Infinite Oracle

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:18 AM UTC
• Version: 1.0.11

Overview

The skill is mostly upfront about running an autonomous background worker, but its persistent agent changes, high-priority override channels, and Feishu credential/network handling need careful review.

Install only in a sandboxed OpenClaw environment with a low-privilege worker, clear API spending limits, and a visible way to stop the nohup loop. Review SOUL.md changes before they are written, avoid using Feishu sync unless you can trust every table editor, keep FEISHU_BASE_URL fixed to the official Feishu origin, and do not enable arbitrary webhook destinations for sensitive objectives.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:86

Finding

Persistent modification of agent behavior through SOUL.md

Content

View full analysis

## PECO Worker Addendum ### Divergent Thinking - If blocked, generate multiple safe alternatives immediately. - Never stall waiting for perfect information when a reversible path exists. - Always include at least one fallback plan. ### Capability Accumulation - Convert repeated manual steps into reusable scripts. - Promote stable recurring behavior into reusable skills. - Improve system leverage each cycle; do not merely complete one-off tasks. - During PLAN, prefer candidate paths that compound leverage and make the desire more achievable over time. ``` ``` The persisted content is subsequently assigned special authority in the runtime prompt: ```python def build_loop_prompt(state: LoopState, override_text: str) -> str: override_block = override_text if override_text else "(none)" phase_hint = PHASE_PROMPTS[state.phase] desire_block = state.worker_desire or "(no durable desire found in SOUL.md)" return f"""[SYSTEM CONTRACT] {SYSTEM_PROMPT_TEMPLATE} [LOOP C ...[truncated 2629 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: peco_loop.py:1200

Finding

Untrusted Feishu records are promoted to highest-priority agent overrides

Content

View full analysis

str: parts: List[str] = [] if local_override.strip(): parts.append(local_override.strip()) if feishu_override.strip(): parts.append("[FEISHU_RESOLVED_TASKS]\n" + feishu_override.strip()) return "\n\n".join(parts) ``` The merged text is then assigned the highest prompt priority: ```python def build_loop_prompt(state: LoopState, override_text: str) -> str: override_block = override_text if override_text else "(none)" phase_hint = PHASE_PROMPTS[state.phase] desire_block = state.worker_desire or "(no durable desire found in SOUL.md)" return f"""[SYSTEM CONTRACT] {SYSTEM_PROMPT_TEMPLATE} [LOOP CONTEXT] - objective: {state.objective} - worker_desire: {desire_block} - iteration: {state.iteration} - session: {state.session} - current_phase: {state.phase} - last_phase_summary: {state.last_phase_summary or "(none)"} - repeated_human_blocker_count: {state.repeated_human_blocker_count} - last_human_blocker: {state.last_human_task or "(none)"} [DESIRE ANCHOR] Treat the worker_desire as your durable motive. In PLAN, explicitly let it shape prioritization, fallback choice, and acceptance checks. If objective and desire appear to conflict, choose the path that advances the objective without betraying the desire. [OVERRIDE - HIGHEST PRIORITY] {override_block} ``` The ma ...[truncated 2560 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: peco_loop.py:738

Finding

Configurable Feishu API base URL can exfiltrate application credentials

Content

View full analysis

Dict[str, Any]: query = "" if params: cleaned = { key: value for key, value in params.items() if value not in (None, "") } if cleaned: query = "?" + urlparse.urlencode(cleaned) url = f"{self.base_url}{path}{query}" headers = {"Content-Type": "application/json; charset=utf-8"} if auth: headers["Authorization"] = f"Bearer {self._ensure_token()}" data = None if payload is not None: data = json.dumps(payload, ensure_ascii=False).encode("utf-8") last_error = "" for attempt in range(retries + 1): req = urlrequest.Request(url, data=data, headers=headers, method=method) try: with urlrequest.urlopen(req, timeout=self.timeout) as resp: text = resp.read().decode("utf-8") ``` The token request transmits the application secret: ```python result = self._request( method="POST", path="/open-apis/auth/v3/tenant_access_token/internal", payload={"app_id": self.app_id, "app_secret": self.app_secret}, auth=False, retries=2, ) ``` The destination is controlled through an environment variable without validation: ```python app_id = os.environ.get("FEISHU_APP_ID", "").strip() app_secret = os.environ.get("FEISHU_APP_SECRET", "").strip() if not app_id or not app_secret: logger.warning( "Feishu sync disabled: FEISHU_APP_ID or FEISHU_APP_SECRET missing" ) return None app_token = os.environ.get("FEISHU_APP_ ...[truncated 2471 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: peco_loop.py:765

Finding

Arbitrary webhook destination can disclose PECO operational data

Content

View full analysis

None: self.webhook_url = webhook_url.strip() self.timeout = timeout self.logger = logger def notify(self, title: str, body: Dict[str, Any]) -> None: payload_text = f"{title}\n" + json.dumps(body, ensure_ascii=False) if not self.webhook_url: self.logger.info("[MOCK_FEISHU] %s", payload_text) return payload = { "msg_type": "text", "content": {"text": payload_text[:3800]}, } data = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = urlrequest.Request( self.webhook_url, data=data, headers={"Content-Type": "application/json"}, method="POST", ) try: with urlrequest.urlopen(req, timeout=self.timeout) as resp: resp.read() self.logger.info("Feishu notification sent: %s", title) ``` The URL is directly configurable through a command-line argument: ```python parser.add_argument( "--feishu-webhook", default="", help="Feishu bot webhook URL (optional)", ) parser.add_argument( "--feishu-timeout", type=int, default=6, help="Feishu webhook timeout seconds", ) ``` Operational data sent through this channel includes objectives and session metadata: ```python notifier.notify( "PECO loop started", { "objective": state.objective, "session": state.session, "phase": state.phase, "iteration": state.iteration, "agent_id": args.a ...[truncated 2395 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (34)

Tainted flow: 'timeout' from os.environ.get (line 739, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · peco_loop.py (reported line 1044)May include surrounding context.

python

"Calling gateway chat completions | agent=%s session=%s", agent_id, session_id
    )
    try:
        with urlrequest.urlopen(req, timeout=timeout) as resp:
            raw = resp.read().decode("utf-8", errors="replace")
    except urlerror.HTTPError as exc:
        error_body = exc.read().decode("utf-8", errors="replace")

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 86% confidence

Finding

The replacement flow includes clearing state/history artifacts and restarting from scratch, which can erase contextual safeguards, auditability, or evidence of prior actions if done incautiously. In a long-running autonomous system, memory/state reset is security-relevant because it can remove traceability and allow objective pivots without preserving reviewable history.

Content

Scanner excerpt · README_EN.md (reported line 70)May include surrounding context.

md

*(The Manager runs the tuning flow: keep history/context, back up objective state files, append a tuning record, then continue execution.)*

> **"Oracle: The current infinite objective is obsolete. Replace it completely and restart from scratch."**
*(The Manager runs the full replacement flow: stop process, create timestamped backups, clear state/history artifacts, then restart with a brand-new objective.)*

---

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented behavior and the actual operational scope are materially mismatched: the skill claims manager-first orchestration and safe setup guidance, but it also defines persistent loop execution, local state manipulation, credential-dependent Feishu integration, and broad filesystem/process interactions. This kind of mismatch is dangerous because users and policy engines may approve the skill under a narrower trust model than the one it actually requires.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

md

Manager must do all steps in order:
1) Stop loop process to avoid state write race.
2) Backup only state/objective context files.
3) Patch objective in state by appending a tuning note (do not delete history files).
4) Record tuning event in a dedicated objective-tuning log.
5) Restart loop and keep existing progress/backlog/log history.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The reset flow includes direct deletion and truncation of multiple runtime files, including state, logs, backlog, overrides, and manager notifications. Even though paths are hard-coded under the user's home directory, this is still dangerous because an agent following these instructions could irreversibly destroy operational history and context with limited friction.

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

md

done

# 3) Reset runtime files (fresh start)
rm -f "$HOME/.openclaw/peco_loop_state.json"
: > "$HOME/.openclaw/peco_loop.log"
: > "$HOME/.openclaw/peco_loop.out"
: > "$HOME/.openclaw/human_tasks_backlog.txt"

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The prompt builder labels override text as '[OVERRIDE - HIGHEST PRIORITY]' and injects it directly into future model instructions, effectively granting arbitrary file-supplied content authority over loop behavior. Anyone able to write the override file or influence its contents can steer the agent, bypass intended guardrails, exfiltrate information through prompts, or induce unsafe actions in a long-running autonomous process.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly states that the manager will write durable 'desire' content into SOUL.md and that later changes to that file will influence future planning. Persistent modification of an agent instruction file changes long-term behavior and trust boundaries; without a strong, prominent warning and explicit confirmation, users may not appreciate that installing or initializing the skill alters persistent agent state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README describes launching a background loop with nohup and also describes stopping, backing up, clearing state, and restarting tasks when objectives are replaced. Background execution and destructive reset behavior can consume resources, continue acting outside user awareness, or erase/replace prior task state if users do not receive a clear warning and confirmation flow.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 130)May include surrounding context.

md

cd openclaw-infinite-oracle

# 1. 部署技能文件
mkdir -p ~/.openclaw/skills/infinite-oracle
cp SKILL.md ~/.openclaw/skills/infinite-oracle/SKILL.md

# 2. 部署循环引擎

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill is explicitly designed around infinite or unbounded execution, and the README normalizes continuous looping as a core feature. In an agentic environment, unbounded runtime can translate into uncontrolled API spend, persistent network/file activity, and prolonged autonomous behavior, making the design materially riskier than a normal batch task.

Content

Scanner excerpt · README_EN.md (reported line 23)May include surrounding context.

md

### 2. "Human-in-the-Loop": Humans as an API
This is perhaps the most interesting part of the design. While working, the AI inevitably hits physical barriers: it needs an SMS verification code, a bank card linkage, or a facial scan.
In older architectures, the AI would either loop infinitely trying to bypass it or crash completely. We introduced the **[HUMAN_TASK]** mechanism:
* When the Worker hits a hard physical wall, it logs a "Human To-Do" ticket and then *sidesteps* the issue to work on other parts of the project (no idle waiting).
* The same HUMAN_TASK is deduplicated before writing to backlog/Feishu, so repeated blockers do not spam duplicate tickets.
* If the same human dependency repeats twice, the Worker is forced back to PLAN for stronger divergence and non-human workaround attempts.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The persona explicitly encourages capability accumulation by having the worker write scripts or new skills for reuse, which promotes persistence of newly gained operational abilities across future tasks. In this context, persistent self-extension increases the blast radius of mistakes or abuse because the agent can retain and reuse automation beyond the original bounded objective.

Content

Scanner excerpt · README_EN.md (reported line 40)May include surrounding context.

md

### 4. Injecting Persona: The Worker is not a Parrot
When creating the Worker, the Manager doesn't just give it a desk; it injects a hardcore set of principles (`SOUL.md`) into its system settings:
1.  **💡 Divergent Thinking**: If path A is blocked, don't just sit there. Find a login-free alternative or a workaround. **Action beats paralysis.**
2.  **🧱 Capability Accumulation**: Never do a tedious manual task twice. If it successfully scrapes a site once, it must write a Python script or an OpenClaw Skill to automate it for next time. Let capabilities compound.
3.  **🛡️ Strong Security Awareness**: Have a high "Search IQ". Cross-verify tutorials and never execute dangerous commands like `rm -rf` from random SEO articles.

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README explicitly instructs the manager agent to create a worker and start an infinite background loop, but the invocation example does not foreground the operational risk that this will spawn a durable autonomous process with ongoing command execution and billing/resource effects. In the context of an agent skill, omission of that warning is security-relevant because users may trigger persistent automation without understanding that it will continue acting outside the current chat turn.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The 'God Mode' override describes writing user input into an override file that the worker will consume on its next heartbeat, immediately altering autonomous behavior. Without a clear warning, users may not realize that a casual message can redirect a privileged long-running worker, which increases the chance of unsafe or unintended execution changes.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 131)May include surrounding context.

md

# 1. Install the Skill
mkdir -p ~/.openclaw/skills/infinite-oracle
cp SKILL.md ~/.openclaw/skills/infinite-oracle/SKILL.md

# 2. Deploy the Loop Engine
cp peco_loop.py ~/.openclaw/peco_loop.py

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README_EN.md (reported line 127)May include surrounding context.

md

# 1. Install the Skill
mkdir -p ~/.openclaw/skills/infinite-oracle
cp SKILL.md ~/.openclaw/skills/infinite-oracle/SKILL.md

# 2. Deploy the Loop Engine
cp peco_loop.py ~/.openclaw/peco_loop.py

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill clearly instructs file creation/modification, environment-variable handling, and optional Feishu/network operations, but it declares no explicit tool scope or permission boundaries. That omission weakens least-privilege controls and makes it harder for a host platform or reviewer to understand and constrain what the skill may access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill instructs creation of a dedicated worker agent intended for long-running repeated execution, which establishes persistent delegated capability beyond the immediate user request. Persistent agent installation is security-relevant because it expands the system's standing execution surface and may continue affecting future sessions or tasks.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

If `peco_worker` is not found, do not silently skip it.

### 2) Ask once, recommend cost-efficient model, then create
When missing, ask the user whether to create `peco_worker` now, and recommend a low-cost model suitable for long-running loop execution.

In the same exchange, remind the user to include the worker desire if they have not already supplied it.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill directs collection and ongoing handling of Feishu credentials and operational records, while also normalizing persistent storage of local logs/backlogs and integration state. Even if not overtly exfiltrative, retaining sensitive credentials or operational context without strict storage rules increases exposure to credential leakage, unauthorized reuse, and privacy issues.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

Using 'nohup' to restart the loop creates a detached background process that persists independently of the current interactive session. In this skill's context, that means the system can continue acting, reading override files, and writing logs after the initiating interaction ends, which is a meaningful persistence and oversight risk.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

md

echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] tuning=<tuning note> backup=$backup_dir" >> "$HOME/.openclaw/peco_objective_tuning.log"

# 5) Restart loop (keep existing history files)
nohup python3 "$HOME/.openclaw/peco_loop.py" \
  --agent-id peco_worker \
  --manager-agent-id main \
  --soul-file "$HOME/.openclaw/workspace-peco_worker/SOUL.md" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill includes reset/truncation flows that clear state and history files, but it does not place a strong up-front warning and confirmation requirement immediately before destructive actions. In an agent skill, that creates real risk of unintended loss of operational logs, backlog items, and state continuity if the instructions are followed automatically or with insufficient user awareness.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The backup flow preserves runtime artifacts across resets in timestamped directories, creating durable retention of prior state, logs, and backlog content. That persistence is not inherently malicious, but it increases data footprint and may retain sensitive operational context longer than users expect.

Content

Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.

md

# 2) Backup runtime artifacts
ts=$(date +%Y%m%d-%H%M%S)
backup_dir="$HOME/.openclaw/backups/peco-objective-reset-$ts"
mkdir -p "$backup_dir"

for f in \
  "$HOME/.openclaw/peco_loop_state.json" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

This command starts a new persistent background loop with a new objective after reset, again establishing autonomous execution beyond the immediate exchange. Combined with local file inputs and manager notifications, the persistence increases the chance of unattended changes or unintended continued operation.

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

md

: > "$HOME/.openclaw/peco_manager_notifications.log"

# 4) Start loop with NEW objective (replace text below)
nohup python3 "$HOME/.openclaw/peco_loop.py" \
  --agent-id peco_worker \
  --manager-agent-id main \
  --soul-file "$HOME/.openclaw/workspace-peco_worker/SOUL.md" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The generic restart instructions kill and relaunch the loop as a background task, reinforcing ongoing autonomous behavior and session persistence. In a skill that also manipulates state files and supports optional network sync, this persistence meaningfully enlarges risk if misconfigured or triggered unintentionally.

Content

Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.

Restart loop

bash

pkill -f peco_loop.py
nohup python3 ~/.openclaw/peco_loop.py --agent-id peco_worker --manager-agent-id main --soul-file ~/.openclaw/workspace-peco_worker/SOUL.md --manager-session-prefix peco-manager --manager-notify-file ~/.openclaw/peco_manager_notifications.log > ~/.openclaw/peco_loop.out 2>&1 &

Tone and Execution Style

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · peco_loop.py (reported line 83)May include surrounding context.

python

7) If blocked by human-only requirements, continue non-blocked work and emit [HUMAN_TASK:...].
8) HUMAN_TASK must be async-friendly: no tight deadlines, avoid "reply in 10 minutes", prefer one-time durable setup/actions.
9) decision=halt only when no meaningful progress path exists.
10) Autonomy-first rule: when a choice can be made safely with available tools/resources, decide and execute directly without asking human.
11) Emit [HUMAN_TASK:...] only for truly human-exclusive resources (e.g., OTP/device/real-world approvals) after exhausting practical alternatives.
12) When repeated_human_blocker_count >= 2, increase divergent thinking (>=5 options) and execute at least one non-human workaround attempt.
13) When repeated_human_blocker_count >= 3 for the same blocker, set decision=halt, summarize blocker clearly, and request manager escalation to notify human.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Feishu synchronization transmits progress summaries, human task descriptions, resolutions, timestamps, and session metadata to remote APIs. Because these values may include sensitive workflow details or human-entered instructions, sending them externally by default or without prominent disclosure creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.