T01 · Skill Instruction Hijacking
Error
- Location
templates/AGENTS.md:7- Finding
Untrusted Bootstrap File Can Hijack Agent Instructions and Erase Evidence
- Content
View full analysis
- Remediation
View remediation
Security audit
Cli Tool Template
Security checks for vulnerabilities and agentic risk
Overview
This CLI template is not clearly malicious, but it gives agents broad persistent-memory and autonomous workspace-editing instructions that users should review before installing.
Before installing, review and edit the templates. Remove or constrain the BOOTSTRAP.md follow-and-delete rule, require explicit approval before writing memory or modifying AGENTS.md, TOOLS.md, or skill files, and make heartbeat activity read-only unless you deliberately opt in to specific file changes. Also expect Japanese-language documentation and placeholders.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T01 · Skill Instruction Hijacking
Error
- Location
templates/AGENTS.md:9- Finding
Persistent Action Items Are Prioritized Over the Current User Request
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
templates/AGENTS.md:42- Finding
Conversation Content Can Be Persisted and Converted into Governing Agent Instructions
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
templates/AGENTS.md:240- Finding
Heartbeat Instructions Authorize Unapproved Workspace and Memory Modification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (14)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The natural-language content throughout the file is exclusively Japanese, and there is no indication that the skill is intentionally limited to Japanese users or that other language options are available. The policy specifically calls for flagging language or locale constraints when they are imposed without user opt-in or justification.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
テンプレートの使用
bash # エージェントのワークスペースを作成 mkdir -p ~/.openclaw/workspace/my-cli-tool # テンプレートをコピー cp -r ~/.openclaw/workspace/skills/cli-tool-template/templates/* \
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
テンプレートの使用
bash # エージェントのワークスペースを作成 mkdir -p ~/.openclaw/workspace/my-cli-tool # テンプレートをコピー cp -r ~/.openclaw/workspace/skills/cli-tool-template/templates/* \
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description is written entirely in Japanese and the rest of the skill documentation also assumes Japanese as the interaction language. Under the policy, language constraints should be opt-in or explicitly justified; this file does not offer a language choice or explain a required locale.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction to delete
BOOTSTRAP.mdon first run authorizes file deletion without requiring explicit user confirmation or even a user-facing notice. Even if intended as workspace hygiene, this normalizes autonomous destructive behavior and could remove information needed for auditability, troubleshooting, or user review.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs the agent to create and update
memory/files andMEMORY.mdas part of normal operation without clearly warning the user that workspace files will be modified automatically. This can lead to silent persistence of conversation-derived data, including sensitive context, and creates side effects users may not expect from a template skill.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Safety - Don't exfiltrate private data. Ever. - Don't run destructive commands without asking. - `trash` > `rm` (recoverable beats gone forever) - When in doubt, ask.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **Ask first:** - Publishing to PyPI/npm without approval - Accessing external systems without credentials - Running commands that affect system-wide state - Pushing to public repositories
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
The phrase 'Proactive work you can do without asking' explicitly authorizes autonomous actions, including running tests and updating documentation. In this workspace context, that makes the skill more dangerous because it encourages unattended changes and command execution during background heartbeats, increasing the chance of unintended side effects or silent modifications.
- Content
md - Nothing new since last check - You just checked <30 minutes ago **Proactive work you can do without asking:** - Run tests and check coverage - Update documentation
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The heartbeat section authorizes proactive background edits such as updating documentation and memory files without explicit approval at the time of change. This increases risk because the agent may alter project artifacts outside the user's immediate awareness, potentially introducing inaccurate edits, leaking sensitive context into files, or creating hard-to-audit changes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The instructions and operational guidance are entirely in Japanese, which effectively imposes a specific language on users. The file does not indicate that this is region-specific, nor does it offer an opt-in or alternative language.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file defines when the heartbeat should run using a placeholder ('頻度 - 例: 1日1回、1日2回') instead of a concrete cadence. That makes the activation condition ambiguous and could lead to inconsistent or unintended invocation timing.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file contains user-facing natural-language content exclusively in Japanese across the listed changelog entries. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation, and this file does not indicate that the skill is intentionally region-specific or that alternative languages are available.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This markdown template uses Japanese placeholder text throughout the user profile fields, including the language field itself, which can impose a specific language/locale expectation in the skill content. The file does not explicitly state that users may choose any preferred language or locale beyond examples, so it risks a mild language-policy issue.
- Content
Static analysis
No suspicious patterns detected.