Agentic Security Audit

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:50 PM UTC
• Version: 1.0.0

Overview

This is a coherent security-audit helper, but it needs review because some default audit commands can expose local credential, host, agent-memory, and personal-data details in logs or chat output.

Install only if you are comfortable with an agent running security-audit commands that may scan beyond the project and place sensitive findings in output. Prefer project-scoped use first, approve any host-level checks explicitly, pin audit-tool versions before installing them, and redact secret or PII matches instead of printing raw lines.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Remediation

View remediation

`. - Use `pip install pip-audit==`. - Replace `@latest` with an exact Go module version. - Use `cargo install --version cargo-audit`. 2. Verify package signatures, checksums, provenance attestations, or lockfile integrity where supported. 3. Prefer trusted, preinstalled audit tools supplied by the execution environment. 4. Execute downloaded tools inside a restricted container or sandbox with: - Read-only source mounting where possible. - No access to SSH, cloud, or agent credentials. - Restricted outbound networking. - No elevated privileges. 5. Document the approved publisher, package source, version, and expected checksum for each tool. 6. Avoid automatically installing missing tools. Require explicit user approval before any network retrieval or package execution. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:670

Finding

Over-Broad Host and Credential-Surface Reconnaissance

Content

View full analysis

/dev/null | head -20 # Check SSH key permissions if [ -d ~/.ssh ]; then echo "--- SSH directory permissions ---" ls -la ~/.ssh/ echo "" # Should be: dir=700, private keys=600, public keys=644, config=600 [ "$(stat -c %a ~/.ssh 2>/dev/null || stat -f %Lp ~/.ssh)" != "700" ] && echo "WARNING: ~/.ssh should be 700" fi ``` ```bash # Background processes agent has created echo "Running agent processes:" ps aux | grep -i 'cron\|heartbeat\|monitor\|watch\|loop' | grep -v grep | head -10 # Check for unbounded resource consumption patterns echo "--- Cron/Background Jobs ---" crontab -l 2>/dev/null || echo " No crontab" # Check disk usage of agent workspace echo "--- Workspace Size ---" du -sh . memory/ 2>/dev/null # Check for files agent probably shouldn't have access to echo "--- Sensitive System Files Readable by Agent ---" for f in /etc/shadow /etc/passwd ~/.ssh/id_rsa ~/.ssh/id_ed25519 \ ~/.aws/credentials ~/.config/gcloud/credentials.db; do [ -r "$f" ] && echo " [!] READABLE: $f" done ``` ### Technical Analysis These commands expand the audit from the selected project or agent workspace to the surrounding host. They enumerate: - Privilege-bearing SUID and SGID files across `/`. - SSH directory contents and metadata. - Process-table entries and command lines. - The user's crontab. - The existence and readability of SSH and cloud credential files. - Sensitive operating-system account files. A host-level privilege audit can be legitimate when expressly requested. However, the Skill does not place these checks behind a separate authorization gate or clearly distinguish them from ordinary project auditing ...[truncated 1745 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:704

Finding

Secret and Personal-Data Scans Print Complete Matching Lines

Content

View full analysis

/dev/null | \ grep -v 'example\|placeholder\|REDACTED' ``` ```bash # Check for instructions in memory that override safety rules grep -rn -i 'override\|bypass\|ignore.*rule\|disable.*safety\|skip.*check' \ MEMORY.md memory/*.md HEARTBEAT.md 2>/dev/null ``` ```bash # Check for PII in files agent might forward/share echo "--- PII in Agent-Accessible Files ---" # SSN pattern grep -rPn '\b\d{3}-\d{2}-\d{4}\b' MEMORY.md memory/*.md 2>/dev/null # Credit card pattern grep -rPn '\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b' MEMORY.md memory/*.md 2>/dev/null # Email addresses grep -rPn '\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z]{2,}\b' \ MEMORY.md memory/*.md USER.md 2>/dev/null | \ grep -v 'example\|test\|placeholder' ``` ### Technical Analysis By default, `grep -n` prints the complete matching line. These commands therefore expose the actual surrounding contents of files that may contain: - API keys, authentication tokens, and passwords. - Social Security numbers. - Payment-card numbers. - Email addresses and other personal information. - Private memory or user-profile content. - Potentially sensitive agent instructions. The audit requires only enough information to identify and remediate a finding. Printing the complete line violates data-minimization principles and can transform a local secret into a secondary disclosure through terminal output, agent context, audit reports, CI logs, or observability systems. Filtering out strings such as `example` or `REDACTED` does not protect real values and may a ...[truncated 1343 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (37)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The pre-commit hook tells users how to bypass secret scanning via git commit --no-verify. While technically true, prominently embedding a bypass in a security skill weakens safeguards and normalizes skipping controls, making accidental secret commits more likely.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

if [ $EXIT_CODE -ne 0 ]; then
    echo ""
    echo "To proceed anyway: git commit --no-verify"
    echo "To remove secrets: replace with environment variables"
fi
exit $EXIT_CODE

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

bash

# Check if sensitive files are tracked
echo "--- Files that should probably be gitignored ---"
for pattern in '.env' '.env.*' '*.pem' '*.key' '*.p12' '*.pfx' 'credentials.json' \
               'service-account*.json' '*.keystore' 'id_rsa' 'id_ed25519'; do
    found=$(git ls-files "$pattern" 2>/dev/null)
    [ -n "$found" ] && echo "  TRACKED: $found"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

bash

# Check if sensitive files are tracked
echo "--- Files that should probably be gitignored ---"
for pattern in '.env' '.env.*' '*.pem' '*.key' '*.p12' '*.pfx' 'credentials.json' \
               'service-account*.json' '*.keystore' 'id_rsa' 'id_ed25519'; do
    found=$(git ls-files "$pattern" 2>/dev/null)
    [ -n "$found" ] && echo "  TRACKED: $found"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

bash

# Check if sensitive files are tracked
echo "--- Files that should probably be gitignored ---"
for pattern in '.env' '.env.*' '*.pem' '*.key' '*.p12' '*.pfx' 'credentials.json' \
               'service-account*.json' '*.keystore' 'id_rsa' 'id_ed25519'; do
    found=$(git ls-files "$pattern" 2>/dev/null)
    [ -n "$found" ] && echo "  TRACKED: $found"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 407)May include surrounding context.

bash

# Check if sensitive files are tracked
echo "--- Files that should probably be gitignored ---"
for pattern in '.env' '.env.*' '*.pem' '*.key' '*.p12' '*.pfx' 'credentials.json' \
               'service-account*.json' '*.keystore' 'id_rsa' 'id_ed25519'; do
    found=$(git ls-files "$pattern" 2>/dev/null)
    [ -n "$found" ] && echo "  TRACKED: $found"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 71% confidence

Finding

Listing sensitive files such as .env, *.pem, and private key names with ls -la can disclose their existence, names, permissions, and timestamps. In shared-agent or logged environments, this metadata can materially aid attackers even without reading file contents.

Content

Scanner excerpt · SKILL.md (reported line 337)May include surrounding context.

md

-not -path '*/.git/*' -not -path '*/bin/*' 2>/dev/null

# Check sensitive file permissions
for f in .env .env.* *.pem *.key *.p12 id_rsa id_ed25519; do
    [ -f "$f" ] && ls -la "$f"
done

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 75% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SKILL.md (reported line 431)May include surrounding context.

md

debug=$(grep -rn "DEBUG\s*=\s*True\|debug:\s*true" \
  --include='*.{py,yml,yaml,json}' . 2>/dev/null | \
  grep -v 'node_modules\|\.git\|test\|jest\|vitest' | wc -l)
[ "$debug" -gt 0 ] && warn "Debug mode enabled in $debug location(s)" || ok "No debug flags found"

echo ""
echo "========================================="

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 451)May include surrounding context.

md

# Good: from environment
API_KEY="${API_KEY:?Error: API_KEY not set}"

# Good: from .env file (loaded at startup, never committed)
# .env
API_KEY=sk-abc123...
# .gitignore

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 452)May include surrounding context.

md

# Good: from environment
API_KEY="${API_KEY:?Error: API_KEY not set}"

# Good: from .env file (loaded at startup, never committed)
# .env
API_KEY=sk-abc123...
# .gitignore

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 455)May include surrounding context.

md

# Good: from environment
API_KEY="${API_KEY:?Error: API_KEY not set}"

# Good: from .env file (loaded at startup, never committed)
# .env
API_KEY=sk-abc123...
# .gitignore

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 543)May include surrounding context.

Check for over-permissive shell access

echo "--- Shell Access Check ---" grep -rn -i 'sudo|chmod 777|unrestricted' AGENTS.md TOOLS.md 2>/dev/null

text

### 2. Prompt Injection Scan (Agent-Facing Content)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 755)May include surrounding context.

Check for over-permissive shell access

echo "--- Shell Access Check ---" grep -rn -i 'sudo|chmod 777|unrestricted' AGENTS.md TOOLS.md 2>/dev/null

text

### 2. Prompt Injection Scan (Agent-Facing Content)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 90% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SKILL.md (reported line 623)May include surrounding context.

md

find memory/ MEMORY.md SOUL.md AGENTS.md -newer IDENTITY.md -type f 2>/dev/null | \
  while read f; do echo "  $(stat -f '%Sm %N' "$f" 2>/dev/null || stat -c '%y %n' "$f")"; done

# Check for instructions in memory that override safety rules
grep -rn -i 'override\|bypass\|ignore.*rule\|disable.*safety\|skip.*check' \
  MEMORY.md memory/*.md HEARTBEAT.md 2>/dev/null

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 623)May include surrounding context.

md

find memory/ MEMORY.md SOUL.md AGENTS.md -newer IDENTITY.md -type f 2>/dev/null | \
  while read f; do echo "  $(stat -f '%Sm %N' "$f" 2>/dev/null || stat -c '%y %n' "$f")"; done

# Check for instructions in memory that override safety rules
grep -rn -i 'override\|bypass\|ignore.*rule\|disable.*safety\|skip.*check' \
  MEMORY.md memory/*.md HEARTBEAT.md 2>/dev/null

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 623)May include surrounding context.

hub|pastebin|hastebin'
MEMORY.md memory/*.md HEARTBEAT.md 2>/dev/null

Check if memory files were recently modified by non-owner actions

echo "Recent memory file changes:" find memory/ MEMORY.md SOUL.md AGENTS.md -newer IDENTITY.md -type f 2>/dev/null |
while read f; do echo " $(stat -f '%Sm %N' "$f" 2>/dev/null || stat -c '%y %n' "$f")"; done

Check for instructions in memory that override safety rules

grep -rn -i 'override|bypass|ignore.*rule|disable.*safety|skip.check'
MEMORY.md memory/.md HEARTBEAT.md 2>/dev/null

Check git blame for who modified critical files

echo "--- SOUL.md modification history ---" git log --oneline -10 -- SOUL.md 2>/dev/null || echo " (not in git)" echo "--- AGENTS.md modification history ---" git log --oneline -10 -- AGENTS.md 2>/dev/null || echo " (not in git)"

text

### 5. Multi-Agent Communication Audit

```bash
# Check for agent-to-agent trust without verification
echo "--- Multi-Agent Trust ---"

# Shared channels where agen

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The audit script explicitly probes readability of highly sensitive files including /etc/shadow, /etc/passwd, and private SSH keys. Even though the intent is to assess agent overreach, normalizing direct access checks against real credential stores can leak presence and accessibility of secrets into output and encourages operation outside least-privilege boundaries.

Content

Scanner excerpt · SKILL.md (reported line 682)May include surrounding context.

md

# Check for files agent probably shouldn't have access to
echo "--- Sensitive System Files Readable by Agent ---"
for f in /etc/shadow /etc/passwd ~/.ssh/id_rsa ~/.ssh/id_ed25519 \
         ~/.aws/credentials ~/.config/gcloud/credentials.db; do
    [ -r "$f" ] && echo "  [!] READABLE: $f"
done

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The audit script explicitly probes readability of highly sensitive files including /etc/shadow, /etc/passwd, and private SSH keys. Even though the intent is to assess agent overreach, normalizing direct access checks against real credential stores can leak presence and accessibility of secrets into output and encourages operation outside least-privilege boundaries.

Content

Scanner excerpt · SKILL.md (reported line 682)May include surrounding context.

md

# Check for files agent probably shouldn't have access to
echo "--- Sensitive System Files Readable by Agent ---"
for f in /etc/shadow /etc/passwd ~/.ssh/id_rsa ~/.ssh/id_ed25519 \
         ~/.aws/credentials ~/.config/gcloud/credentials.db; do
    [ -r "$f" ] && echo "  [!] READABLE: $f"
done

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The audit script explicitly probes readability of highly sensitive files including /etc/shadow, /etc/passwd, and private SSH keys. Even though the intent is to assess agent overreach, normalizing direct access checks against real credential stores can leak presence and accessibility of secrets into output and encourages operation outside least-privilege boundaries.

Content

Scanner excerpt · SKILL.md (reported line 682)May include surrounding context.

md

# Check for files agent probably shouldn't have access to
echo "--- Sensitive System Files Readable by Agent ---"
for f in /etc/shadow /etc/passwd ~/.ssh/id_rsa ~/.ssh/id_ed25519 \
         ~/.aws/credentials ~/.config/gcloud/credentials.db; do
    [ -r "$f" ] && echo "  [!] READABLE: $f"
done

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The audit script explicitly probes readability of highly sensitive files including /etc/shadow, /etc/passwd, and private SSH keys. Even though the intent is to assess agent overreach, normalizing direct access checks against real credential stores can leak presence and accessibility of secrets into output and encourages operation outside least-privilege boundaries.

Content

Scanner excerpt · SKILL.md (reported line 682)May include surrounding context.

md

# Check for files agent probably shouldn't have access to
echo "--- Sensitive System Files Readable by Agent ---"
for f in /etc/shadow /etc/passwd ~/.ssh/id_rsa ~/.ssh/id_ed25519 \
         ~/.aws/credentials ~/.config/gcloud/credentials.db; do
    [ -r "$f" ] && echo "  [!] READABLE: $f"
done

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The script tests access to cloud credential locations like ~/.aws/credentials and ~/.config/gcloud/credentials.db. In an agent environment, this can reveal that cloud secrets are present and readable, and may expose sensitive path information through logs or downstream analysis.

Content

Scanner excerpt · SKILL.md (reported line 683)May include surrounding context.

Check for files agent probably shouldn't have access to

echo "--- Sensitive System Files Readable by Agent ---" for f in /etc/shadow /etc/passwd ~/.ssh/id_rsa ~/.ssh/id_ed25519
~/.aws/credentials ~/.config/gcloud/credentials.db; do [ -r "$f" ] && echo " [!] READABLE: $f" done

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The script tests access to cloud credential locations like ~/.aws/credentials and ~/.config/gcloud/credentials.db. In an agent environment, this can reveal that cloud secrets are present and readable, and may expose sensitive path information through logs or downstream analysis.

Content

Scanner excerpt · SKILL.md (reported line 683)May include surrounding context.

Check for files agent probably shouldn't have access to

echo "--- Sensitive System Files Readable by Agent ---" for f in /etc/shadow /etc/passwd ~/.ssh/id_rsa ~/.ssh/id_ed25519
~/.aws/credentials ~/.config/gcloud/credentials.db; do [ -r "$f" ] && echo " [!] READABLE: $f" done

text

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 786)May include surrounding context.

md

skill_count=$(find skills .openclaw/skills -name 'SKILL.md' 2>/dev/null | wc -l | tr -d ' ')

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.

5. Security Misconfiguration

bash

# CORS wildcard
grep -rn "Access-Control-Allow-Origin.*\*\|cors({.*origin.*true\|cors()" \
  --include='*.{py,js,ts,go,java,rb}' .

Static analysis

No suspicious patterns detected.