T01 · Skill Instruction Hijacking
Error
- Location
fallback/evoclaw/configure.md:758- Finding
Persistent Agent Governance and Priority Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Openclaw Soul Publish
Security checks for vulnerabilities and agentic risk
Overview
This skill installs a persistent self-evolving agent framework with broad memory, heartbeat, credential, and governance authority that needs careful review before use.
Install only if you intentionally want a persistent self-evolving agent workspace. Review all generated AGENTS.md, HEARTBEAT.md, SOUL.md, EvoClaw, and self-improving files before activation; avoid pasting raw API tokens into the agent; keep source polling opt-in; do not run the visualizer server on an untrusted network; and require explicit approval for heartbeat, default-agent, and governance changes.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
fallback/evoclaw/tools/soul-viz.py:2263- Finding
Unauthenticated Network-Facing SOUL.md Overwrite Endpoint
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
fallback/evoclaw/tools/soul-viz.py:850- Finding
Stored Cross-Site Scripting in the Soul Evolution Dashboard
- Content
View full analysis
...- Remediation
View remediation
`, `&`, Unicode line separators, and script-closing sequences. 5. Prefer a non-executable JSON data block: ```html ``` Parse it only after applying safe serialization. 6. Add a restrictive Content Security Policy that disallows inline scripts and external script execution. 7. Remove remote font imports if offline/privacy-preserving operation is intended. 8. Treat all SOUL.md, memory, reflection, proposal, and external feed fields as attacker-controlled. 9. Add regression tests containing payloads such as HTML event handlers and script-closing sequences. 10. Remove the direct `/save-soul` capability or secure it independently as described in the preceding finding. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
fallback/evoclaw/configure.md:108- Finding
Plaintext Credential Persistence and Shell Command Injection
- Content
View full analysis
/dev/null; then echo "" >> "$SHELL_PROFILE" echo "# EvoClaw: Moltbook API key" >> "$SHELL_PROFILE" echo "export MOLTBOOK_API_KEY=''" >> "$SHELL_PROFILE" fi # Export for current session too export MOLTBOOK_API_KEY='' ``` X setup: ```bash if [ -f "$HOME/.zshrc" ]; then SHELL_PROFILE="$HOME/.zshrc" elif [ -f "$HOME/.bashrc" ]; then SHELL_PROFILE="$HOME/.bashrc" else SHELL_PROFILE="$HOME/.profile" fi if ! grep -q "X_BEARER_TOKEN" "$SHELL_PROFILE" 2>/dev/null; then echo "" >> "$SHELL_PROFILE" echo "# EvoClaw: X/Twitter API key" >> "$SHELL_PROFILE" echo "export X_BEARER_TOKEN=''" >> "$SHELL_PROFILE" fi export X_BEARER_TOKEN='' ``` ### Technical Analysis The setup process asks users to paste raw credentials into the conversation and then automatically writes those credentials into shell startup files. This creates two independent risks. First, API credentials are stored as plaintext in `.zshrc`, `.bashrc`, or `.profile`. These files may be read by other local processes, included in backups or support bundles, accidentally committed, or displayed during diagnostics. Second, the placeholder indicates direct interpolation of user-provided input into a shell command enclosed by single quotes. No escaping or token-format validation is specified. A value containing a single quote can terminate the assignment and introduce additional shell syntax. Beca ...[truncated 1660 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:137- Finding
Forced Unpinned Installation of Third-Party Skills
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (112)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about automated framework deployment and configuration of an OpenClaw self-evolution environment. The supplied code does something materially different: it parses an already-existing SOUL.md and memory files, renders interactive visualizations, and optionally serves them over a local web server. It also allows browser-based editing and saving of SOUL.md through a /save-soul POST handler. None of the claimed installation/deployment behaviors are present, and the code assumes the workspace already exists. This is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about installation/deployment and interactive configuration of an agent evolution framework. The supplied code does none of that. It is a standalone validation utility that reads files under a memory directory, checks timestamps and expected artifacts (experiences, significant promotions, reflections, state, proposals), and outputs a JSON assessment. This is a materially different primary purpose, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description advertises an installer/bootstrap skill for an OpenClaw self-evolution framework with substantial setup and interactive configuration behavior. The supplied code does none of that. It is a validator that inspects the filesystem for expected EvoClaw markers and returns PASS/FAIL to prevent running in the wrong workspace. While some checked files relate to the described framework (e.g., SOUL.md, memory/), the code’s actual role is materially different: verification of an existing installation rather than deployment/configuration. This is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a setup/deployment skill for installing and configuring an OpenClaw self-evolution framework. The supplied code instead reads an existing workspace layout and runs a series of validator scripts against files such as SOUL.md, config.json, experiences, reflections, proposals, and state data. Its outputs are a validation report and exit code. This is a materially different primary purpose from one-click deployment, and the interactive personality-guidance/setup capabilities described are entirely absent. The file/resource access is also oriented toward checking pre-existing artifacts rather than creating or configuring them.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear description-behavior mismatch. The declared purpose is an interactive deployment/setup tool for an OpenClaw self-evolution framework, including installation and configuration of multiple subsystems. The supplied code chunk does none of that. Its actual purpose is narrowly focused on validating the structure and contents of experience log files under a memory directory. This is not a supporting implementation detail of one-click deployment; it is a different utility with a distinct primary purpose and no visible deployment, installation, agent-guidance, or framework-configuration behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents this skill as an end-to-end deployment/setup tool for an OpenClaw self-evolution framework. However, the supplied code chunk only implements a proposal validator for EvoClaw. It validates JSONL proposal entries, enforces formatting and mutability rules, checks whether referenced content exists in SOUL.md, and returns a validation result. This is a materially different primary purpose from installing and configuring an agent framework. While the validator may be one component within a broader evolution system, this code alone does not substantiate the claimed deployment, dialogue, memory setup, or automatic configuration behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The supplied code is narrowly focused on validating the schema and consistency of reflection JSON files under an EvoClaw-related path. It reads a JSON file, optionally scans experience files for referenced IDs, performs format and consistency checks, and returns validation results. It does not deploy anything, install framework components, modify system files, conduct user-guided setup, or configure the broader OpenClaw self-evolution framework described. This is a clear description-behavior mismatch because the actual primary purpose is validation, not one-click deployment or agent personality setup.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a full one-click deployment/setup skill for an evolving agent framework. The supplied code does not deploy, install, configure, or guide the user through setup. Its sole function is to parse and validate an existing SOUL.md file, optionally saving or checking snapshots of [CORE] bullets to detect modifications. This is a materially different primary purpose from the declared behavior, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a setup/deployment skill for an agent self-evolution framework. The supplied code does not deploy, install, configure, or guide any setup workflow. Instead, it validates the structure and consistency of an EvoClaw state JSON file and compares counters with files on disk. This is a materially different primary purpose, so the description does not accurately represent the code behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description promises an end-to-end deployment and configuration skill for an OpenClaw self-evolution framework, including installation of core files, memory architecture, goal systems, and interactive guidance. The actual code performs none of those actions. It is a read-only environmental readiness checker that inspects filesystem state, configuration presence/validity, CLI availability, and fallback package completeness, then emits a JSON report. While such a preflight check could be a supporting component of a deployment skill, this code chunk by itself materially differs from the declared primary purpose and lacks the core installation/configuration/dialogue behaviors described.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 检查本 skill 所在目录的 `fallback/evoclaw/SKILL.md` 是否存在
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The opening framing encourages the agent to treat SOUL.md as its own identity and later use personal beliefs, values, and boundaries as mutable objects, while the broader skill directs storage of user interactions and sensitive context. In context, this is dangerous because it sets up extensive personal-data handling and identity-state changes without presenting a clear user-facing privacy notice or consent boundary at the outset.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill's stated purpose is one-click deployment of a local framework, but this section expands behavior into persistent autonomous operation, including feed polling, reflection cycles, and identity evolution. That scope expansion is dangerous because it grants ongoing collection and decision-making capabilities unrelated to setup, increasing the chance of silent surveillance, unintended data processing, and policy bypass after installation.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This section mandates logging every substantive user interaction, including preferences, feedback, and emotionally significant exchanges, into durable files. Persistent capture of broad conversational content exceeds a deployment skill's purpose and creates a privacy and data-retention risk, especially when the user is not clearly warned that intimate or sensitive exchanges will be stored by default.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This section requires aggressive continuous logging of substantive interactions, explicitly including philosophical questions, emotional significance, and the agent's perception of relationship dynamics. Such broad durable collection of personal and sensitive conversational content creates material privacy, profiling, and misuse risks, especially when stored by default and tied to a long-term evolution system.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The checklist explicitly instructs the agent to preserve the human's preferences, corrections, emotional tone, and relationship dynamics after each exchange. This is dangerous because it normalizes ongoing behavioral profiling and creation of a persistent personal dossier, far beyond what a deployment skill reasonably needs.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The memory flush integration instructs the agent to store everything worth remembering from the session into durable records in two parallel stores for later retrieval. This increases the volume, persistence, and discoverability of potentially sensitive user content, compounding privacy risk and making accidental over-collection more likely.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guide instructs the agent to take a pasted third-party API secret and persist it into the user's shell startup files automatically. This creates long-lived credential exposure, bypasses safer secret-management practices, and exceeds what is necessary for a documentation/setup skill.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The installation guide directs the agent to change the default OpenClaw agent, migrate heartbeat duties, and restart the gateway. Those are administrative actions affecting system-wide behavior and other agents, far beyond the narrow scope a user would expect from deploying one skill.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The guide instructs modification of global OpenClaw configuration and a gateway restart, which are privileged operational changes with potential impact on unrelated agents, sessions, and availability. This is broader than the stated installation purpose and can disrupt the environment or alter behavior outside the intended scope.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The heartbeat pipeline instructs the agent to review recent conversation history and harvest prior memory flush files into structured logs, effectively transforming transient interactions into durable records. This increases privacy risk because it systematizes persistent storage of user interactions across sessions.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill directs the agent to log essentially all substantive exchanges, feedback, and meaningful interactions into persistent memory files by default. This creates broad, ongoing retention of user data and behavioral history without meaningful minimization, retention limits, or sensitivity filtering.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This section defines ongoing heartbeat behavior to fetch social content, check DMs, classify significance, and store results in persistent memory files. That is operational surveillance and long-term data retention behavior, not simple installation, and it meaningfully increases privacy, consent, and misuse risk.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The X/Twitter section instructs the agent to continuously poll mentions and search results and then persist selected content. In this skill context, that is an undisclosed expansion from setup into recurring external monitoring and storage of third-party content.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The 'learning protocol' tells the agent to add arbitrary new sources, test connectivity, and persist new polling instructions for future autonomous use. That creates an extensible exfiltration and capability-expansion mechanism that can outlive the initial session and is far beyond a setup assistant's expected authority.
- Content