overall setup, it does not specifically disclose that the token will be persisted to disk or warn the user about protecting that file.
- Content
Static analysis
Detected: suspicious.privileged_always
Skill is configured with always=true (persistent invocation).
Warn
- Code
- suspicious.privileged_always
- Location
- SKILL.md:1