T01 · Skill Instruction Hijacking
Error
- Location
evolve.js:754- Finding
Mandatory Agent Role Replacement Enables Indirect Prompt Injection and Unauthorized File Mutation
- Content
View full analysis
- Remediation
View remediation
Security audit
Funky Fund Flamingo
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly a local self-improvement prompt generator, but it deserves Review because it gathers private local context and strongly directs an agent to edit files by default.
Install only if you are comfortable with a skill reading local OpenClaw session logs, USER.md, MEMORY.md, installed skill metadata, and optional .env-derived process variables to build prompts. Prefer --dry-run or --review, avoid forwarding generated prompts to cloud models unless you have reviewed/redacted them, and pin the installer version rather than using @latest.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
evolve.js:117- Finding
Sensitive Session, Memory, and User Data Is Aggregated Without Redaction or Complete Size Limits
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Note
- Location
index.js:72- Finding
Unsolicited Promotional Content Contaminates Agent-Consumed Standard Output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (36)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
If the code's primary purpose is policy enforcement or banned-string scanning rather than evolution, the skill is misclassified in a way that affects trust, deployment, and data handling decisions. Because the skill advertises access to logs, memory, and skills and encourages looped execution, a misleading description amplifies the risk of unnecessary continuous access to sensitive local context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the code's primary purpose is policy enforcement or banned-string scanning rather than evolution, the skill is misclassified in a way that affects trust, deployment, and data handling decisions. Because the skill advertises access to logs, memory, and skills and encourages looped execution, a misleading description amplifies the risk of unnecessary continuous access to sensitive local context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the code's primary purpose is policy enforcement or banned-string scanning rather than evolution, the skill is misclassified in a way that affects trust, deployment, and data handling decisions. Because the skill advertises access to logs, memory, and skills and encourages looped execution, a misleading description amplifies the risk of unnecessary continuous access to sensitive local context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the code's primary purpose is policy enforcement or banned-string scanning rather than evolution, the skill is misclassified in a way that affects trust, deployment, and data handling decisions. Because the skill advertises access to logs, memory, and skills and encourages looped execution, a misleading description amplifies the risk of unnecessary continuous access to sensitive local context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
If the code's primary purpose is policy enforcement or banned-string scanning rather than evolution, the skill is misclassified in a way that affects trust, deployment, and data handling decisions. Because the skill advertises access to logs, memory, and skills and encourages looped execution, a misleading description amplifies the risk of unnecessary continuous access to sensitive local context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the code's primary purpose is policy enforcement or banned-string scanning rather than evolution, the skill is misclassified in a way that affects trust, deployment, and data handling decisions. Because the skill advertises access to logs, memory, and skills and encourages looped execution, a misleading description amplifies the risk of unnecessary continuous access to sensitive local context.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the code's primary purpose is policy enforcement or banned-string scanning rather than evolution, the skill is misclassified in a way that affects trust, deployment, and data handling decisions. Because the skill advertises access to logs, memory, and skills and encourages looped execution, a misleading description amplifies the risk of unnecessary continuous access to sensitive local context.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md files: ["index.js", "evolve.js", "agents/*.yaml", "ADL.md", "VFM.md", "TREE.md"]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md files: ["index.js", "evolve.js", "agents/*.yaml", "ADL.md", "VFM.md", "TREE.md"]
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md files: ["index.js", "evolve.js", "agents/*.yaml", "ADL.md", "VFM.md", "TREE.md"]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Loading ../../.env is credential access behavior because it imports potentially sensitive secrets into the skill process. In combination with prompt generation and self-modifying logic, this enlarges the blast radius of accidental exfiltration or misuse.
- Content
js // Env loading (optional) // ----------------------------- try { // Load env from workspace root: ../../.env // If dotenv is missing, continue gracefully. // eslint-disable-next-line import/no-extraneous-dependencies require('dotenv').config({ path: path.resolve(__dirname, '../../.env') });
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
This is the same credential-access behavior at the specific call site invoking dotenv on the workspace .env path. It is dangerous because unrelated secrets become available to code whose main function is prompt assembly from logs and memory.
- Content
js // Load env from workspace root: ../../.env // If dotenv is missing, continue gracefully. // eslint-disable-next-line import/no-extraneous-dependencies require('dotenv').config({ path: path.resolve(__dirname, '../../.env') }); } catch (_) { } // -----------------------------
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 99% confidence
- Finding
The script prints the full generated prompt, which includes session transcript, USER.md, MEMORY.md, health metadata, and other collected context. Console output is commonly captured by logs, wrappers, CI systems, or orchestration layers, creating an immediate exfiltration channel for sensitive data.
- Content
js signals: logSignals }); // Print prompt for upstream runner to feed into model console.log(prompt); return prompt;
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 88% confidence
- Finding
Returning the full prompt exposes the same sensitive assembled context to any caller importing this module. In a plugin or agent ecosystem, upstream code may persist, transmit, or inspect that return value without the user's awareness.
- Content
js // Print prompt for upstream runner to feed into model console.log(prompt); return prompt; } module.exports = { run };
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file declares ADL as a LEVEL 0 priority with scope covering code mutation, skill creation/refactor, memory, workflows, and evolution tooling, which gives it extremely broad reach without clear activation conditions or exception boundaries. In a self-modifying or policy-driven agent, this can unintentionally suppress other safeguards, block legitimate operations, or let a poorly specified rule dominate behavior across unrelated contexts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The statement that ADL is 'Active • Binding • Enforced at Runtime and Review Time,' combined with earlier override language, creates a globally active control with no contextual limits, sunset criteria, or conflict-resolution rules. In this skill's self-evolution context, such a blanket rule can become a governance choke point that overrides narrower security logic, causes denial of intended maintenance, or entrenches unsafe policy behavior by making itself difficult to bypass or correct.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The README instructs users to run
npx clawhub@latest install funky-fund-flamingo, which pulls and executes the latest published package without pinning a specific version. If the upstream package is compromised or a malicious update is released, users installing this skill could execute attacker-controlled code; this is more concerning here because the skill is explicitly aimed at self-modifying agent workflows and may be granted broad local access.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares no explicit tool scope while its documented usage invokes Node.js and shell execution, creating a capability transparency gap. In an agent ecosystem, missing permission boundaries can cause the skill to be run with broader-than-expected access to files, environment variables, and command execution, increasing the chance of unsafe automation or privilege misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly states it will capture interaction history for analysis, billing, and optimization, but provides no user notice, consent model, retention limits, or access controls. In a self-evolving, memory-aware, revenue-focused agent, broad logging increases the chance of collecting sensitive user content and reusing it beyond user expectations, creating privacy and compliance risk.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly loads a workspace .env file, which can expose secrets unrelated to its stated local audit/mutation function. Even if it only checks for key presence today, loading secrets into process memory broadens access and makes accidental inclusion in prompts, logs, errors, or future code paths much more likely.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill does more than inspect logs: it archives and moves session files. That mutates evidence and operational state, which can interfere with retention, forensic review, or other tooling that expects session logs to remain in place.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script performs host health inspection such as uptime, memory, disk, PID, and integration-state checks, which exceeds a narrow 'audit logs, memory, and skills' role. This unnecessarily collects environmental metadata that can aid fingerprinting or leak operational details if the generated prompt is shared upstream.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
USER.md is loaded wholesale and later inserted into model context with no warning or permission check. Personal registry data can include identifying preferences, workflow notes, or sensitive user attributes that should not be automatically propagated.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The prompt template explicitly embeds raw USER.md content and the real session transcript into natural-language model context. This creates a direct data leakage path because any downstream model, logger, or operator receiving the prompt gains broad access to user and session data.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The instruction to adapt behavior from USER.md and MEMORY.md encourages unconstrained use of stored personal and historical data in future actions. In a self-evolution skill, this broad personalization directive increases the chance that sensitive context is reused in ways the user did not intend.
- Content
Static analysis
No suspicious patterns detected.