T02 · Agent Memory Poisoning
Error
- Location
scripts/analyze_patterns.py:47- Finding
Persistent Pattern-Library Poisoning Through Untrusted Skill Metadata
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill Factory
Security checks for vulnerabilities and agentic risk
Overview
This skill is coherently aimed at building and publishing other skills, but it uses broad local scans and unsafe helper-script and packaging patterns that could leak files or carry untrusted instructions into future skill work.
Review this skill before installing or using it. Run bundled scripts only from a verified skill installation path, avoid the find-based fallback commands, inspect the full package manifest before publishing, and do not let generated pattern reports or eval outputs automatically rewrite or publish skills without human review.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T07 · Tool Hijacking and Spoofing
Error
- Location
SKILL.md:45- Finding
Execution of Unverified Scripts Discovered by Filename
- Content
View full analysis
/dev/null | python3 -c "import json,sys; print(json.load(sys.stdin).get('path',''))")/scripts/init_skill.py \ \ --path ~/.openclaw/workspace/skills/ \ --resources scripts,references \ --examples ``` The documented fallback is unsafe: ```bash SKILL_DIR=$(dirname $(find ~/.openclaw/workspace/skills ~/.nvm -name "init_skill.py" 2>/dev/null | head -1)) python3 "$SKILL_DIR/init_skill.py" --path ~/.openclaw/workspace/skills/ --resources scripts,references ``` The packaging workflow repeats the same pattern: ```bash SKILL_SCRIPTS="$(dirname "$(find ~/.openclaw/workspace/skills/skill-creator ~/.nvm -name "package_skill.py" 2>/dev/null | head -1)")" python3 "$SKILL_SCRIPTS/package_skill.py" ~/.openclaw/workspace/skills/ ``` ### Technical Analysis The fallback commands search broad user-controlled directory trees for files with specific names and execute the first match returned by `find`. The commands do not verify: - The selected file belongs to the expected Skill. - The path is canonical and beneath a trusted installation directory. - The file owner or permissions are trustworthy. - The file content or hash matches the reviewed bundled script. - Multiple matches exist. - A symlink or attacker-created directory influenced the result. Filename equality is not an authenticity check. Any process or package capable of writing an earlier matching file under the searched paths can spoof the bundled tool. The behavior exceeds the minimum necessary privilege scope because the Skill already describes these scripts as bundled resources. It is unnecessary to search all of `~/.nvm` or broad workspace directories for ...[truncated 1351 chars]- Remediation
View remediation
| head -1` executable-discovery fallbacks. 2. Resolve the Skill installation path using one trusted OpenClaw registry command. 3. Validate that the returned path is nonempty, canonical, and points to the expected Skill slug. 4. Quote the entire generated path before execution. 5. Fail closed if the registry lookup fails or if more than one installation is detected. 6. Verify that the resolved script is a regular file and not a symbolic link. 7. Where supported, verify package ownership, signature, or a known script digest before execution. 8. Do not search general `~/.nvm` or workspace directory trees for executable code by filename. 9. Prefer invocation through an authenticated package entry point rather than executing discovered source files. 10. Document manual path selection as a non-executing diagnostic step if automatic resolution is unavailable. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/package_skill.py:70- Finding
Skill Packaging Can Include Sensitive Files and Symlink Targets
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code chunk implements a narrow packaging utility: it checks that a skill directory exists, requires SKILL.md, runs validate_skill, and zips the folder into a .skill file. This partially matches the declared 'package skill' capability, but does not support most of the much broader described functions such as creation, evaluation, benchmarking, pattern analysis, synthesis, or publishing. The primary behavior is therefore materially narrower than the declared purpose, so this is a description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a broad skill authoring and lifecycle management capability, including creation, evaluation, improvement, benchmarking, synthesis, packaging, and publishing. The supplied code only performs basic validation of a single skill's SKILL.md frontmatter and related formatting rules. This is a materially narrower and different primary purpose than declared. There is no evidence of benchmarking, analysis, synthesis, packaging, publishing, or even general skill generation/editing behavior. Therefore the description does not accurately represent the actual code behavior.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Synthesize** | Build skill from patterns | Scaffolded `SKILL.md` |
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs creation and modification of SKILL.md and related project artifacts, enabling self-modification or generation of executable agent behavior. In a skill-building context this is expected, but it is still high risk because a triggered run can persist new instructions, alter future agent behavior, or implant unsafe logic into other skills.
- Content
_meta.json # Auto-populated on publish
text ### Step 4 — Write SKILL.md **Frontmatter rules:** ```yaml
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The iterative step to update SKILL.md and re-package enables repeated modification of persistent agent instructions. This increases risk because the skill can continuously rewrite behavior based on prior outputs or eval results, potentially entrenching unsafe changes or poisoning downstream published artifacts.
- Content
md Validates structure, outputs `<skill-name>.skill` zip. ### Step 6 — Iterate Run evals (Mode 2) → identify failures → update SKILL.md → re-package → repeat. ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
python # Print next steps print(f"\n[OK] Skill '{skill_name}' initialized successfully at {skill_dir}") print("\nNext steps:") print("1. Edit SKILL.md to complete the TODO items and update the description") if resources: if include_examples: print("2. Customize or delete the example files in scripts/, references/, and assets/")
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill invokes shell commands, reads and writes files, and performs network publishing, but it declares no explicit tool or permission scope. That makes the skill over-privileged by default and increases the chance it will be triggered in contexts where destructive or sensitive operations were not intended.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are extremely broad, including common requests like 'create a skill', 'build a skill', and 'improve this skill', which raises the chance of accidental invocation. Because the skill can write files, run shell commands, inspect installed skills, and publish artifacts, unintended triggering could cause unreviewed modifications or data exposure.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
Writing SKILL.md creates persistent state that affects future sessions and future skill invocations. In this context persistence is part of the feature, but without boundaries it can store unsafe instructions or silently change future behavior beyond the current interaction.
- Content
_meta.json # Auto-populated on publish
text ### Step 4 — Write SKILL.md **Frontmatter rules:** ```yaml
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
Creating eval files and run histories introduces persistent artifacts that can influence later decisions, benchmarks, or improvement loops. While normal for an evaluation workflow, persistence becomes risky if untrusted prompts, assertions, or prior run outputs are later reused without validation.
- Content
Measure skill quality against defined expectations.
Setup
Create
evals/evals.json:json [ {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This manifest-like JSON assertion says descriptions should include trigger phrases like 'disk' or 'monitor'. In particular, 'monitor' is a broad everyday term, and the file provides no scope limits, negative examples, or disambiguation to prevent accidental invocation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The phrase 'you need speed' is highly vague and could spuriously match unrelated conversations, leading to accidental invocation of a high-performance browser automation skill. Although the phrase appears in a reference/patterns document rather than executable code, documenting such a trigger as a reusable pattern can normalize unsafe trigger design and cause insecure reuse in future skills.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The listed trigger phrases for the skill creator include broad, natural-language requests such as 'create a skill', 'build a skill', and 'make a skill', which can match many benign user requests and cause unintended invocation. In a skill that can create, evaluate, package, and publish other skills, overbroad activation increases the chance of unsafe automation, unintended tool use, or propagation of insecure/generated skills.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python Options: --scan-dirs Comma-separated list of skill directories to scan Default: ~/.openclaw/workspace/skills/,~/.nvm/.../openclaw/skills/ --output Write report to this path (default: stdout) --query Filter patterns relevant to a search term """
Static analysis
No suspicious patterns detected.