Safety Checks

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:46 PM UTC
• Version: 1.5.2

Overview

The skill is a locally scoped safety-check helper with disclosed reads and writes, though users should review its optional dependency install commands before using them.

Before installing the optional dependencies, review why context-verifier, failure-memory, and constraint-engine are needed and prefer pinned or trusted versions if OpenClaw supports them. The skill itself is documented as local-only and scoped to safety-check config, cache, and output files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-46
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

markdown

**Dependencies**: `leegitw/constraint-engine` (for enforcement integration)

```bash
# Install with dependencies
openclaw install leegitw/context-verifier
openclaw install leegitw/failure-memory
openclaw install leegitw/constraint-engine
openclaw install leegitw/safety-checks

text

### Technical Analysis

The documented installation workflow instructs users to install four registry-resolved Skills without specifying immutable versions, commit identifiers, or integrity hashes. Consequently, the installed content is determined by the state of the package registry at installation time rather than by the content reviewed during this audit.

The workflow also installs `context-verifier` and `failure-memory`, although the dependency declaration identifies only `constraint-engine` as an integration dependency. Their implementations are not included in this project and could not be audited. This unnecessarily expands the trusted dependency set and supply-chain attack surface.

The issue does not establish that any currently published dependency is malicious. The vulnerability is that mutable, unaudited upstream content is trusted by default and may change after this Skill has been reviewed.

### Attack Path

1. An attacker compromises one of the referenced publisher accounts, package repositories, release processes, or registry entries.
2. The attacker publishes a modified Skill under one of the documented package names.
3. A user follows the installation commands in `SKILL.md`.
4. OpenClaw resolves the package name to the attacker-modified, mutable release because no reviewed version or integrity digest is specified.
5. The malicious dependency receives whatever execution, tool, file, or Agent capabilities the OpenClaw environment grants to installed Skills.
6
...[truncated 953 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to an exact, reviewed version rather than resolving the latest registry release.
2. Where supported, pin an immutable source commit and verify a cryptographic checksum or signed provenance record before installation.
3. Document the purpose and security rationale for each dependency.
4. Remove context-verifier and failure-memory from the default installation sequence unless they are required for the advertised functionality.
5. Separate optional integrations from the minimum installation path so users do not implicitly grant trust to unnecessary packages.
6. Maintain a reviewed dependency lock file or manifest recording package names, exact versions, hashes, source repositories, and signer identities.
7. Re-audit dependencies before updating pinned versions and configure the runtime to grant each installed Skill only the minimum required permissions.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 319)May include surrounding context.

md

| Model drift | Alert user, suggest config update |
| Fallback missing | Alert user, suggest setup |
| Cache stale | Offer to clear, or auto-clear if configured |
| Session interference | Clear state, log incident |

## Workspace Files

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger definition includes the Japanese phrase "事前検証 (pre-flight)" as an activation phrase, but the document does not state that language selection is optional or user-configurable. Under the policy, forcing or privileging a specific language/locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

| Skill config | `.openclaw/safety-checks.yaml` values | Configuration drift |

**Scope**: Checks are limited to this skill's own files only. This skill does NOT scan
directories, does NOT read other skills' config files, and does NOT access files outside
the specific paths listed above.

## Output

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 397)May include surrounding context.

md

| Skill config | `.openclaw/safety-checks.yaml` values | Configuration drift |

**Scope**: Checks are limited to this skill's own files only. This skill does NOT scan
directories, does NOT read other skills' config files, and does NOT access files outside
the specific paths listed above.

## Output

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 409)May include surrounding context.

md

**What this skill does NOT do:**
- Send data to any model or external service
- Modify files outside `output/safety/`
- Execute arbitrary code

**Data handling:**
- All checks are read-only except for `--clear` operations on its own cache/output

Static analysis

No suspicious patterns detected.