Hire

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:28 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent AI-agent hiring wizard, but it makes persistent agent, config, scheduling, and shared-memory changes with insufficient scoping and approval checkpoints.

Install only if you are comfortable with the skill creating new agent files, linking shared user and memory context into that agent, modifying OpenClaw gateway configuration, and possibly creating a scheduled review task. Before using it, require explicit confirmation for shared context links, validate the agent name, preview config.patch changes, and document how to undo config and cron changes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:127

Finding

Default Exposure of Shared User Identity and Persistent Team Memory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:115

Finding

Unvalidated Agent Name Used in Filesystem Paths and Raw Gateway Configuration

Content

View full analysis

/` with: ``` ```md Check existing agents to avoid name conflicts. Suggest a name that fits the role, but let the user override. ``` ```md 2. **Automatically update the OpenClaw config via gateway `config.patch`** (do not ask the user to run a manual command). You must: - Add the new agent entry to `agents.list` using this format: ```json { "id": "", "workspace": "/home/lars/clawd/agents/", "model": "" } ``` - Add the new agent ID to the **main agent's** `subagents.allowAgents` array - Preserve all existing agents and fields (arrays replace on patch) **Required flow:** 1) Fetch config + hash ```bash openclaw gateway call config.get --params '{}' ``` 2) Build the updated `agents.list` array (existing entries + new agent) and update the `main` agent's `subagents.allowAgents` (existing list + new id). 3) Apply with `config.patch`: ```bash openclaw gateway call config.patch --params '{ "raw": "{\n agents: {\n list: [ /* full list with new agent + updated main allowAgents */ ]\n }\n}\n", "baseHash": "", "restartDelayMs": 1000 }' ``` ``` ### Technical Analysis The skill permits the user to override the proposed agent name but defines no validation, canonicalization, or encoding requirements. The same value is subsequently treated as: - A component of the relative path `agents//`. - An agent identifier. - A component of an absolute workspace path. - A value inserted into a configuration update. - An entry added to the main agent's authorization list. A name containing path separators or traversal sequences could cause the ...[truncated 2495 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger description includes broad phrases like "I need help with X," which can match ordinary conversation and cause the skill to activate when the user did not intend to hire or create an agent. In this skill, unintended activation is especially risky because the workflow can create files and later modify gateway configuration, turning a prompt-matching issue into an action-initiation problem.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill performs material side effects—creating agent directories, symlinks, and automatically patching gateway configuration—without surfacing a clear up-front warning in the description or obtaining explicit informed consent immediately before execution. That lack of transparency increases the chance users trigger persistent system changes they do not understand or expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The when-to-use section repeats ambiguous activation guidance without guardrails, reinforcing that the skill may be invoked from vague statements rather than clear user intent. Because this is an agent-provisioning skill, accidental invocation can lead to collection of setup details and progression toward persistent changes the user did not explicitly request.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Creating a cron job establishes persistent automated behavior that continues beyond the current session, which can surprise users and create an ongoing execution path if not tightly scoped and consented to. Although the skill asks whether reviews should be set up, the persistence mechanism still deserves explicit disclosure because scheduled tasks can consume resources, generate data, and operate unattended.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md

1. **"Want to set up periodic performance reviews?"**
   - If yes: ask preferred frequency (weekly, biweekly, monthly)
   - Create a cron job that triggers a review conversation
   - Review covers: what went well, what's not working, scope/permission adjustments
   - At the end of each review, ask: "Want to keep this schedule, change frequency, or stop reviews?"

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Automatically symlinking shared USER.md and MEMORY.md into every new agent broadly exposes user identity and team context to newly created agents by default, regardless of the role's minimum data needs. In a hiring/setup context where new agents may be specialized or experimental, this creates unnecessary data propagation and weakens isolation boundaries.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The instruction to automatically update configuration via config.patch and "do not ask the user" removes an approval checkpoint for a sensitive administrative action. This is dangerous because it authorizes the skill to make persistent access-control and agent-registration changes autonomously, which can be abused or triggered unintentionally.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

## After Setup

1. Tell the user what was created and where
2. **Automatically update the OpenClaw config via gateway `config.patch`** (do not ask the user to run a manual command). You must:
   - Add the new agent entry to `agents.list` using this format:
     ```json
     {

Static analysis

No suspicious patterns detected.