Security audit

Execution Loop

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed agent execution-control skill that uses local hooks and state files; install it only if you want it to influence when agents stop.

Install only for workflows where you deliberately want Stop-hook control over agent completion. Use clear session IDs without path characters, keep state directories private and out of source control, clean old ~/.openclaw/shared-context/sessions data when no longer needed, and avoid enabling re-anchor or handoff patterns for highly sensitive prompts unless you accept local persistence.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill describes shell hooks, environment-variable use, and persistent reads/writes to files such as `sessions/<id>/ralph.json`, `$TMPDIR/doubt-gate-*`, and `.harness-tasks.json`, yet it declares no permissions. That mismatch undermines least-privilege review and can cause operators to enable a skill with broader execution and filesystem access than expected.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as loop-control, but it also performs policy enforcement on assistant language, consumes task-state files, maintains persistent per-session control state, supports cancellation semantics, and injects stored task context back into the conversation. This broader behavior materially changes trust boundaries: it can steer agent behavior, persist state across turns, and act on external files in ways a user may not expect from the description alone.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The implementation example classifies any prompt mentioning exactly one file as "low" and zero-file prompts as "trivial," while the documented safety rules say Express must never be used for production-code writes and uncertain triage must default to Standard. In this execution-control skill, that mismatch is dangerous because vague prompts like "fix auth bug" or other under-specified code-change requests can be routed into a low-assurance path that skips verification, increasing the chance of unsafe or incomplete changes being applied.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list includes broad phrases such as `task completion`, `headless mode`, and `adaptive complexity`, which are common in benign conversations and can cause the skill to activate unexpectedly. Because this skill can block stopping, inject context, and alter execution flow, accidental invocation increases the chance of unwanted persistence, drift in control logic, or interference with normal agent operation.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: The documented behavior stores the user's original task on disk and later reinjects it into subsequent turns, but the skill description does not clearly warn about this persistence and prompt replay. This creates a real transparency and privacy/security issue because sensitive prompt content may be retained longer than expected and resurfaced in later contexts, increasing exposure and the chance of unintended disclosure or prompt-context contamination.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The example explicitly instructs the agent to '保存进度、写 handoff 文档', which normalizes persistent filesystem writes in headless mode without any user-facing notice or consent boundary. In an automation/CI context this can cause unexpected workspace mutations, leakage of intermediate state into tracked files, or downstream pipeline behavior that depends on silently created artifacts.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The pipeline example directs writing results to '.working-state/implementation-output.md' but does not warn that this creates or modifies files on disk. In headless execution skills, that omission is more concerning because the behavior is intended for unattended runs, so silent persistence can surprise operators, pollute repos, or expose sensitive intermediate data to later stages.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script persistently stores per-session state under `~/.openclaw/shared-context/sessions` without setting restrictive permissions or disclosing that durable metadata is being written. In an execution-loop skill, persistent session files can accumulate behavioral traces and task-related state across runs, which increases privacy and local data exposure risk, especially on shared systems or when session identifiers are attacker-influenced.

Static analysis

No suspicious patterns detected.