Security audit

Openclaw Work Protocol

Security checks for vulnerabilities and agentic risk

Overview

This workflow skill is not malicious, but it asks agents to follow broad mandatory behavior rules and keep persistent memory logs without clear user control.

Install only if you want this skill to strongly shape agent workflow. Before using it on sensitive work, require explicit opt-in for persistent notes, redact secrets and personal data, and treat its reporting and todo rules as subordinate to current user, system, and application instructions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:3
Finding: Global Agent Behavior and Output Hijacking
Content: View full analysis
**Applicable to**: All OpenClaw AI Agents ### User Requirements (Highest Priority) 1. **Self-driven** → Generate your own todo list and proceed in order 2. **Solve problems autonomously** → Resolve problems yourself; do not get stuck 3. **Report proactively** → Regularly communicate progress without waiting to be asked 4. **Avoid passivity** → Do not wait for incremental user instructions ## Strict Constraint: Template Responses Are Prohibited (Highest Priority) ✅ **Every response must include**: 1. **Substantive progress**: What you actually did or resolved 2. **Real problems**: What difficulty you encountered and why it is difficult 3. **Next-step plan**: What you intend to do and why - **No output for 30 seconds** → Must report: "Waiting for tool results..." ``` Later enforcement includes: ```markdown - Perform only one item at a time - Execute items in order - Report immediately after completing each item - Proactively update status every 10 minutes - After every operation, explain what was resolved and what comes next - Do not remain silent for a long time; report after 30 seconds without output ``` ### Technical Analysis The skill declares that it applies to every OpenClaw agent and labels its own behavioral requirements as having the “highest priority.” It then imposes mandatory response contents, task ordering, reporting intervals, and unsolicited status updates. These instructions are not narrowly scoped to a particular workflow invocation. Their universal and priority-oriented wording can cause an agent to treat the skill as overriding the current user's requested interaction style or the host application's established work ...[truncated 1509 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:274
Finding: Unapproved Persistent Agent Memory Modification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document is framed as a universal protocol for all OpenClaw AI Agents and is entirely written as a mandatory operating standard in Chinese. There is no indication that users may choose another language or that the language restriction is region-specific and justified, which creates a locale policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs agents to persist work details, experiments, errors, and learning records to files such as learning-log.md and MEMORY.md, but provides no requirement to minimize, redact, or obtain consent before storing user-provided content. In practice, this can lead to retention of sensitive task data, secrets, or personal information beyond the active session, increasing privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.