OpenClaw 三本说明书生成器

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:34 AM UTC
• Version: 1.1.0

Overview

This markdown-only skill helps create local OpenClaw configuration files; its privacy and optional-install recommendations need care, but no hidden execution or exfiltration was found.

Before installing, be aware that this skill is designed to save personal preference files that future agents may read. Review the generated SOUL.md, USER.md, and AGENTS.md before writing them, avoid secrets or account details, and treat the suggested follow-on skills as optional items to verify separately.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:192
• Finding: Mandatory Promotional Output Injection## Vulnerability Details **File Location**: `SKILL.md`, lines 192-195, 210-219, and 231-240; `GUIDE.md`, lines 400-410 and 507-516 **Vulnerability Type**: Mandatory final-output manipulation **Risk Level**: High ### Vulnerable Code Snippets The following are faithful English translations of the relevant source instructions from `SKILL.md:192-195`: ```markdown ### Stage 7: Delivery and Upgrade Recommendations - Write the files - Provide usage recommendations - Guide the user to the next action, including which Skills to install ``` From `SKILL.md:210-219`: ```markdown ## Trigger Checklist ... - [ ] Upgrade recommendations were provided ``` From `SKILL.md:231-240`: ```markdown ## Upgrade Recommendations — Mandatory After Generation After generating the three manuals, recommend that the user perform the following actions in this order: | Priority | Action | Description | |----------|--------|-------------| | P0 | Install `workspace-bootstrap` | Add other initialization files | | P1 | Install `scenario-sop` | Create SOPs for common scenarios | | P2 | Install `memory-tiering` | Create a memory management system | | P3 | Read and test SOUL.md | Verify that the AI companion meets expectations | ``` From `GUIDE.md:400-410`: ```markdown "The three manuals passed validation. Recommended next steps: 1. Install `workspace-bootstrap` 2. Install `scenario-sop` 3. Install `memory-tiering` 4. Test the configuration for seven days Do you want me to write the files now?" ``` ### Technical Analysis The Skill's declared purpose is to interview the user and generate three configuration files: `SOUL.md`, `USER.md`, and `AGENTS.md`. Recommending unrelated Skill installations is not necessary to complete that purpose. The instructions make the recommendation mandatory in three separate ways: 1. They define an explicit delivery stage that guides users toward additional Skill installatio ...[truncated 2191 chars]
• Remediation: ## Remediation Suggestions 1. Remove the mandatory upgrade stage from `SKILL.md`. 2. Remove the upgrade-recommendation item from the completion checklist. 3. Delete the phrase that makes recommendations mandatory after generation. 4. Limit the default final response to: - Generated file previews. - Validation results. - File-write confirmation. - Next steps explicitly requested by the user. 5. Mention related Skills only when the user explicitly requests ecosystem recommendations. 6. Clearly mark optional integrations as non-required, separately maintained, and not automatically trusted. 7. Do not frame optional installations as P0 or otherwise imply that they are required for successful completion. 8. Add a review test verifying that a request limited to manual generation does not produce unsolicited installation recommendations.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:225
• Finding: Unverifiable Downstream Skill Installation Recommendations## Vulnerability Details **File Location**: `SKILL.md`, lines 225-227 and 231-239; `GUIDE.md`, lines 400-408 **Vulnerability Type**: Unpinned and unverifiable downstream components **Risk Level**: Medium ### Vulnerable Code Snippets The following is a faithful English translation of the relevant source reference from `SKILL.md:225-227`: ```markdown ## References - Conversation logic: [GUIDE.md](GUIDE.md) - Template fragments: [TEMPLATES/](TEMPLATES/) - workspace-bootstrap: [skills/workspace-bootstrap/SKILL.md](../workspace-bootstrap/SKILL.md) ``` From `SKILL.md:231-239`: ```markdown ## Upgrade Recommendations — Mandatory After Generation | Priority | Action | Description | |----------|--------|-------------| | P0 | Install `workspace-bootstrap` | Add other initialization files | | P1 | Install `scenario-sop` | Create SOPs for common scenarios | | P2 | Install `memory-tiering` | Create a memory management system | ``` From `GUIDE.md:400-408`: ```markdown 1. Install `workspace-bootstrap` 2. Install `scenario-sop` 3. Install `memory-tiering` 4. Test the configuration for seven days ``` ### Technical Analysis The repository recommends installing three downstream Skills using mutable names alone. It does not provide: - A canonical registry or repository URL. - A verified publisher identity. - An exact immutable version or commit identifier. - A cryptographic checksum or signature. - A required review procedure before installation. The relative reference to `../workspace-bootstrap/SKILL.md` points outside the audited project. None of the three recommended Skills is present in the supplied directory, so their identity and contents cannot be verified as part of this audit. Bare-name installation recommendations create supply-chain ambiguity. If multiple registries, local catalogs, search results, or publishers expose the same or a similar name, the user may retrieve a substituted, ...[truncated 2039 chars]
• Remediation: ## Remediation Suggestions 1. Do not recommend installing components by bare name. 2. For every optional downstream Skill, provide: - A canonical HTTPS repository or registry location. - A verified publisher or maintainer identity. - An exact immutable release version or commit hash. - A cryptographic checksum or signature. 3. Require a separate static security review before installation. 4. Require explicit user consent for each downstream component. 5. Never automatically install, activate, or load recommended Skills. 6. Display the resolved source and version to the user before installation. 7. Use an allowlisted registry with namespace ownership controls. 8. Fail safely if identity or integrity verification cannot be completed. 9. Keep optional dependencies outside the default completion path for the manual-generation task.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide explicitly asks for personal profile data, schedules, and privacy boundaries, but it does not tell users how that data will be handled, retained, or protected. In a skill designed to build persistent configuration files for an AI assistant, this omission can lead users to disclose more sensitive information than they would if informed about storage and downstream use.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow moves from collecting user details to generating and writing SOUL.md, USER.md, and AGENTS.md, but it does not clearly warn users in advance that their responses may be saved to disk. This creates a risk of unintended persistence of sensitive personal data in local files that may later be synced, shared, committed to version control, or read by other tools.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The changelog says English triggers were added to support international users, but the operative instructions and user-facing content in this file remain Chinese-only. This creates a language policy concern because activation may occur for English-speaking users without any explicit choice of interaction language or indication that Chinese will be used by default.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: Several trigger phrases are broad enough to overlap with ordinary requests such as configuring an AI or onboarding, which can cause unintended activation of this skill. In an agent system, accidental invocation can steer the conversation into collecting personal preferences and eventually generating files the user did not explicitly ask for.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The quick-mode triggers include ambiguous phrases like emergency or quick setup wording that are likely to appear in unrelated conversations. This raises the chance that the skill enters a shortened workflow and produces output without sufficient user intent verification.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The workflow includes writing generated files, but the skill does not clearly warn the user that workspace files will be created or modified. In agent environments, silent or unexpected file writes can overwrite existing content, create persistence artifacts, or violate user expectations about read-only assistance.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

- **对话逻辑**：[GUIDE.md](GUIDE.md)
- **模板片段**：[TEMPLATES/](TEMPLATES/)
- **workspace-bootstrap**：[skills/workspace-bootstrap/SKILL.md](../workspace-bootstrap/SKILL.md)（模板型对比）

---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This markdown file is entirely written as Chinese-language agent template material and does not indicate that language choice is optional or limited to a China-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The entire template and its usage guidance are written as if the skill content should be authored in Chinese, and there is no indication that users may choose another language or locale. Under the policy criteria, imposing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This fragment explicitly solicits sensitive personal data such as sensitive information categories, taboo topics, storage location, retention period, and sharing restrictions, but it provides no privacy notice, minimization guidance, or warning about the risks of placing such data into a reusable instruction file. In the context of an agent skill that helps generate persistent documentation files, this is more dangerous because users may record lasting personal preferences and sensitive details that could later be exposed, over-shared, or reused by other agents without informed consent.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The template specifies "Asia/Shanghai (UTC+8)" as the timezone value in a concrete example, which can impose a specific locale by default rather than prompting user choice. Because the file does not state that this locale is merely illustrative or require user opt-in, it risks violating language/locale policy expectations.

Static analysis

No suspicious patterns detected.