T08 · Insecure Dependencies
Warning
- Location
SKILL.md:15- Finding
Unpinned External Plugin Installation and Automatic Activation
- Content
View full analysis
- Remediation
View remediation
Security audit
Foundry
Security checks for vulnerabilities and agentic risk
Overview
Foundry openly presents itself as a self-writing OpenClaw extension, but its default learning, self-modification, and unpinned auto-enabled plugin install create review-worthy control and persistence risks.
Install only if you are comfortable with a plugin that can create and modify OpenClaw capabilities, learn from agent activity, and interact with external sources. Prefer pinning and verifying the plugin version, disabling autoLearn by default, reviewing any generated code before enabling it, and requiring explicit confirmation before marketplace publishing, community ability installation, or self-extension.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:54- Finding
Automatic Persistent Learning from Agent Activity
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The skill explicitly claims it can create new skills and extensions, which is a recursive capability expansion mechanism. In context, this is dangerous because it enables an agent to manufacture additional executable or semi-executable artifacts that may bypass original trust assumptions, especially when combined with research, learning, and marketplace features.
- Content
md 1. **Research** — Fetch and understand OpenClaw documentation on demand 2. **Write Extensions** — Generate new tools and hooks for OpenClaw 3. **Write Skills** — Create ClawHub-compatible skill packages 4. **Self-Modify** — Add new capabilities to itself 5. **Learn** — Record patterns from failures and successes
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 98% confidence
- Finding
The skill advertises self-modification, meaning it can add new capabilities to itself over time. This materially increases risk because a self-modifying agent can change its behavior, expand privileges, and persist unsafe logic beyond the original reviewed version; in this file, that risk is amplified by automatic learning, external-source ingestion, and plugin installation workflow.
- Content
md 1. **Research** — Fetch and understand OpenClaw documentation on demand 2. **Write Extensions** — Generate new tools and hooks for OpenClaw 3. **Write Skills** — Create ClawHub-compatible skill packages 4. **Self-Modify** — Add new capabilities to itself 5. **Learn** — Record patterns from failures and successes ## Tools
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill description advertises a very broad, self-writing capability without clear trigger boundaries or safety constraints. In an agent ecosystem, overly permissive invocation language increases the chance the skill is selected for tasks involving code generation, self-modification, or external access without explicit user intent, which can amplify unsafe behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The learning section describes automatic collection from agent activity and ingestion from external sources, but it does not present a strong warning about privacy, prompt/data leakage, or contamination from untrusted content. Because the skill learns from failures, successes, docs, GitHub, and arXiv, it could absorb sensitive context or unsafe patterns and reuse them in future actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The marketplace publishing capability is exposed as a normal feature without an explicit warning that generated patterns or skills may be shared externally. If used carelessly, this can exfiltrate proprietary logic, sensitive prompts, internal workflows, or contaminated artifacts derived from prior agent interactions.
- Content
Static analysis
No suspicious patterns detected.