48h-Expert-Methodology

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:38 AM UTC
• Version: 1.0.1

Overview

This skill is a structured learning-output helper with a disclosed local handoff file, but no evidence of hidden code execution, credential access, exfiltration, or destructive behavior.

Before installing, be aware that generated learning outputs are intended to be saved at ~/.openclaw/swarm_tmp/expert_output.json and may be read by later audit skills. Avoid using it for private or sensitive topics unless you are comfortable with that local persistence.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: This markdown file includes example invocations using generic verbs like "learn:" and "study:" without explaining whether these are the only trigger phrases, what contexts activate the skill, or what inputs are out of scope. Such broad wording overlaps with common user requests and could cause unintended or ambiguous skill invocation.

Session Persistence

Medium

• Category: Rogue Agent

Content

#### Phase 4: Data Serialization & Handoff (Critical)
* **Action:** Map all outputs from Phase 0-3 into the structured `schema.json` format.
* **Integrity Check:** The resulting JSON **MUST** pass structural validation. 
* **Persistence:** Write the final JSON to `~/.openclaw/swarm_tmp/expert_output.json`.

### 3. Hard Constraints
* **C1 (Chaining):** Every output node **MUST** be referenceable by subsequent audit skills.

• Confidence: 97% confidence
• Finding: The instruction to persist output at a stable path in the user's home directory introduces session-to-session state sharing and makes the data referenceable by subsequent skills. In this context, the chaining requirement increases risk because later skills may trust or consume this file without the user's awareness, enabling covert data retention or cross-skill influence.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to write data into a fixed path under the user's home directory without any user consent, transparency, or scoping to a safe temporary workspace. This creates unauthorized filesystem side effects and could enable silent persistence of potentially sensitive or misleading data for later reuse by other skills.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The README presents the skill in both Chinese and English, but it does not state how the skill chooses a response language or whether the user can opt in to a preferred locale. This can create a language/locale policy concern because the skill's language behavior is not explicitly user-directed.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The skill forces a rigid output format and forbids normal prose without obtaining user opt-in, which can override expected interaction patterns and reduce transparency. While not directly a code-execution risk, it can suppress warnings, context, or safety caveats that would otherwise be presented to the user.

Static analysis

No suspicious patterns detected.