Funky Fund Flamingo

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:47 PM UTC
• Version: 1.0.1

Overview

This skill is openly a local self-improvement prompt generator, but it deserves Review because it gathers private local context and strongly directs an agent to edit files by default.

Install only if you are comfortable with a skill reading local OpenClaw session logs, USER.md, MEMORY.md, installed skill metadata, and optional .env-derived process variables to build prompts. Prefer --dry-run or --review, avoid forwarding generated prompts to cloud models unless you have reviewed/redacted them, and pin the installer version rather than using @latest.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: evolve.js:754
• Finding: Mandatory Agent Role Replacement Enables Indirect Prompt Injection and Unauthorized File Mutation<![CDATA[ ## Vulnerability Details **File Location**: `evolve.js:754-763`, `evolve.js:785-797`, `evolve.js:802-823`, `evolve.js:843-851`, `evolve.js:931`; reinforced by `funky-fund-flamingo-master-directive.json:21-25` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code ```javascript return ` *** 🧬 OPENCLAW EVOLUTION LOOP (REVENUE EDITION) [${NOW_ISO}] *** **MISSION** You are a **Recursive, Self-Improving, Revenue-Seeking System**. Your job is to build skills and improvements that create **legitimate economic leverage**: - Paid utility (premium features, subscriptions, usage-based) - Lead capture + business workflow integrations - Automations that replace paid SaaS or save measurable time - Instrumentation needed for billing, proof of value, and retention ``` Untrusted context is interpolated directly into the same instruction document: ```javascript **CONTEXT [User Registry (USER.md)]** \`\`\` ${userSnippet} \`\`\` **CONTEXT [Recent Memory Snippet]** \`\`\` ${todayLogSnippet} \`\`\` **CONTEXT [REAL SESSION TRANSCRIPT (RAW BRAIN DUMP)]** \`\`\` ${sessionTranscript} \`\`\` ``` The prompt then authorizes and mandates changes: ```javascript 2. **🛠️ MUTATE (Act)** - Repair any breaking issues if present. - Then implement at least ONE **revenue-oriented** improvement: - Add a monetizable capability, premium tier, or usage metric needed for pricing/billing. - Improve distribution/onboarding so real users can adopt it. Modes: - **Mode A (Repair)**: Fix bugs and harden reliability - **Mode B (Optimize)**: Refactor only when it enables economic outcomes (speed, cost, scalability) - **Mode C (Expand)**: Create a new capability/skill with a clear paying customer - **Mode D (Instrument)**: Add usage tracking / analytics / admin dashboards - **Mode E (Personalization)**: Adapt to USER.md + MEMORY.md preferences and workflow ``` ```javascript /* You have permission to edit files. Proc ...[truncated 3385 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove role-replacement language such as “You are a Recursive, Self-Improving, Revenue-Seeking System.” 2. Remove unconditional file-edit authorization and the requirement that every cycle must mutate files. 3. Make analysis the default behavior and require explicit, per-cycle user approval before any change is applied. 4. Enforce review mode unconditionally for changes to code, Skills, configuration, workflows, or memory. 5. Treat transcripts, tool results, memory, user profiles, and Skill metadata as untrusted data. 6. Serialize imported context as structured JSON rather than concatenating it into an instruction document. 7. If Markdown remains necessary, escape all fence delimiters and control markers before interpolation. 8. Place explicit instructions immediately before and after each context block stating that embedded commands must never be followed. 9. Convert raw context into a constrained findings schema before supplying it to a tool-capable Agent. 10. Restrict the executing Agent to an allowlist of files and operations, and prohibit shell execution unless separately approved. 11. Validate generated actions against a policy engine outside the language model before applying them. 12. Set `must_evolve_each_cycle`, `no_op_forbidden`, and `stability_only_scans_banned` to safe defaults that permit a no-change outcome. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: evolve.js:117
• Finding: Sensitive Session, Memory, and User Data Is Aggregated Without Redaction or Complete Size Limits<![CDATA[ ## Vulnerability Details **File Location**: `evolve.js:117-127`, `evolve.js:134-137`, `evolve.js:323-353`, `evolve.js:590-600`, `evolve.js:775-797`, `evolve.js:931` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Vulnerable Code The Skill locates sensitive local context: ```javascript const AGENT_NAME = sanitizeAgentName(process.env.AGENT_NAME || 'main'); const AGENT_SESSIONS_DIR = path.join(os.homedir(), `.openclaw/agents/${AGENT_NAME}/sessions`); const TODAY_LOG = path.join(MEMORY_DIR, `${TODAY}.md`); const STATE_FILE = path.join(MEMORY_DIR, 'evolution_state.json'); const PERSISTENT_MEMORY_FILE = path.join(MEMORY_DIR, 'funky_fund_flamingo_persistent_memory.json'); const ROOT_MEMORY = path.join(WORKSPACE_ROOT, 'MEMORY.md'); const DIR_MEMORY = path.join(MEMORY_DIR, 'MEMORY.md'); const MEMORY_FILE = fs.existsSync(ROOT_MEMORY) ? ROOT_MEMORY : DIR_MEMORY; const USER_FILE = path.join(WORKSPACE_ROOT, 'USER.md'); ``` Session limits remain large enough to include sensitive content: ```javascript const TARGET_SESSION_BYTES = clampInt(process.env.TARGET_SESSION_BYTES, 64000, 4096, 262144); const MAX_MEMORY_CHARS = clampInt(process.env.MAX_MEMORY_CHARS, 50000, 1000, 120000); const MAX_TODAY_LOG_CHARS = clampInt(process.env.MAX_TODAY_LOG_CHARS, 3000, 500, 20000); const MAX_PERSISTENT_MEMORY_CHARS = clampInt(process.env.MAX_PERSISTENT_MEMORY_CHARS, 8000, 500, 20000); ``` `USER.md` is returned without a size limit or redaction: ```javascript function readMemorySnippet() { const content = safeReadFile(MEMORY_FILE); if (!content) return '[MEMORY.md MISSING]'; return truncate(content, MAX_MEMORY_CHARS); } function readUserSnippet() { const content = safeReadFile(USER_FILE); if (!content) return '[USER.md MISSING]'; return content; } ``` The data is combined into one prompt: ```javascript **CONTEXT [Global Memory (MEMORY.md)]** \`\`\` ${memorySnippet} \`\`\` **CONTEXT [Persistent Funky Fund F ...[truncated 2715 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Run secret detection and PII redaction over every imported context source. 2. Redact common API-key formats, bearer tokens, private keys, cookies, passwords, credentials, internal URLs, email addresses, and other configured patterns. 3. Apply strict byte and character limits to `USER.md` as well as every other source. 4. Prefer metadata, counts, and locally generated summaries over raw transcript or memory excerpts. 5. Require explicit user confirmation before producing output intended for a cloud model. 6. Add a privacy-preserving mode that excludes transcripts, tool output, `USER.md`, and global memory by default. 7. Display which files and approximate byte counts will be included before prompt generation. 8. Keep generated prompt artifacts permission-restricted and introduce an automatic retention policy. 9. Separate stdout intended for machine consumption from diagnostics and other logs. 10. Document that users should not store credentials in session logs or memory, while treating this warning as supplementary rather than a replacement for technical controls. ]]>

T01 · Skill Instruction Hijacking

Note

• Location: index.js:72
• Finding: Unsolicited Promotional Content Contaminates Agent-Consumed Standard Output<![CDATA[ ## Vulnerability Details **File Location**: `index.js:72-79`, `index.js:101-104` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Low ### Vulnerable Code ```javascript function printStarBeggar() { console.log('\n\x1b[33m%s\x1b[0m', '======================================================='); console.log('\x1b[33m%s\x1b[0m', '✨ Loving Funky Fund Flamingo? Give it a Star! ✨'); console.log('\x1b[36m%s\x1b[0m', '👉 https://github.com/IceMasterT/funky-fund-flamingo'); console.log('\x1b[33m%s\x1b[0m', '=======================================================\n'); } ``` The footer is printed unconditionally after the evolution prompt: ```javascript await runEvolution({ isLoop }); // Cosmetic footer (non-functional, safe to remove) printStarBeggar(); ``` ### Technical Analysis The core engine prints its generated Agent prompt to stdout. The launcher then appends an unrelated promotional request and external URL to the same stream. A runner that captures stdout as one model prompt cannot reliably distinguish the functional output from publisher-controlled promotional content. This does not directly execute code or access the linked site. The issue is output manipulation: unrelated instructions and branding are inserted into an Agent-consumed channel without being requested by the user. ### Attack Path 1. An automation runner invokes `node index.js run`. 2. `evolve.run()` prints the generated mutation prompt to stdout. 3. `printStarBeggar()` appends the promotional request and GitHub URL to that same stdout stream. 4. The runner captures the complete output as a single prompt. 5. The upstream Agent or user receives unsolicited content as part of the functional result. ### Impact Assessment The issue can contaminate machine-readable prompt output, create unexpected model behavior, and expose users to an unsolicited external link. It does not by itself grant additional privileges, perform network access, or execute a re ...[truncated 17 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the promotional footer from the normal execution path. 2. Ensure stdout contains only the generated prompt or a documented structured result. 3. Send optional diagnostics and branding to stderr rather than stdout. 4. Make promotional output explicitly opt-in through a separate command-line flag. 5. Add an output-format test that verifies no unrelated content is appended to Agent-consumed output. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (36)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: If the code's primary purpose is policy enforcement or banned-string scanning rather than evolution, the skill is misclassified in a way that affects trust, deployment, and data handling decisions. Because the skill advertises access to logs, memory, and skills and encourages looped execution, a misleading description amplifies the risk of unnecessary continuous access to sensitive local context.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: If the code's primary purpose is policy enforcement or banned-string scanning rather than evolution, the skill is misclassified in a way that affects trust, deployment, and data handling decisions. Because the skill advertises access to logs, memory, and skills and encourages looped execution, a misleading description amplifies the risk of unnecessary continuous access to sensitive local context.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: If the code's primary purpose is policy enforcement or banned-string scanning rather than evolution, the skill is misclassified in a way that affects trust, deployment, and data handling decisions. Because the skill advertises access to logs, memory, and skills and encourages looped execution, a misleading description amplifies the risk of unnecessary continuous access to sensitive local context.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: If the code's primary purpose is policy enforcement or banned-string scanning rather than evolution, the skill is misclassified in a way that affects trust, deployment, and data handling decisions. Because the skill advertises access to logs, memory, and skills and encourages looped execution, a misleading description amplifies the risk of unnecessary continuous access to sensitive local context.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: If the code's primary purpose is policy enforcement or banned-string scanning rather than evolution, the skill is misclassified in a way that affects trust, deployment, and data handling decisions. Because the skill advertises access to logs, memory, and skills and encourages looped execution, a misleading description amplifies the risk of unnecessary continuous access to sensitive local context.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: If the code's primary purpose is policy enforcement or banned-string scanning rather than evolution, the skill is misclassified in a way that affects trust, deployment, and data handling decisions. Because the skill advertises access to logs, memory, and skills and encourages looped execution, a misleading description amplifies the risk of unnecessary continuous access to sensitive local context.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: If the code's primary purpose is policy enforcement or banned-string scanning rather than evolution, the skill is misclassified in a way that affects trust, deployment, and data handling decisions. Because the skill advertises access to logs, memory, and skills and encourages looped execution, a misleading description amplifies the risk of unnecessary continuous access to sensitive local context.

Ae1

High

• Category: analysis-evasion

Content

files: ["index.js", "evolve.js", "agents/*.yaml", "ADL.md", "VFM.md", "TREE.md"]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

files: ["index.js", "evolve.js", "agents/*.yaml", "ADL.md", "VFM.md", "TREE.md"]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

files: ["index.js", "evolve.js", "agents/*.yaml", "ADL.md", "VFM.md", "TREE.md"]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

// Env loading (optional)
// -----------------------------
try {
    // Load env from workspace root: ../../.env
    // If dotenv is missing, continue gracefully.
    // eslint-disable-next-line import/no-extraneous-dependencies
    require('dotenv').config({ path: path.resolve(__dirname, '../../.env') });

• Confidence: 95% confidence
• Finding: Loading ../../.env is credential access behavior because it imports potentially sensitive secrets into the skill process. In combination with prompt generation and self-modifying logic, this enlarges the blast radius of accidental exfiltration or misuse.

Credential Access

High

• Category: Privilege Escalation

Content

// Load env from workspace root: ../../.env
    // If dotenv is missing, continue gracefully.
    // eslint-disable-next-line import/no-extraneous-dependencies
    require('dotenv').config({ path: path.resolve(__dirname, '../../.env') });
} catch (_) { }

// -----------------------------

• Confidence: 95% confidence
• Finding: This is the same credential-access behavior at the specific call site invoking dotenv on the workspace .env path. It is dangerous because unrelated secrets become available to code whose main function is prompt assembly from logs and memory.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

signals: logSignals
    });

    // Print prompt for upstream runner to feed into model
    console.log(prompt);

    return prompt;

• Confidence: 99% confidence
• Finding: The script prints the full generated prompt, which includes session transcript, USER.md, MEMORY.md, health metadata, and other collected context. Console output is commonly captured by logs, wrappers, CI systems, or orchestration layers, creating an immediate exfiltration channel for sensitive data.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

// Print prompt for upstream runner to feed into model
    console.log(prompt);

    return prompt;
}

module.exports = { run };

• Confidence: 88% confidence
• Finding: Returning the full prompt exposes the same sensitive assembled context to any caller importing this module. In a plugin or agent ecosystem, upstream code may persist, transmit, or inspect that return value without the user's awareness.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The file declares ADL as a LEVEL 0 priority with scope covering code mutation, skill creation/refactor, memory, workflows, and evolution tooling, which gives it extremely broad reach without clear activation conditions or exception boundaries. In a self-modifying or policy-driven agent, this can unintentionally suppress other safeguards, block legitimate operations, or let a poorly specified rule dominate behavior across unrelated contexts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The statement that ADL is 'Active • Binding • Enforced at Runtime and Review Time,' combined with earlier override language, creates a globally active control with no contextual limits, sunset criteria, or conflict-resolution rules. In this skill's self-evolution context, such a blanket rule can become a governance choke point that overrides narrower security logic, causes denial of intended maintenance, or entrenches unsafe policy behavior by making itself difficult to bypass or correct.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The README instructs users to run `npx clawhub@latest install funky-fund-flamingo`, which pulls and executes the latest published package without pinning a specific version. If the upstream package is compromised or a malicious update is released, users installing this skill could execute attacker-controlled code; this is more concerning here because the skill is explicitly aimed at self-modifying agent workflows and may be granted broad local access.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares no explicit tool scope while its documented usage invokes Node.js and shell execution, creating a capability transparency gap. In an agent ecosystem, missing permission boundaries can cause the skill to be run with broader-than-expected access to files, environment variables, and command execution, increasing the chance of unsafe automation or privilege misuse.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly states it will capture interaction history for analysis, billing, and optimization, but provides no user notice, consent model, retention limits, or access controls. In a self-evolving, memory-aware, revenue-focused agent, broad logging increases the chance of collecting sensitive user content and reusing it beyond user expectations, creating privacy and compliance risk.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly loads a workspace .env file, which can expose secrets unrelated to its stated local audit/mutation function. Even if it only checks for key presence today, loading secrets into process memory broadens access and makes accidental inclusion in prompts, logs, errors, or future code paths much more likely.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill does more than inspect logs: it archives and moves session files. That mutates evidence and operational state, which can interfere with retention, forensic review, or other tooling that expects session logs to remain in place.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script performs host health inspection such as uptime, memory, disk, PID, and integration-state checks, which exceeds a narrow 'audit logs, memory, and skills' role. This unnecessarily collects environmental metadata that can aid fingerprinting or leak operational details if the generated prompt is shared upstream.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: USER.md is loaded wholesale and later inserted into model context with no warning or permission check. Personal registry data can include identifying preferences, workflow notes, or sensitive user attributes that should not be automatically propagated.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The prompt template explicitly embeds raw USER.md content and the real session transcript into natural-language model context. This creates a direct data leakage path because any downstream model, logger, or operator receiving the prompt gains broad access to user and session data.

Ssd 3

Medium

• Confidence: 87% confidence
• Finding: The instruction to adapt behavior from USER.md and MEMORY.md encourages unconstrained use of stored personal and historical data in future actions. In a self-evolution skill, this broad personalization directive increases the chance that sensitive context is reused in ways the user did not intend.

Static analysis

No suspicious patterns detected.