T01 · Skill Instruction Hijacking
Error
- Location
templates/AGENTS.md:7- Finding
Untrusted Bootstrap Instructions Can Hijack Agent Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
Data Analysis Workflow
Security checks for vulnerabilities and agentic risk
Overview
This is a data-analysis workspace template, but its agent template gives broad persistent memory and bootstrap authority that users should review before installing.
Install only if you are comfortable using this as a starting template and will edit AGENTS.md before relying on it. Remove or constrain the BOOTSTRAP.md rule, require confirmation for memory-derived actions and cleanup, keep secrets out of TOOLS.md, and review persistent memory files periodically.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
templates/AGENTS.md:15- Finding
Persistent Memory Instructions Permit Cross-Session Memory Poisoning
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
templates/AGENTS.md:116- Finding
Template Encourages Plaintext Storage of API Keys and Database Connection Details
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill description is presented in Japanese, including headings, usage, and support text, with no indication that other languages are supported or that the Japanese-only scope is intentional. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
テンプレートの使用
bash # エージェントのワークスペースを作成 mkdir -p ~/.openclaw/workspace/my-data-analysis # テンプレートをコピー cp -r ~/.openclaw/workspace/skills/data-analysis-workflow/templates/* \
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
テンプレートの使用
bash # エージェントのワークスペースを作成 mkdir -p ~/.openclaw/workspace/my-data-analysis # テンプレートをコピー cp -r ~/.openclaw/workspace/skills/data-analysis-workflow/templates/* \
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file's title, description, instructions, and examples are all presented in Japanese, which effectively imposes a specific language on users. The policy allows locale constraints when they are explicitly documented and justified or when users are given a choice, neither of which appears here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction to delete BOOTSTRAP.md on first run encourages irreversible modification of workspace state without any confirmation, audit step, or user-visible warning. Even if intended as cleanup, it can destroy provenance or setup guidance that later sessions may need, and normalizes autonomous file deletion by the agent.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Safety - Don't exfiltrate private data. Ever. - Don't run destructive commands without asking. - `trash` > `rm` (recoverable beats gone forever) - When in doubt, ask.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Sending emails, tweets, public posts - Anything that leaves the machine - Accessing external databases without credentials - Deploying models without approval ## Data Analysis Workflow
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
The skill explicitly authorizes proactive work 'without asking,' including cleaning logs, updating dashboards, documenting workflows, and editing MEMORY.md during heartbeats. Although framed as helpful maintenance, this grants the agent standing authority to modify files and artifacts without contemporaneous user consent, which can lead to unintended data loss, tampering with experiment evidence, or silent changes to long-term memory and reporting.
- Content
md - Nothing new since last check - You just checked <30 minutes ago **Proactive work you can do without asking:** - Review and clean up old experiment logs - Update model performance dashboards
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown skill is entirely written in Japanese, including its purpose, steps, and cautions, which effectively forces a specific language on users. The file does not indicate that Japanese is optional, user-selected, or required for a justified region-specific use case.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file contains user-facing natural language entirely in Japanese, but it does not indicate that the language is optional or that users may choose another locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The file prescribes a specific language/token choice by instructing the agent to reply with
HEARTBEAT_OKin quiet cases. This imposes a fixed locale/language convention without offering user choice or documenting a justified locale requirement.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The template hard-codes several user-facing field descriptions in Japanese alongside English headings, which may impose a language/locale assumption on downstream use. The file does not explicitly say the user can choose a preferred language for the template itself, even though it asks for a communication language.
- Content
Static analysis
No suspicious patterns detected.