Security audit

OpenClaw 三本说明书生成器

Security checks for vulnerabilities and agentic risk

Overview

This markdown-only skill helps create local OpenClaw configuration files; its privacy and optional-install recommendations need care, but no hidden execution or exfiltration was found.

Before installing, be aware that this skill is designed to save personal preference files that future agents may read. Review the generated SOUL.md, USER.md, and AGENTS.md before writing them, avoid secrets or account details, and treat the suggested follow-on skills as optional items to verify separately.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:192
Finding: Mandatory Promotional Output Injection
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 192-195, 210-219, and 231-240; GUIDE.md, lines 400-410 and 507-516
Vulnerability Type: Mandatory final-output manipulation
Risk Level: High

Vulnerable Code Snippets

The following are faithful English translations of the relevant source instructions from SKILL.md:192-195:

markdown
### Stage 7: Delivery and Upgrade Recommendations - Write the files - Provide usage recommendations - Guide the user to the next action, including which Skills to install

From SKILL.md:210-219:

markdown
## Trigger Checklist ... - [ ] Upgrade recommendations were provided

From SKILL.md:231-240:

markdown
## Upgrade Recommendations — Mandatory After Generation After generating the three manuals, recommend that the user perform the following actions in this order: | Priority | Action | Description | |----------|--------|-------------| | P0 | Install `workspace-bootstrap` | Add other initialization files | | P1 | Install `scenario-sop` | Create SOPs for common scenarios | | P2 | Install `memory-tiering` | Create a memory management system | | P3 | Read and test SOUL.md | Verify that the AI companion meets expectations |

From GUIDE.md:400-410:

markdown
"The three manuals passed validation. Recommended next steps: 1. Install `workspace-bootstrap` 2. Install `scenario-sop` 3. Install `memory-tiering` 4. Test the configuration for seven days Do you want me to write the files now?"

Technical Analysis

The Skill's declared purpose is to interview the user and generate three configuration files: SOUL.md, USER.md, and AGENTS.md. Recommending unrelated Skill installations is not necessary to complete that purpose.

The instructions make the recommendation mandatory in three separate ways:

They define an explicit delivery stage that guides users toward additional Skill installatio ...[truncated 2191 chars]
Remediation: View remediation
Remediation Suggestions

Remove the mandatory upgrade stage from SKILL.md.

Remove the upgrade-recommendation item from the completion checklist.

Delete the phrase that makes recommendations mandatory after generation.

Limit the default final response to:

Generated file previews.

Validation results.

File-write confirmation.

Next steps explicitly requested by the user.

Mention related Skills only when the user explicitly requests ecosystem recommendations.

Clearly mark optional integrations as non-required, separately maintained, and not automatically trusted.

Do not frame optional installations as P0 or otherwise imply that they are required for successful completion.

Add a review test verifying that a request limited to manual generation does not produce unsolicited installation recommendations.

T08 · Insecure Dependencies

Warning

Location: SKILL.md:225
Finding: Unverifiable Downstream Skill Installation Recommendations
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 225-227 and 231-239; GUIDE.md, lines 400-408
Vulnerability Type: Unpinned and unverifiable downstream components
Risk Level: Medium

Vulnerable Code Snippets

The following is a faithful English translation of the relevant source reference from SKILL.md:225-227:

markdown
## References - Conversation logic: [GUIDE.md](GUIDE.md) - Template fragments: [TEMPLATES/](TEMPLATES/) - workspace-bootstrap: [skills/workspace-bootstrap/SKILL.md](../workspace-bootstrap/SKILL.md)

From SKILL.md:231-239:

markdown
## Upgrade Recommendations — Mandatory After Generation | Priority | Action | Description | |----------|--------|-------------| | P0 | Install `workspace-bootstrap` | Add other initialization files | | P1 | Install `scenario-sop` | Create SOPs for common scenarios | | P2 | Install `memory-tiering` | Create a memory management system |

From GUIDE.md:400-408:

markdown
1. Install `workspace-bootstrap` 2. Install `scenario-sop` 3. Install `memory-tiering` 4. Test the configuration for seven days

Technical Analysis

The repository recommends installing three downstream Skills using mutable names alone. It does not provide:

A canonical registry or repository URL.

A verified publisher identity.

An exact immutable version or commit identifier.

A cryptographic checksum or signature.

A required review procedure before installation.

The relative reference to ../workspace-bootstrap/SKILL.md points outside the audited project. None of the three recommended Skills is present in the supplied directory, so their identity and contents cannot be verified as part of this audit.

Bare-name installation recommendations create supply-chain ambiguity. If multiple registries, local catalogs, search results, or publishers expose the same or a similar name, the user may retrieve a substituted, ...[truncated 2039 chars]
Remediation: View remediation
Remediation Suggestions

Do not recommend installing components by bare name.

For every optional downstream Skill, provide:

A canonical HTTPS repository or registry location.

A verified publisher or maintainer identity.

An exact immutable release version or commit hash.

A cryptographic checksum or signature.

Require a separate static security review before installation.

Require explicit user consent for each downstream component.

Never automatically install, activate, or load recommended Skills.

Display the resolved source and version to the user before installation.

Use an allowlisted registry with namespace ownership controls.

Fail safely if identity or integrity verification cannot be completed.

Keep optional dependencies outside the default completion path for the manual-generation task.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide explicitly asks for personal profile data, schedules, and privacy boundaries, but it does not tell users how that data will be handled, retained, or protected. In a skill designed to build persistent configuration files for an AI assistant, this omission can lead users to disclose more sensitive information than they would if informed about storage and downstream use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow moves from collecting user details to generating and writing SOUL.md, USER.md, and AGENTS.md, but it does not clearly warn users in advance that their responses may be saved to disk. This creates a risk of unintended persistence of sensitive personal data in local files that may later be synced, shared, committed to version control, or read by other tools.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The changelog says English triggers were added to support international users, but the operative instructions and user-facing content in this file remain Chinese-only. This creates a language policy concern because activation may occur for English-speaking users without any explicit choice of interaction language or indication that Chinese will be used by default.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Several trigger phrases are broad enough to overlap with ordinary requests such as configuring an AI or onboarding, which can cause unintended activation of this skill. In an agent system, accidental invocation can steer the conversation into collecting personal preferences and eventually generating files the user did not explicitly ask for.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The quick-mode triggers include ambiguous phrases like emergency or quick setup wording that are likely to appear in unrelated conversations. This raises the chance that the skill enters a shortened workflow and produces output without sufficient user intent verification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow includes writing generated files, but the skill does not clearly warn the user that workspace files will be created or modified. In agent environments, silent or unexpected file writes can overwrite existing content, create persistence artifacts, or violate user expectations about read-only assistance.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.
md
- **对话逻辑**：[GUIDE.md](GUIDE.md) - **模板片段**：[TEMPLATES/](TEMPLATES/) - **workspace-bootstrap**：[skills/workspace-bootstrap/SKILL.md](../workspace-bootstrap/SKILL.md)（模板型对比） ---

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file is entirely written as Chinese-language agent template material and does not indicate that language choice is optional or limited to a China-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The entire template and its usage guidance are written as if the skill content should be authored in Chinese, and there is no indication that users may choose another language or locale. Under the policy criteria, imposing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This fragment explicitly solicits sensitive personal data such as sensitive information categories, taboo topics, storage location, retention period, and sharing restrictions, but it provides no privacy notice, minimization guidance, or warning about the risks of placing such data into a reusable instruction file. In the context of an agent skill that helps generate persistent documentation files, this is more dangerous because users may record lasting personal preferences and sensitive details that could later be exposed, over-shared, or reused by other agents without informed consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The template specifies "Asia/Shanghai (UTC+8)" as the timezone value in a concrete example, which can impose a specific locale by default rather than prompting user choice. Because the file does not state that this locale is merely illustrative or require user opt-in, it risks violating language/locale policy expectations.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code Snippets

Technical Analysis

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code Snippets

Technical Analysis

Remediation Suggestions

SkillSpector

Tp2

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Vague Triggers

Vague Triggers

Missing User Warnings

Skill Enumeration

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations