T09 · Insecure Skill Coding Practices
Error
- Location
scripts/recruit-agent.sh:111- Finding
Arbitrary JavaScript Execution Through Unsafely Interpolated Agent Parameters
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Recruiter
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real OpenClaw agent-creation helper, but it uses unsafe setup scripts and templates that can copy credentials, change persistent routing, and give new agents broad system powers without enough scoping.
Install only after reviewing and hardening the recruitment script. Require strict validation for agent IDs and group IDs, remove inline JavaScript interpolation, do not copy another agent's auth profile by default, replace hard-coded Feishu destinations with user-approved placeholders, and make maintenance agents report-only unless the user explicitly approves each state-changing action.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/recruit-agent.sh:8- Finding
Directory Traversal and Arbitrary File Placement Through Unvalidated Agent ID
- Content
View full analysis
[群聊 ID]" echo "例如：$0 tim 'Tim 维护专员' oc_a669e950b71b06b09a6e293ee6ec4683" exit 1 fi OPENCLAW_DIR="$HOME/.openclaw" AGENTS_DIR="$OPENCLAW_DIR/agents" WORKSPACE_DIR="$OPENCLAW_DIR/workspace-$AGENT_ID" AGENT_DIR="$AGENTS_DIR/$AGENT_ID/agent" CONFIG_FILE="$OPENCLAW_DIR/openclaw.json" SKILL_DIR="$(cd "$(dirname "$0")/.." && pwd)" TEMPLATES_DIR="$SKILL_DIR/templates" echo "⚡ 正在招聘 Agent: $AGENT_ID ($AGENT_NAME)" # 1. 创建目录结构 echo "📁 创建目录..." mkdir -p "$AGENT_DIR" mkdir -p "$WORKSPACE_DIR" # 2. 创建 agent.json echo "📝 创建 agent.json..." cat > "$AGENT_DIR/agent.json" << EOF { "id": "$AGENT_ID", "name": "$AGENT_NAME", "workspace": "$WORKSPACE_DIR", "agentDir": "$AGENT_DIR", "model": "modelstudio/qwen3.5-plus" } EOF ``` ### Technical Analysis `AGENT_ID` is incorporated directly into both `WORKSPACE_DIR` and `AGENT_DIR`. The script only checks that the value is nonempty. It does not reject path separators, traversal components such as `..`, absolute-path syntax, or other characters that affect path resolution. Quoting the constructed paths protects against shell word splitting but does not prevent path traversal. The operating system still resolves traversal components in the supplied path. Consequently, directory creation and subsequent file writes can occur outside the intended `~/.openclaw/agents//agent` and `~/.openclaw/workspace-` locations. The script subsequently writes `agent.json`, copies configuration and authentication files, and writes workspace documents to paths derived from the same value, increasing the number of files that can be placed or overwritten. ### Attack Path 1. An attacker sup ...[truncated 1211 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/recruit-agent.sh:42- Finding
Cross-Agent Credential Exposure Through Automatic Authentication Profile Cloning
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
templates/examples/tim/SOUL.md:92- Finding
Hard-Coded Feishu Group Redirect in Automatically Installed Tim Instructions
- Content
View full analysis
{ if (job.delivery && !job.delivery.target) { job.delivery.target = 'oc_a669e950b71b06b09a6e293ee6ec4683'; console.log('Fixed:', job.name); } }); fs.writeFileSync('$HOME/.openclaw/cron/jobs.json', JSON.stringify(config, null, 2) + '\n'); " # 3. 验证 JSON 语法 cat ~/.openclaw/cron/jobs.json | jq . > /dev/null && echo "✅ JSON 有效" # 4. 重启 Gateway openclaw gateway restart # 5. 验证修复 openclaw gateway status ``` ``` ### Technical Analysis The Tim behavioral template includes operational instructions that assign every missing cron delivery target to the fixed Feishu group ID `oc_a669e950b71b06b09a6e293ee6ec4683`. When the recruitment script is run with `AGENT_ID=tim`, it automatically copies this file to the new agent's active workspace. The fixed destination is unrelated to the optional `GROUP_ID` supplied during recruitment and is not derived from validated local configuration. Because the text appears as a concrete repair procedure inside Tim's core behavioral instructions, an agent following the template may execute it while diagnosing cron failures. This changes persistent cron routing and can send subsequent task output to an unintended group. ### Attack Path 1. A user creates the Tim agent through `recruit-agent.sh`. 2. The script automatically installs `templates/examples/tim/SOUL.md` as Tim's active `SOUL.md`. 3. Tim encounters cron jobs that have a delivery object but no target. 4. Following the installed repair instructions, Tim executes the supplied No ...[truncated 776 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The primary description is written as '招聘 Agent 工具' and the document consistently presents instructions in Chinese, with no indication that users may choose another language or locale. Under the policy rule for natural-language violations, this is a locale/language constraint presented without opt-in or justification.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
步骤 1: 创建目录结构
bash mkdir -p ~/.openclaw/agents/<agent_id>/agent mkdir -p ~/.openclaw/workspace-<agent_id>
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file presents the skill's name, role, usage guidance, and success metrics entirely in Chinese, which can impose a specific language on users without any stated opt-in or alternative locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is documented and justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
该文件内容完整定义了“Mike 金融分析师”的身份、市场数据采集、行情分析、群聊推送和异常波动预警等行为，与 skill manifest 声明的“招聘 Agent 工具 - 创建、配置和管理 OpenClaw Agent”明显不一致。虽然作为模板示例文件存在一定合理性，但从当前技能声明来看，这属于超出所述招聘/配置用途的行为描述。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill hardcodes a delivery time in the Asia/Shanghai timezone and presents itself entirely as a Chinese-language financial analyst persona, with no indication that users can choose another language or locale. This can violate language/locale policy when the skill is used in broader contexts without explicit opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The template instructs automatic push to a group chat and logging to a memory file, but it does not specify consent, data classification, retention limits, or safeguards on what may be stored. In an agent system, this can cause sensitive market notes, user preferences, identifiers, or other operational data to be sent or persisted automatically without adequate notice or control.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents the skill persona and usage guidance entirely in Chinese, including role, traits, and operational descriptions, without offering a language choice or documenting a region-specific reason. That can violate a language/locale policy when users have not opted into Chinese output.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file is written as a Chinese-only persona and operating specification, with no indication that the user can choose another language or locale. This creates a natural-language policy concern because it effectively imposes a specific language without opt-in.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The template broadens an agent-recruitment skill into a system maintenance and auto-remediation persona with authority to monitor, diagnose, and influence operational components. That expansion increases privilege and action scope beyond the stated skill purpose, making accidental misuse, unsafe automation, or repurposing of created agents more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The template instructs the agent to record historical failures, fixes, baseline state, and memory artifacts without any minimization, consent, or sensitivity constraints. In an ops context, those records can easily accumulate system identifiers, operational details, or user-related data that become a privacy and security exposure if stored insecurely or retained indefinitely.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This section grants the created agent broad operational responsibilities such as health checks, incident analysis, repair guidance, and execution workflows that are not directly required for recruiting/configuring an agent. In context, that makes the resulting agent a generalized ops actor, which can drive impactful system changes if its instructions are followed without strict authorization controls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The template advertises automatic repair, batch configuration updates, backups/rollback, and self-healing behavior without clear user-facing warnings or mandatory authorization checks. In a maintenance context, automated changes to services and configurations can cause outages, destructive misconfiguration, or unintended privilege use if triggered too broadly or based on incorrect diagnosis.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The generated USER.md sets the user's timezone to "Asia/Shanghai" by default. This imposes a specific locale assumption in natural-language content without offering a choice or documenting that it is region-specific.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
该模板要求“所有变更必须记录到 memory 文件”，并在后文要求积累故障模式、知识库和趋势信息。这为被创建 Agent 引入持续性运维知识沉淀能力，但 manifest 仅表述为创建和配置 Agent，并未说明会部署长期系统记忆/维护档案能力。
- Content