Physical De Escalation

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:44 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent de-escalation guidance, but it asks for filesystem access it does not need and defines sensitive incident state without clear privacy controls.

Review this before installing. The de-escalation instructions themselves look purpose-aligned, but install it only in an environment where filesystem access is tightly sandboxed, avoid sharing names or identifying incident details unless needed, and prefer a pinned or otherwise trusted installation path.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Package Execution Through npx Installation Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code Snippet:

yaml

install: "npx clawhub install physical-de-escalation"

Technical Analysis

The installation command invokes clawhub through npx without specifying an exact package version or integrity hash. If the package is unavailable locally, npx may resolve and execute a package from the configured npm registry. The effective code executed during installation can therefore change after this Skill has been reviewed.

The project contains no lockfile, package manifest, integrity constraint, or vendored installer that would bind this command to an audited release. This creates a supply-chain risk if the upstream package, publisher account, registry resolution, or a future package release is compromised.

Attack Path

1. An attacker compromises the upstream clawhub package, its publisher account, or the relevant package-resolution infrastructure.
2. The attacker publishes a malicious release that is selected by the unpinned command.
3. A user follows the installation metadata and runs npx clawhub install physical-de-escalation.
4. npx resolves and executes the malicious package release.
5. The package runs with the operating-system privileges of the user performing the installation.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that account's privileges and environment, this could expose accessible files, credentials, environment variables, project data, or network resources. If installation is performed by an administrative or highly privileged account, the resulting impact could extend to system-wide modification.

No evidence indicates that the currently resolved package is malicious; the vulnerability is the absence of version and integrity cont ...[truncated 45 chars]

Remediation

View remediation

Remediation Suggestions

• Pin clawhub to a specific, reviewed version rather than allowing dynamic resolution.
• Use a trusted registry and verify the publisher and package provenance.
• Validate the package with a cryptographic integrity hash or signed provenance where supported.
• Maintain a lockfile or equivalent immutable dependency record.
• Review the pinned release before upgrading and perform upgrades through a controlled process.
• Run installation in a sandbox or least-privileged environment rather than under an administrative account.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:13

Finding

Filesystem Capability Requested Without a Demonstrated Functional Need

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:13-15
Vulnerability Type: Excessive tool permission
Risk Level: Low

Vulnerable Code Snippet:

yaml

openclaw:
  requires:
    tools: [filesystem]
  install: "npx clawhub install physical-de-escalation"

Technical Analysis

The Skill declares a requirement for the filesystem tool, but its documented behavior consists of conversational physical de-escalation guidance, scenario exercises, state fields, and response triggers. No instruction in the audited file identifies a legitimate file-reading or file-writing operation.

Granting a capability that is not required violates the principle of least privilege. The precise exposure depends on the host platform's filesystem sandbox and authorization model, but the unnecessary capability expands the damage that could result from a compromised dependency, later malicious modification, or unintended Agent behavior.

Attack Path

1. The host grants the Skill its declared filesystem capability.
2. A future malicious Skill modification, compromised dependency, or manipulated execution path causes the Agent to invoke that tool.
3. The Agent accesses or modifies files permitted by the host's filesystem authorization boundary.
4. Data may be disclosed or altered even though filesystem access is unrelated to the Skill's stated purpose.

Impact Assessment

The maximum impact is bounded by the host's filesystem-tool permissions. If the tool is broadly scoped, exploitation could expose user documents, project files, local configuration, or credentials readable by the Agent, and could permit modification or deletion of writable files. In a properly sandboxed host, the impact may be limited to the sandbox directory.

The audited instructions do not actively invoke the filesystem tool, so this is an excessive-permission weakness rather than evidence of actual unauthorized file access.

Remediation

View remediation

Remediation Suggestions

• Remove filesystem from the required tools because the documented Skill behavior does not need it.
• If a future feature legitimately requires file access, document the exact operation and request only the narrowest necessary capability.
• Restrict any necessary access to a dedicated sandbox directory.
• Prefer read-only access where writes are unnecessary.
• Require explicit user approval before accessing files containing personal, workplace, or incident information.
• Add automated permission reviews to detect capabilities that are declared but unused.

other

Note

• Location: SKILL.md:394

Finding

Sensitive Confrontation State Defined Without Privacy or Retention Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:394-418
Vulnerability Type: Potential excessive retention of personal incident information
Risk Level: Low

Vulnerable Code Snippet:

yaml

## Agent State

```yaml
de_escalation:
  user_context:
    primary_scenario: null
    work_environment: null
    frequency_of_confrontations: null
    has_de_escalation_training: false
  skills_covered:
    five_second_assessment: false
    body_positioning: false
    voice_modulation: false
    verbal_techniques: false
    pre_attack_indicators: false
    scenario_protocols: false
    bystander_intervention: false
  incidents:
    recent_confrontation: null
    outcome: null
    what_worked: null
    what_didnt: null
  follow_up:
    training_recommendation: null
    practice_scenarios_completed: []

text

### Technical Analysis

The Agent State schema includes workplace context and details about recent confrontations, their outcomes, and the user's responses. Such fields may contain sensitive information about violence, victims, alleged aggressors, employment, health crises, or identifiable third parties.

The Skill does not state whether this information is session-local or persistent, does not request consent before retention, and provides no minimization, deletion, expiration, or access-control policy. The actual risk therefore depends on how the host implements Agent State. If the state persists across sessions or is exposed to other components, sensitive incident history could remain available longer than the user expects.

This finding is not classified as memory poisoning because the fields store conversational context rather than attacker-authored behavioral rules.

### Attack Path

1. A user discusses a workplace or personal confrontation with the Agent.
2. The Agent populates fields such as `work_environment`, `recent_confrontation`, `outcome`, `what_worked`, or `what_
...[truncated 720 chars]

Remediation

View remediation

Remediation Suggestions

• Keep confrontation and incident details session-local by default.
• Obtain explicit user consent before persisting any incident-related information.
• Document whether Agent State persists, who can access it, and how users can inspect or delete it.
• Define a short retention period and automatically expire incident details when no longer needed.
• Store only the minimum information necessary for follow-up; avoid names, precise locations, employer identifiers, and third-party personal details.
• Apply encryption and access controls if persistence is required.
• Provide a command or interface that allows the user to clear all de-escalation state immediately.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use the skill when someone 'needs to calm a heated situation in a physical space,' which is a very broad natural-language trigger that overlaps with many everyday interpersonal situations. The file provides examples but does not clearly bound when the skill should not activate or give exclusion conditions, increasing the chance of overbroad invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The install command invokes npx clawhub install physical-de-escalation without pinning a specific version or immutable package reference. That creates a supply-chain risk: a future compromised or maliciously updated package/tool could be fetched and executed at install time.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Several entries, such as 'heated argument at a family gathering' and 'prepare for situations that could turn physical,' are broad enough to match common everyday speech and do not specify thresholds for activation. The section lacks negative examples or constraints that distinguish routine conflict advice from higher-risk physical de-escalation use cases.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger activates when a 'user indicates they are currently in or just exited a confrontation,' but 'confrontation' is an ambiguous term that can include minor verbal disagreements as well as dangerous physical incidents. Without narrower scope or exclusions, the skill may activate in benign contexts where this specialized guidance is not intended.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.