Security audit

Skill Creator

Security checks for vulnerabilities and agentic risk

Overview

This documentation-only skill helps users create and edit OpenClaw skills, with persistent skill-file changes clearly tied to that purpose.

Install this if you want help drafting or reviewing OpenClaw skills. Because generated workspace skills can persist and auto-load later, review any generated SKILL.md carefully, especially its trigger description, language policy, and whether it gives future agents the right scope.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.
md
description: > Create, edit, improve, tidy, review, audit, or restructure OpenClaw AgentSkills and SKILL.md files. Optimized for OpenClaw's architecture: sub-agents, context fork, skill auto-loading, and references/. Covers the full lifecycle: analyze existing work → extract patterns → design skill → write SKILL.md → test → iterate. Keywords: skill, create skill, skill creator, SKILL.md, 스킬, 스킬 만들기, 스킬 생성, 스킬 개선, 스킬 수정, 스킬 검토, 스킬 작성, スキル, スキル作成, スキル生成, スキル作成, 技能创建, 创建技能, 生成技能, 改进技能. ---

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description uses very broad trigger terms like create, edit, improve, review, audit, and restructure, which overlap with many ordinary writing or maintenance requests. In an auto-loading skill system, this can cause the skill to activate in contexts the user did not intend, increasing prompt-surface area and enabling unintended steering of unrelated tasks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The language policy says the SKILL.md body should always be written in English, regardless of the user's requested language. This can override user intent and create unsafe or unreliable transformations in multilingual workflows, especially when the agent is asked to preserve original language, legal wording, or locale-specific meaning.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire skill reference is written in Korean and does not indicate any user opt-in, alternative language option, or region-specific justification. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The guidance to include broad trigger keywords, including localized terms, is underspecified and can cause the skill to activate in overly general contexts. In a skill that creates or edits other skills, accidental invocation is more dangerous because it can steer unrelated tasks into modifying agent behavior or generating prompt-bearing artifacts, increasing the chance of misuse or prompt-injection propagation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Line L84 instructs authors to include trigger keywords in both English and the local language. This imposes a language policy requirement in the skill guidance rather than offering a user choice or documenting a justified locale constraint, which fits the natural-language policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Line L84 explicitly recommends including both English and localized trigger keywords in the description. This imposes a language/locale behavior requirement without indicating user choice or opt-in, which matches the policy category for language or locale constraints.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.