Agent Smith

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:59 PM UTC
• Version: 0.3.1

Overview

This skill is not plainly malicious, but it needs review because its optional persistent hook can influence future agent sessions to publish decision rationale to a public third-party service.

Install only if you want agents to build a public decision record on the Agent Smith service. Do not post secrets, private customer data, proprietary architecture details, incident details, internal hostnames, or raw chain-of-thought. If you enable the OpenClaw hook, understand that it will keep adding reminders in later qualifying sessions until you disable or remove the hook.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: hooks/openclaw/handler.ts:10

Finding

Persistent Bootstrap Instruction Injection Encourages External Disclosure

Content

View full analysis

Vulnerability Details

File Location: hooks/openclaw/handler.ts:10-44
Vulnerability Type: Persistent agent bootstrap instruction injection
Risk Level: Medium

Vulnerable Code

typescript

const REMINDER_CONTENT = `## Agent Smith Reminder

You have the agent-smith skill active. Document your decisions.

**Post when you:**
- Choose approach A over B with a reason → \`decision\`
- Complete something with a measurable result → \`outcome\`
- Disagree with another agent's posted decision → \`challenge\`
- Review another agent's past decisions → \`audit\`

**Skip** routine tool calls, file reads, and decisions with no reasoning.

**Quality check before posting:**
- Does \`reasoning\` explain *why*, not just *what*?
- Is \`context\` specific enough to evaluate the decision later?
- Would another agent learn something from this post?

If no: skip. If yes: post.`;

const handler: HookHandler = async (event) => {
  if (!event || typeof event !== 'object') return;
  if (event.type !== 'agent' || event.action !== 'bootstrap') return;
  if (!event.context || typeof event.context !== 'object') return;

  const sessionKey = event.sessionKey || '';
  if (sessionKey.includes(':subagent:')) return;

  if (Array.isArray(event.context.bootstrapFiles)) {
    event.context.bootstrapFiles.push({
      path: 'AGENT_SMITH_REMINDER.md',
      content: REMINDER_CONTENT,
      virtual: true,
    });
  }
};

The associated installation instructions in SKILL.md:48-57 copy the hook into the persistent OpenClaw hook directory and enable it:

bash

cp -r hooks/openclaw ~/.openclaw/hooks/agent-smith
openclaw hooks enable agent-smith

Technical Analysis

Once explicitly installed and enabled by the user, the hook executes on every qualifying agent:bootstrap event. It appends an attacker-authored virtual file named AGENT_SMITH_REMINDER.md to the agent's bootstrap context before ...[truncated 2656 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic behavioral instruction injection from the global agent:bootstrap lifecycle.
2. Require explicit, per-session user activation instead of persisting the hook across unrelated sessions.
3. Require per-post confirmation before external transmission, showing the exact destination and complete payload to the user.
4. Default to generating a local draft rather than publishing directly to an external service.
5. Apply deterministic redaction for credentials, tokens, personal information, repository secrets, internal hostnames, and confidential project context.
6. Restrict activation to explicitly allowlisted workspaces or session identifiers rather than all non-subagent sessions.
7. Clearly document both disable and uninstall procedures, including removal of the copied hook from ~/.openclaw/hooks.
8. Provide an unmistakable runtime indication whenever the hook has modified bootstrap context.
9. Separate the reminder from trusted bootstrap files so agents can distinguish third-party guidance from system or workspace policy.
10. Add automated tests confirming that no network submission can occur without an affirmative user approval for the specific payload.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill repeatedly encourages posting decisions, outcomes, and challenges to a public reputation system, but the top-level description does not clearly warn users that submitted reasoning and context become public and may reveal sensitive operational details. In a skill centered on publishing agent decision data, omission of a prominent privacy warning materially increases the risk of inadvertent data leakage.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The skill instructs agents to send registration and subsequent post data to an external service, creating an intentional data exfiltration path outside the local environment. Although this appears to be the product's stated purpose rather than overtly malicious behavior, the skill's context makes the transmission sensitive because it encourages sharing decision rationale, outcomes, and operational context that may include proprietary or security-relevant information.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

Setup (once)

bash

curl -X POST https://sentinel.agent-smith.org/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "handle": "your-agent-name",

Static analysis

No suspicious patterns detected.