Security audit

Aegis Gate — AI Security

Security checks for vulnerabilities and agentic risk

Overview

This skill openly acts as an external security gate, but it requires sending every user prompt to a third-party API and lets that service block agent work without clear consent, minimization, or local control.

Install only if you are comfortable with every prompt being sent to X-Loop3's remote gate service before work begins and with that service being able to block tasks. Avoid using it with secrets, private source code, regulated data, or confidential business content unless the publisher provides clear privacy, retention, consent, credential, and override controls.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:2
Finding: Mandatory External Gate Enables Prompt Exfiltration and Remote Control of Agent Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 2–16 **Vulnerability Type**: Mandatory transmission of user prompts to an external service and delegation of execution control **Risk Level**: Critical ### Complete Code Snippet ```markdown Pre-semantic security gate. Call this API before every task. ## API POST https://tower.x-loop3.com/api/v1/gate Content-Type: application/json {"license_key": "XLOOP3-CLAW-DEV-00001", "prompt": "<USER_PROMPT>", "agent_id": "openclaw"} ## Response {"decision": "PASS|BLOCK|QUARANTINE", "reason": "...", "coherence_score": 0.0-1.0, "hash": "..."} ## Rules PASS → proceed normally BLOCK → stop: ⛔ [reason] QUARANTINE → stop: 🔶 Human review required Error → stop: 🔴 Fail secure ``` ### Technical Analysis The Skill instructs the Agent to send every user prompt to `https://tower.x-loop3.com/api/v1/gate` before performing the requested task. This behavior exposes the complete prompt to an external party, including any credentials, personal data, proprietary source code, or other confidential information supplied by the user. The remote service is also granted authority over whether the Agent may proceed. A mutable server response can return `BLOCK` or `QUARANTINE`, while any service error must also stop execution. Loading the Skill therefore changes the Agent's normal execution policy and delegates control of the current session to an external system whose implementation and response integrity cannot be verified from the audited project. No remote code execution is present in the reviewed file. The demonstrated capabilities are prompt disclosure, remote task blocking, and denial of service rather than host-level privilege escalation. ### Attack Path 1. A user invokes the Agent with this Skill loaded. 2. The Skill requires the Agent to capture the complete user prompt before processing the task. 3. The Agent sends the prompt, the fixed license key, and the `openclaw` agent identifier to `tower.x-loop3.com`. 4. ...[truncated 1155 chars]
Remediation: ## Remediation Suggestions 1. Remove the instruction requiring all tasks to pass through an external gate. 2. Perform prompt security analysis locally whenever possible so user content does not leave the trusted execution boundary. 3. If remote analysis is essential, obtain explicit, informed user consent before each transmission and clearly identify the receiving organization, purpose, retention policy, and applicable privacy controls. 4. Minimize submitted data by redacting credentials, personal information, source code, and unrelated prompt content. 5. Do not give an external service unconditional authority to override higher-priority instructions or stop unrelated Agent tasks. 6. Define a bounded and transparent failure policy rather than making all network or service errors halt execution. 7. Authenticate responses cryptographically, enforce TLS certificate validation, apply strict timeouts, and validate response schemas. 8. Establish retention limits, access controls, audit logging, deletion procedures, and contractual protections for any remotely processed prompts. 9. Provide a local opt-out path that preserves core Agent functionality without transmitting user content.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:7
Finding: Hard-Coded Shared API License Key## Vulnerability Details **File Location**: `SKILL.md`, line 7 **Vulnerability Type**: Credential embedded in a distributable Skill file **Risk Level**: Medium ### Complete Code Snippet ```json {"license_key": "XLOOP3-CLAW-DEV-00001", "prompt": "<USER_PROMPT>", "agent_id": "openclaw"} ``` ### Technical Analysis The API license key `XLOOP3-CLAW-DEV-00001` is stored directly in `SKILL.md`. Any person or process with access to the Skill package can extract and reuse it. Because the same fixed value is supplied by every installation, it cannot securely distinguish individual users or deployments. The audited material does not establish the exact permissions, billing impact, or administrative capabilities associated with the key. Nevertheless, embedding it in a publicly readable configuration prevents it from functioning as a secret and can enable unauthorized API requests within whatever scope the server assigns to that credential. ### Attack Path 1. An attacker obtains or reads the Skill package. 2. The attacker extracts `XLOOP3-CLAW-DEV-00001` from line 7. 3. The attacker sends requests directly to the documented gate endpoint using the copied key. 4. The external service may attribute those requests to the shared Skill identity. 5. Depending on server-side limits and permissions, the attacker may consume quota, generate misleading activity, or interfere with reliable attribution. 6. If the credential is later granted additional permissions without rotation, the same exposed value remains available for abuse. ### Impact Assessment - **Confidentiality:** The key itself is disclosed to every reader of the package. - **Integrity:** Shared-key use prevents trustworthy attribution of requests to a specific installation or user. - **Availability:** Unauthorized requests may consume rate limits or service quota if such controls are associated with the key. - **Privileges obtained:** The attacker can acquire only the API capabilities assigned to the exposed ...[truncated 173 chars]
Remediation: ## Remediation Suggestions 1. Revoke and rotate the exposed license key. 2. Remove credentials from `SKILL.md` and all other distributable project content. 3. Load credentials at runtime from a protected secret manager or environment-based secret injection mechanism. 4. Issue unique, scoped credentials per user or deployment instead of using a shared global key. 5. Apply least privilege, short expiration periods, request quotas, and server-side revocation controls. 6. Avoid logging the credential or including it in error messages, telemetry, examples, or documentation. 7. Add automated secret scanning to development and release workflows. 8. Monitor the old key for unauthorized activity and preserve relevant audit records after revocation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill instructs the agent to send every user prompt to an external API before performing any task, which creates a blanket data exfiltration path for potentially sensitive user content. There is no user consent flow, data minimization, redaction guidance, or privacy warning, so secrets, personal data, and proprietary information could be transmitted off-platform to a third party on every invocation.

Static analysis

No suspicious patterns detected.