T06 · System Persistence
Error
- Location
08-checklist.md:40- Finding
Recurring Autonomous Agent Execution Through Scheduled Tasks
- Content
View full analysis
- Remediation
View remediation
Security audit
AI Agent Training Manual
Security checks for vulnerabilities and agentic risk
Overview
This markdown training manual is mostly coherent, but it teaches agents to create persistent automation and handle sensitive local context with too little scoping or approval.
Review and edit this manual before installing it into a live agent. Do not follow the broad token-search command, require explicit approval before creating cron jobs or sending/sharing content externally, add retention and redaction rules for memory/logs/backups, and avoid global unpinned package installs.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
01-mindset.md:33- Finding
Filesystem-Wide Credential Discovery and Exposure of Tokens in Command Output
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
01-mindset.md:44- Finding
Untrusted Corrections Can Be Persisted and Promoted Into Core Agent Instructions
- Content
View full analysis
write it to a file first -> then reply Learned new knowledge -> write it to a file first -> then reply Made a decision -> write it to a file first -> then reply ``` It assigns the content to durable files: ```text Temporary information -> memory/YYYY-MM-DD.md Persistent knowledge -> MEMORY.md Error lessons -> .learnings/ERRORS.md Tool techniques -> TOOLS.md ``` The onboarding workflow then requires the agent to reload those files and promote selected lessons into core instructions: ```text - At every session start, read SOUL.md, USER.md, and today's and yesterday's logs. - Record corrections immediately in .learnings/LEARNINGS.md. - Write a daily memory log. - Promote high-value lessons into SOUL.md, TOOLS.md, or AGENTS.md. ``` ### Technical Analysis The workflow creates a durable trust transition: 1. Conversation content is classified as a correction, lesson, decision, or feature request. 2. It is written into persistent memory without a provenance requirement. 3. It may later be promoted into core behavior files. 4. Those behavior and memory files are reloaded in future sessions. No validation mechanism distinguishes an authenticated user correction from untrusted content encountered in email, group chat, a web page, a document, or delegated-agent output. There is also no requirement to store external content as inert quoted data rather than executable agent instructions. Consequently, prompt-injection text can move from an untrusted content channel into persistent state and ultimately into files that govern future agent behavior. The daily learning-review cron described elsewhere in the project increases the risk ...[truncated 1442 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
04-tools.md:131- Finding
Unpinned Global Package Installation Through a Mutable Third-Party Registry
- Content
View full analysis
clawhub install --dir ~/.openclaw/skills/ clawhub install --dir /tmp/clawhub-preview clawhub install ``` ### Technical Analysis The npm command resolves the current version available under the package name at installation time. It does not pin an exact version, verify an integrity hash, use a lockfile, or isolate installation to the project. The `-g` flag broadens the installation scope and may expose the package's executable entry points to unrelated sessions and projects. Changing npm's persistent registry configuration to a mirror changes the trust source for subsequent npm operations, not only the Mermaid installation. If the mirror is compromised, stale, misconfigured, or serves a malicious release, installation lifecycle scripts and package binaries can execute with the privileges of the installing account. The ClawHub instructions recommend previewing some Skills, which is a partial safeguard, but they do not require source audit, version pinning, publisher verification, signature verification, or sandboxed execution before enabling a Skill in the live agent environment. ### Attack Path 1. An agent follows the installation instructions and persistently changes the npm registry. 2. It requests the latest unpinned Mermaid CLI package or an unpinned ClawHub Skill. 3. A compromised registry, publisher account, mutable release, or ...[truncated 1042 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (22)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
常见坑
text ❌ 用 gog auth list 检查状态（WSL2 无 TTY 环境 keyring 不可用） ❌ --to A --to B 发多人（后面覆盖前面，只发给最后一个） ✅ 多人分开发，每人一封 ❌ OAuth token 过期后继续尝试发送
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The entire skill is written in Chinese and presents its operating principles exclusively in that language, with no indication that the user can opt into another language or that the skill is intended only for a Chinese-speaking context. Under the policy, forcing a specific language without user choice is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document title and all operational instructions are written only in Chinese, which establishes a language-specific interaction policy without any opt-in or alternative language path. Under the policy rule, forcing a specific language is a natural-language policy violation unless the locale constraint is explicitly justified or optional.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instruction "中文为主，专业术语保留英文" sets a default language policy for responses rather than offering language choice based on user preference or context. This is a natural-language policy issue because it forces a locale preference without explicit opt-in, and the surrounding guidance does not document a justified region-specific constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guide instructs agents to make Feishu documents publicly accessible for external recipients by setting broad sharing options, but it does not require confirming that the document contains no sensitive or internal-only data. This can lead to accidental data exposure outside the organization through overbroad link sharing.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest describes this skill as a new-agent training manual covering best practices and onboarding guidance. While general tool-usage advice fits that purpose, detailed operational instructions for sending Gmail messages extend into an active external-communication capability that is not obviously necessary for a training handbook itself.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The email instructions provide a ready-to-use external send flow without explicitly requiring user confirmation of recipients, content, and the fact that data will leave the system boundary. That omission increases the risk of accidental disclosure of sensitive content or misdirected messages.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
A training manual can reasonably mention tools, but these lines give concrete curl commands and endpoint usage for external network access. That capability is not inherently required by a new-employee handbook unless the manifest explicitly says it includes operational API usage guides for external services.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest frames the skill as a handbook for mindset, norms, checklists, and recommended skills. Instructions to reconfigure npm registries and globally install mermaid-cli are operational system-modification steps that are broader than a documentation-only onboarding purpose.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The Git guidance explicitly notes that remote URLs may contain tokens and encourages checking them during troubleshooting, but it does not instruct agents to avoid echoing, logging, or sharing those secrets. In a training context, this normalizes handling secret-bearing URLs in plain view and can lead to credential leakage in chat, logs, or screenshots.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The cron configuration example states that the timezone must be set to "Asia/Shanghai", which imposes a specific locale choice in natural-language guidance. The file does not indicate that this is optional, user-selected, or limited to a region-specific deployment, so it can violate language/locale policy expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The guidance says to automatically set Feishu document permissions after creation for external users, but it does not require least-privilege sharing, recipient verification, or any warning about exposing sensitive content. In a training manual for new agents, this can normalize making documents broadly accessible and increase the chance of unintended data disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The checklist directs the agent to record user basic information, preferences, and needs in USER.md without any privacy notice, minimization rule, retention limit, or consent checkpoint. This encourages unnecessary collection of personal data and creates a durable record that could later be exposed, reused out of context, or retained longer than intended.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The checklist establishes persistent storage of user information and repeated review of memory files, which creates a natural-language data retention surface without limits on content sensitivity, access, or retention duration. In an agent training context, this is especially risky because it operationalizes routine accumulation of personal and behavioral data across sessions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The checklist instructs deletion of BOOTSTRAP.md immediately after onboarding without requiring user confirmation, backup, or verification that the file is no longer needed. This can cause loss of provenance, setup instructions, or guardrails that may still be operationally important, and normalizes destructive file actions in a training document.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Instructing the agent to reread SOUL.md, USER.md, and recent logs at every session startup encourages broad reuse of previously collected user data regardless of present need. This increases the chance of overexposure, context leakage between tasks, and reliance on stale or overly sensitive historical notes.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
A mandatory daily log of interactions promotes continuous retention of operational and potentially user-specific details without stating what must be excluded or how long records should be kept. Over time this can accumulate sensitive data, increase disclosure risk, and create an unnecessary audit trail of personal or confidential information.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
该文档全文以中文呈现，并以“AI 代理新员工培训手册”的形式规定培训内容，但未说明这是特定地区/语言场景专用，也未提供其他语言或用户选择。这可能构成语言/locale 策略违规，因为技能文档默认强制特定语言而没有用户 opt-in。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 74% confidence
- Finding
The file presents operational instructions entirely in Chinese and uses prescriptive language throughout, but does not indicate that Chinese is an intentional locale requirement or offer an alternative language option. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file contains user-facing natural-language instructions exclusively in Chinese, including titles, explanations, and warnings. Under the language/locale policy rule, forcing a single language without opt-in or documenting a justified locale constraint can be a policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 70% confidence
- Finding
All instructional content in the file is presented only in Chinese, with no indication that the user may choose another language or locale. This can constitute a language policy issue when a skill implicitly forces one language without opt-in or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description and the entire training manual are presented in Chinese, with no indication that users can choose another language or locale. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable unless the locale constraint is explicitly documented and justified.
- Content
Static analysis
No suspicious patterns detected.