Openclaw Pr Maintainer

• Outcome: Review
• Latest audit: Nov 7, 2026 · 5:53 AM UTC
• Version: 1.0.4

Overview

ClawScan rated this skill suspicious because scanners flagged instructions that could bypass review and CI checks and extend cleanup rules beyond the skill’s stated scope; the scan was incomplete.

Consider the verdict a reason to review the skill’s instructions carefully before installing, especially the direct-push and broad cleanup rules. Skillspector scanned 4 of 5 components, and its tool-misuse analysis was degraded; some references were also unresolved. The evidence is therefore incomplete, and the suspicious verdict is not a claim that the author acted maliciously.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: references/landing.md

Finding

Emergency instructions redirect scoped landing authority into direct main pushes

Content

View full analysis

Impact

An agent with sufficient GitHub permissions can introduce changes directly into the shared main branch without the PR-based review and admission checks required by the ordinary workflow. A named-PR landing can also expand into an unsolicited baseline repair.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Emergency and cost-saving framing redirects the agent into bypassing review and CI safeguards.

High

• Category: Prompt Injection
• Confidence: 99% confidence

Finding

Emergency and cost-saving language instructs direct pushes to main without PR review, discourages confirming CI, and permits landing known PR-caused failures with a promised later fix. In a privileged maintainer workflow, this can introduce unreviewed or broken changes into the protected branch, contradicting the document's other exact-head and enforced-gate safeguards.

Content

No source excerpt is available for this finding.

The skill extends its cleanup policy to unrelated tasks, beyond its declared OpenClaw issue/PR scope.

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The instruction explicitly extends file-creation and cleanup rules to every task, crossing the skill's declared OpenClaw issue/PR boundary. This could cause an agent to delete proof or scratch belonging to unrelated workflows or suppress their evidence handoffs; ownership and retention safeguards reduce, but do not eliminate, that scope violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/media.md (reported line 13)May include surrounding context.

md

matching `gh pr` commands. Example: `gh pr comment <pr> --repo openclaw/openclaw --body-file <comment.md> --attach <proof.mp4>`.
- `gh --attach` video rules: accepted extensions are `.mp4`, `.mov`, and `.webm`; the local maximum is 100 MB, while GitHub's account limit may be lower. Do not add `#alt` to a video path. `gh` inserts a bare URL so GitHub renders a player, and the uploaded asset cannot be deleted.
- Compatibility fallback: if the installed `gh` lacks `--attach`, upload directly with `curl -s "https://uploads.github.com/user-attachments/assets?name=<file>&content_type=<mime>&repository_id=$(gh api repos/<owner>/<repo> --jq .id)" -X POST -H "Authorization: Bearer $(gh auth token)" -H "Accept: application/json" --data-binary @<file>`, then embed the returned `.url`: images as `![alt](url)`, video as a bare line so GitHub renders a player. For that endpoint, 422 = unsupported type and 404 = bad repo id/no push. Use `content_type` `video/mp4`, `video/quicktime`, or `video/webm`;