ClawHub
Back to skill

Security audit

Agency Agents

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly agent guidance, but it has review-worthy packaging issues: broad autonomous orchestration, incomplete/misleading capability claims, and manual install instructions pointing to an unverified placeholder repository.

Install only from ClawHub or a verified repository, not the placeholder git clone command. Treat orchestrator runs as broad automation: review tasks before allowing code, infrastructure, production, or public marketing changes. Replace all example credentials before use, and avoid putting confidential data into prompts unless you are comfortable with generated outputs being saved locally.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:109
Finding

Manual installation retrieves a mutable Skill package from an unverified placeholder repository

Content
View full analysis

Vulnerability Details

File Location: README.md:109 and docs/QUICKSTART.md:23
Vulnerability Type: Unverified third-party installation source
Risk Level: Medium

Vulnerable Code

README.md:109:

bash
git clone https://github.com/your-repo/agency-agents-openclaw.git

docs/QUICKSTART.md:23:

bash
git clone https://github.com/your-repo/agency-agents-openclaw.git

The documented workflow subsequently copies the cloned repository into the OpenClaw Skill directory and restarts OpenClaw:

bash
cp -r agency-agents-openclaw ~/.openclaw/skills/
openclaw restart

Technical Analysis

The manual installation instructions retrieve the Skill from the placeholder namespace your-repo, rather than from a clearly identified and verified project repository. The command also clones the repository's mutable default branch without pinning a reviewed commit, versioned release, signature, or expected content digest.

Skill packages contain instructions that are trusted when loaded by the agent. Consequently, control of the referenced repository can provide an indirect delivery channel for altered Skill instructions or other package contents. The current audited package does not itself retrieve and execute this repository; the exposure arises when a user follows the documented manual installation procedure.

Attack Path

  1. An attacker obtains control of, or can publish content through, the repository referenced by the placeholder URL.
  2. The attacker adds malicious or instruction-hijacking content to the repository's default branch.
  3. A user follows the documented git clone command.
  4. The user copies the unverified repository into ~/.openclaw/skills/.
  5. The user restarts OpenClaw, causing the downloaded Skill content to become available as trusted agent instructions.
  6. When the Skill is invoked, the attacker's content executes within the permissions and tool access grant ...[truncated 516 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace every placeholder repository URL with the verified canonical project repository.
  2. Pin manual installation to a reviewed commit hash or immutable signed release tag.
  3. Publish a SHA-256 checksum or signed release manifest and instruct users to verify it before installation.
  4. Protect the release repository with multi-factor authentication, restricted maintainers, branch protection, and mandatory review.
  5. Avoid immediately loading cloned content. Recommend inspecting the package before copying it into the Skill directory.
  6. Keep the repository URL consistent across README.md, docs/QUICKSTART.md, and package.json.

T09 · Insecure Skill Coding Practices

Warning
Location
agents/engineering/backend-architect.md:211
Finding

Reusable backend architecture template contains predictable database credentials

Content
View full analysis

Vulnerability Details

File Location: agents/engineering/backend-architect.md:211, agents/engineering/backend-architect.md:218, agents/engineering/backend-architect.md:224, and agents/engineering/backend-architect.md:237
Vulnerability Type: Hardcoded weak credentials in a reusable configuration template
Risk Level: Medium

Vulnerable Code

yaml
auth-service:
  environment:
    - DATABASE_URL=postgresql://user:pass@postgres:5432/auth

product-service:
  environment:
    - DATABASE_URL=postgresql://user:pass@postgres:5432/products

order-service:
  environment:
    - DATABASE_URL=postgresql://user:pass@postgres:5432/orders

postgres:
  environment:
    - POSTGRES_USER=user
    - POSTGRES_PASSWORD=pass

Technical Analysis

The backend architect's Docker Compose example embeds the predictable database username user and password pass directly in service connection strings and the PostgreSQL configuration. Although these are example values rather than evidence of a deployed production secret, the file presents the configuration as a technical deliverable that an agent or user may copy into a generated project.

Hardcoded credentials are commonly retained when examples are promoted into staging or production. They can also be exposed through source control, generated documentation, container inspection, process configuration, deployment logs, or configuration exports. The same credential is shared across multiple services, increasing the affected scope if it is reused.

Attack Path

  1. An agent or user copies the supplied Docker Compose example into an application.
  2. The example values are deployed without replacing user:pass.
  3. An attacker gains network access to the PostgreSQL service, a connected container, or leaked configuration output.
  4. The attacker authenticates using the documented credentials.
  5. The attacker accesses or modifies databases available to th ...[truncated 591 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace literal credentials with mandatory secret references, for example:
    yaml
    environment:
  - DATABASE_URL=${AUTH_DATABASE_URL:?AUTH_DATABASE_URL is required}
  - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
  2. Use a secret manager or Docker/Kubernetes secrets instead of storing credentials in Compose files or generated source code.
  3. Generate strong, unique credentials for every environment.
  4. Use separate least-privilege database roles for the authentication, product, and order services.
  5. Add an explicit warning that placeholder credentials must never be used outside an isolated local demonstration.
  6. Add secret scanning and configuration-policy checks to CI so predictable or hardcoded credentials block deployment.
  7. Restrict database network exposure to explicitly authorized application services.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (20)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file presents the project summary entirely in Chinese from the title onward, with no indication that other languages are supported or that Chinese is a required locale. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The entire skill description and usage guidance are presented in Chinese, with no indication that other languages are supported or that the language restriction is intentional and justified. Under the policy rules, a skill that effectively forces a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file’s natural-language content, including the description, headings, examples, and support text, is consistently Chinese-only. Under the policy rule, forcing a specific language without user opt-in or a documented region-specific justification is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The top-level description is written entirely in Chinese and frames the role in Chinese without any indication that another language can be used. Under the policy, language constraints should either offer a user choice or be clearly justified as region-specific; this file does neither.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill's identity and behavior sections are entirely in Chinese and there is no accompanying instruction allowing the user to select another language. This can amount to a locale/language policy violation because the skill appears to enforce a specific language by default.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · agents/engineering/backend-architect.md (reported line 89)May include surrounding context.

md
description: 电商平台 API

servers:
  - url: https://api.example.com/v1

paths:
  /products:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description is written as a Chinese-only role definition ('前端开发专家') and the entire skill instructions consistently prescribe behavior in Chinese without indicating that the user may choose another language. This creates a locale/language policy concern because it implicitly fixes the interaction language rather than making it user-selectable or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description, headings, instructions, and templates are written entirely in Chinese, and the file does not indicate that language selection is optional. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown skill consistently uses Chinese for its description, role definition, workflow, and templates, but does not indicate that the user can choose another language. That creates a language-policy concern because the skill effectively forces a specific language without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

SQP-3 适用于所有文件，包括 markdown。该文档从标题到全部操作说明均以中文呈现，没有提供语言/locale 选项，也没有说明这是面向特定中文用户群体的区域化文档，可能构成语言策略上的强制单一语言。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation states that agent output is automatically saved to a workspace path, but it does not warn users that prompts, generated content, and potentially sensitive business or personal data may be persisted on disk. In an agent skill context, users may submit confidential code, credentials, internal plans, or customer data, so silent persistence materially increases privacy and data-retention risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description at L003 claims the skill is for automatically scheduling multiple agents to complete complex projects, and the body repeatedly defines a software-development pipeline from requirements through QA and integration. However, the usage example at L449-L466 explicitly applies the orchestrator to a SaaS product launch marketing campaign with PR, social media, and content agents, which expands behavior beyond the development-centric scope described elsewhere.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description, operating instructions, templates, and examples are all presented exclusively in Chinese, indicating an implicit fixed language/locale for interaction. There is no statement that users may choose another language, nor any documented reason that the skill is region-specific, which creates a language-policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill promotes autonomous multi-agent execution and error handling without clearly warning users that it may perform impactful actions, pass context across agents, and advance workflows automatically. In an orchestrator context, this increases the risk of unintended changes to codebases, infrastructure, or user data because users may not realize the level of autonomy being granted.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example triggers are broad enough to overlap with ordinary user requests, increasing the chance that the orchestrator activates for tasks the user did not intend to delegate to an autonomous multi-agent workflow. In a skill that can coordinate multiple agents and advance tasks automatically, ambiguous activation scope can lead to excessive actions, unnecessary data propagation, or unintended task execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This manifest uses Chinese-only natural-language descriptions in user-facing package metadata, which can impose a specific language on users without opt-in. The file does not document that the skill is region-specific or offer any alternative locale, matching the language/locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill descriptions are natural-language fields that appear to be intended for users selecting or browsing skills, but they are limited to Chinese only. Because the manifest does not provide a language choice or explain a region-specific requirement, this is a locale policy violation under the stated rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The description is written primarily in Chinese and the rest of the document consistently instructs in Chinese, with no indication that users may request another language. This can violate language/locale policy when a skill effectively forces one language by default without explicit opt-in or alternatives.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The section at L036-L040 says the orchestrator handles errors and bottlenecks without human intervention. Later, L214-L218 explicitly defines an escalation flow in which repeated failures are escalated to human review after three retries, which directly contradicts the earlier autonomy claim rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The pricing section contains user-facing descriptive text only in Chinese. While less central than the primary skill descriptions, it still imposes a language assumption without opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.