Agent Starter Kit

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:26 AM UTC
• Version: 1.0.0

Overview

This starter kit is mostly disclosed template content, but its default agent rules allow persistent memory, recurring monitoring, bootstrap instruction following, and repository pushes without enough user control.

Install only if you are comfortable editing the templates before starting an agent. In particular, remove or gate the BOOTSTRAP.md follow/delete rule, require confirmation before any commit or push, make heartbeat checks opt-in per service, and treat memory files as untrusted notes rather than instructions. Avoid connecting email, calendar, social, or repository credentials until those boundaries are explicit.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: templates/AGENTS.md:5

Finding

Untrusted Bootstrap File Can Hijack Agent Instructions

Content

View full analysis

Vulnerability Details

File Location: templates/AGENTS.md:5-7
Vulnerability Type: Untrusted instruction execution and evidence deletion
Risk Level: High

Vulnerable Code Snippet

markdown

## First Run

If `BOOTSTRAP.md` exists, that's your birth certificate. Follow it, figure out who you are, then delete it. You won't need it again.

Technical Analysis

The template directs the agent to treat any workspace-level BOOTSTRAP.md file as authoritative, follow its instructions, and then delete it. It does not require:

• Verification of the file's provenance or integrity.
• Inspection or approval by the user.
• Restriction of the tools or data available while processing it.
• Confirmation that higher-priority safety constraints take precedence.
• Preservation of the file for subsequent investigation.

Consequently, any party capable of creating or modifying BOOTSTRAP.md can inject instructions that alter the agent's initial goals or request tool operations. Automatic deletion also removes the original instruction source, reducing auditability.

This issue does not itself grant filesystem access to a remote attacker. Exploitation requires an attacker, compromised process, malicious package, or other actor to already have the ability to place or modify a file in the agent workspace.

Attack Path

1. An attacker or compromised component obtains write access to the agent workspace.
2. The attacker creates a malicious BOOTSTRAP.md.
3. The file instructs the agent to disclose workspace information, change behavioral constraints, invoke available tools, or perform another unauthorized action.
4. The agent starts and automatically treats the file as authoritative.
5. The agent follows the injected instructions using whatever tools and permissions are available in its runtime.
6. The agent deletes BOOTSTRAP.md, removing the primary source of the malicious instructions.

Impact Asse

...[truncated 421 chars]

Remediation

View remediation

Remediation Suggestions

• Treat BOOTSTRAP.md as untrusted input rather than authoritative instructions.
• Display its contents and require explicit user approval before applying any behavior-changing directive.
• State that platform policies, safety requirements, and current user instructions always take precedence.
• Parse bootstrap content through a strict allowlist of declarative configuration fields instead of executing free-form instructions.
• Do not permit bootstrap content to authorize network operations, secret access, destructive commands, or changes to safety controls.
• Do not delete the file automatically. Archive it with integrity metadata or require explicit approval before removal.
• Restrict workspace write access and validate the file's owner, permissions, expected path, and cryptographic digest where practical.

T02 · Agent Memory Poisoning

Error

• Location: templates/AGENTS.md:14

Finding

Conversation Content Can Poison Automatically Loaded Persistent Memory

Content

View full analysis

Vulnerability Details

File Location: templates/AGENTS.md:14-17, templates/AGENTS.md:30-44, and templates/AGENTS.md:190-197
Vulnerability Type: Persistent memory poisoning through insufficiently validated conversational input
Risk Level: High

Vulnerable Code Snippets

markdown

3. Read `memory/YYYY-MM-DD.md` (today + yesterday) for recent context
4. **If in MAIN SESSION** (direct chat with your human): Also read `MEMORY.md`
5. **Check for unresolved next actions** — scan the last entry in `MEMORY.md` for any pending action items. If found, surface them immediately before anything else. Don't wait to be asked.

markdown

### 🧠 MEMORY.md - Your Long-Term Memory

- **ONLY load in main session** (direct chats with your human)
- **DO NOT load in shared contexts** (Discord, group chats, sessions with other people)
- This is for **security** — contains personal context that shouldn't leak to strangers
- You can **read, edit, and update** MEMORY.md freely in main sessions
- Write significant events, thoughts, decisions, opinions, lessons learned
- This is your curated memory — the distilled essence, not raw logs
- Over time, review your daily files and update MEMORY.md with what's worth keeping

### 📝 Write It Down - No "Mental Notes"!

- **Memory is limited** — if you want to remember something, WRITE IT TO A FILE
- "Mental notes" don't survive session restarts. Files do.
- When someone says "remember this" → update `memory/YYYY-MM-DD.md` or relevant file

markdown

### 🔄 Memory Maintenance (During Heartbeats)

Periodically (every few days), use a heartbeat to:

1. Read through recent `memory/YYYY-MM-DD.md` files
2. Identify significant events, lessons, or insights worth keeping long-term
3. Update `MEMORY.md` with distilled learnings
4. Remove outdated info from MEMORY.md that's no longer relevant

Technical Analysis

The template creates a persistent tr ...[truncated 2268 chars]

Remediation

View remediation

Remediation Suggestions

• Treat all memory content as untrusted contextual data, never as authoritative instructions.
• Persist only factual, user-approved information and explicitly prohibit storage of commands, policy overrides, credentials, and tool-execution directives.
• Require confirmation before writing conversational content to daily or long-term memory.
• Require a separate approval step before promoting daily notes into MEMORY.md.
• Attach provenance metadata to every entry, including source session, author, timestamp, trust level, and approval status.
• Separate factual memory from action queues. Pending actions should require current-session reconfirmation before execution.
• Sanitize quoted or third-party content and clearly delimit it so that it cannot be interpreted as instructions.
• Add integrity checks, version history, and an auditable change log for persistent memory.
• Never allow a memory entry to weaken safety controls or authorize external, destructive, or privileged operations.

T09 · Insecure Skill Coding Practices

Warning

• Location: templates/AGENTS.md:180

Finding

Heartbeat Instructions Permit Repository Pushes Without User Approval

Content

View full analysis

Vulnerability Details

File Location: templates/AGENTS.md:180-188
Vulnerability Type: Unapproved external repository modification
Risk Level: Medium

Vulnerable Code Snippet

markdown

**Proactive work you can do without asking:**

- Read and organize memory files
- Check on projects (git status, etc.)
- Update documentation
- Commit and push your own changes
- **Review and update MEMORY.md** (see below)

Technical Analysis

This instruction explicitly authorizes the agent to commit and push changes without asking the user. A push modifies a remote repository and transmits repository content outside the local machine. This conflicts with the same template's earlier rule that actions leaving the machine require approval.

The instruction does not require inspection of:

• The staged diff or files included in the commit.
• The destination remote and repository owner.
• The target branch.
• Embedded credentials, private data, or generated artifacts.
• Branch-protection requirements or organizational change controls.

Because heartbeat execution is proactive, the push may occur without an active user reviewing the changes. The risk is especially significant if another instruction-hijacking or memory-poisoning issue causes the agent to modify files before the heartbeat runs.

Attack Path

1. The agent has access to a Git repository and credentials that permit remote pushes.
2. Files are changed by the agent, user, another local process, or poisoned persistent instructions.
3. A heartbeat is triggered.
4. The agent interprets the template as authorization to commit and push without asking.
5. The agent stages unintended files or sensitive content and creates a commit.
6. The commit is pushed to the configured remote and becomes accessible according to that repository's visibility and permissions.

Impact Assessment

Successful exploitation or accidental activation can mod ...[truncated 542 chars]

Remediation

View remediation

Remediation Suggestions

• Remove push from the list of actions permitted without approval.
• Require explicit, per-operation user confirmation immediately before every push.
• Present the complete staged diff, remote URL, target branch, commit message, and affected files before requesting approval.
• Run secret scanning and sensitive-file checks before staging or pushing.
• Default to local read-only inspection during heartbeats.
• Permit local commits only when explicitly requested or governed by a narrowly scoped, user-approved policy.
• Use least-privilege Git credentials, protected branches, signed commits, and mandatory pull-request review.
• Prevent heartbeat jobs from accessing production deployment credentials or unrestricted repository tokens.
• Reconcile the template's policy so that all network-visible actions consistently require approval.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document presents all user-facing instructions and descriptions in Japanese, which effectively forces a specific language for understanding and use. Under the stated policy, language-specific behavior should either be optional or clearly documented and justified.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

テンプレートの使用

bash

# エージェントのワークスペースを作成
mkdir -p ~/.openclaw/workspace/my-agent

# テンプレートをコピー
cp -r ~/.openclaw/workspace/skills/agent-starter-kit/templates/* \

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file uses Japanese throughout the skill description and instructions, but does not indicate that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

ステップ1: テンプレートをコピー

bash

# エージェントのワークスペースを作成
mkdir -p ~/.openclaw/workspace/my-agent

# テンプレートをコピー
cp -r ~/.openclaw/workspace/skills/agent-starter-kit/templates/* \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to delete BOOTSTRAP.md on first run encourages file deletion without a confirmation step or warning. Even if intended as cleanup, it normalizes destructive behavior early in execution and could remove important setup or audit information before the user verifies the agent's initialization.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · templates/AGENTS.md (reported line 76)May include surrounding context.

md

## Safety

- Don't exfiltrate private data. Ever.
- Don't run destructive commands without asking.
- `trash` > `rm` (recoverable beats gone forever)
- When in doubt, ask.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This template goes beyond defining workspace conventions and authorizes ongoing operational behavior such as heartbeat-driven monitoring, project checking, documentation updates, and repository actions. In a starter-kit context, these instructions can cause an agent to take real actions unrelated to setup, increasing the risk of unauthorized activity and scope creep.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The template instructs the agent to monitor external services such as email, calendars, social mentions, and weather on a recurring basis. For a generic starter kit, this grants broad surveillance-like access without proving necessity, which can expose sensitive personal data and trigger unapproved external interactions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The 'without asking' language authorizes proactive work, including project inspection, documentation updates, and repository changes, without requiring user approval. This creates a clear pathway for autonomous modification of local and remote assets, which is especially risky in a template likely to be reused broadly.

Content

Scanner excerpt · templates/AGENTS.md (reported line 182)May include surrounding context.

md

- Nothing new since last check
- You just checked <30 minutes ago

**Proactive work you can do without asking:**

- Read and organize memory files
- Check on projects (git status, etc.)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The template explicitly authorizes proactive repository-affecting actions, including updating documentation and committing and pushing changes without asking. This can mutate codebases or publish changes remotely without review, creating integrity, change-management, and potential data-leak risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template defines recurring autonomous behavior but does not specify clear trigger conditions, scope boundaries, authorization requirements, or safe failure conditions. In an agent starter kit, this ambiguity can lead downstream users to implement periodic actions that run too broadly or at the wrong time, increasing the risk of unintended side effects, policy violations, or repeated execution of sensitive operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The template instructs the agent to perform actions, record what it did to memory, and optionally report results without any warning about data sensitivity, persistence, or operational impact. In a reusable starter kit, this can normalize storing sensitive information or executing state-changing actions during periodic checks without consent, minimization, or audit safeguards.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The template contains multiple required placeholder labels written only in Japanese, such as at L03, L09-L16, L22-L24, and L35-L49. As a reusable skill template, this implicitly steers authors toward Japanese-only content without documenting a locale choice or justified regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown template uses Japanese-only field labels and examples, including the communication-language field itself, which creates an implicit language requirement for users filling out the file. The policy allows locale constraints only when documented and justified or when users are given a choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The changelog entries from L05-L10 are presented exclusively in Japanese, which can constitute a language-policy concern when no user opt-in, alternative language, or locale-specific justification is provided. Because this is documentation text rather than behavior-enforcing code, the impact is limited but still reflects a natural-language locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The template directs the agent to mimic human social behavior in group chats, including using reactions and timing contributions naturally, without explicit user opt-in. While not directly destructive, this can misrepresent the agent's nature, create social engineering concerns, and lead to unapproved participation in shared spaces.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown template includes required content prompts in Japanese embedded within an otherwise English document, which can implicitly force authors toward a specific language or locale. Because the file does not offer an explicit language choice or explain that the locale is optional, it may conflict with language/locale neutrality expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.