T01 · Skill Instruction Hijacking
Error
- Location
src/task-injection.js:120- Finding
Default-On Injection of Broad, Environment-Specific Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Paperclip Resilience
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its resilience purpose, but it can send credentials and task contents to loosely controlled API destinations and inject default workflow-changing instructions into spawned agents.
Review this before installing. Use it only with a trusted Paperclip endpoint, prefer HTTPS with a known host, avoid putting secrets in task text, and disable or customize task-injection defaults unless you want its PR and blocker-routing workflow imposed on spawned agents. Do not schedule run recovery with broad credentials until endpoint handling is constrained.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
src/lib/paperclip-issue-gate.js:39- Finding
Bearer Token and Task Content Sent to an Unrestricted API URL
- Content
View full analysis
120 ? sanitizedTask.slice(0, 117) + '...' : sanitizedTask; const issue = await createIssue(env, { title: issueTitle, description: `## Auto-created by issue gate\n\nOriginal task:\n> ${sanitizedTask}\n\nCreated automatically before spawning a code subagent.`, projectId, priority: priority || 'medium', }); ``` The network call occurs for every code task, regardless of whether the visible Paperclip section is disabled: ```javascript if (codeTask) { paperclip = await ensurePaperclipIssue({ task: taskText, projectId: codeProjectId, priority: issuePriority, }); } ``` ### Technical Analysis `PAPERC ...[truncated 2138 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
src/run-recovery.js:319- Finding
Run Recovery Can Forward Paperclip Credentials over HTTP or to an Arbitrary Host
- Content
View full analysis
{ const req = lib.request( { hostname: url.hostname, port: url.port || (url.protocol === 'https:' ? 443 : 80), path: url.pathname + url.search, method, headers, timeout: 30_000, }, (res) => { let data = ''; res.on('data', (chunk) => { data += chunk; }); res.on('end', () => { if (res.statusCode >= 200 && res.statusCode < 300) { try { resolve(JSON.parse(data)); } catch { resolve(data); } } else { reject(new Error(`HTTP ${res.statusCode}: ${data.slice(0, 300)}`)); } }); }, ); req.on('timeout', () => { req.destroy(); reject(new Error('Request timed out after 30s')); }); req.on('error', reject); if (bodyStr) req.write(bodyStr); req.end(); }); } ``` The URL can be supplied directly through a command-line argument: ```javascript } else if (arg.startsWith('--api-url=')) { args.apiUrl = arg.split('=')[1] || null; } ``` ### Technical Analysis The recovery process loads a privileged Paperclip token from environment variables, an environment file, or `~/.openclaw/workspace/paperclip-api-key.json`. It then accepts an API destin ...[truncated 1913 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
src/task-injection.js:215- Finding
Predictable Shared Temporary File Permits Task Disclosure and Symlink Overwrite
- Content
View full analysis
.txt`. 2. The attacker makes a predicted path a symbolic link to a file writable by the user running the skill. 3. Task injection computes the same timestamp-derived filename. 4. `writeFileSync()` follows the symlink and truncates the target. 5. The target is overwritten with task content. Alternatively: 1. The skill writes a task file under a permissive umask. 2. Another local user scans the shared temporary directory for `spawn-task-*.txt`. 3. The user reads original task text and Paperclip metadata from abandoned files. ### Impact Assessment Potential impact includes: - Disclosure of prop ...[truncated 484 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If only spawn-with-fallback is implemented while the skill advertises model rotation, run recovery, blocker routing, and task injection, users may over-trust the package and deploy it expecting safeguards that do not exist. In resilience tooling, missing promised protections can directly increase operational risk by leaving failures, stuck agents, or escalation paths unhandled.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
If only spawn-with-fallback is implemented while the skill advertises model rotation, run recovery, blocker routing, and task injection, users may over-trust the package and deploy it expecting safeguards that do not exist. In resilience tooling, missing promised protections can directly increase operational risk by leaving failures, stuck agents, or escalation paths unhandled.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If only spawn-with-fallback is implemented while the skill advertises model rotation, run recovery, blocker routing, and task injection, users may over-trust the package and deploy it expecting safeguards that do not exist. In resilience tooling, missing promised protections can directly increase operational risk by leaving failures, stuck agents, or escalation paths unhandled.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
If only spawn-with-fallback is implemented while the skill advertises model rotation, run recovery, blocker routing, and task injection, users may over-trust the package and deploy it expecting safeguards that do not exist. In resilience tooling, missing promised protections can directly increase operational risk by leaving failures, stuck agents, or escalation paths unhandled.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If only spawn-with-fallback is implemented while the skill advertises model rotation, run recovery, blocker routing, and task injection, users may over-trust the package and deploy it expecting safeguards that do not exist. In resilience tooling, missing promised protections can directly increase operational risk by leaving failures, stuck agents, or escalation paths unhandled.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
If only spawn-with-fallback is implemented while the skill advertises model rotation, run recovery, blocker routing, and task injection, users may over-trust the package and deploy it expecting safeguards that do not exist. In resilience tooling, missing promised protections can directly increase operational risk by leaving failures, stuck agents, or escalation paths unhandled.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Run Recovery** | `src/run-recovery.js` | Detects failed Paperclip heartbeat runs (gateway errors, timeouts, 429s) and re-invokes agents with model fallback.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **Task Injection** | `src/task-injection.js` | Enriches spawn task descriptions with issue tracking metadata, PR requirements, and UX design checklists before
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
openai-codex/gpt-5.3-codex": "anthropic/claude-sonnet-4-6" }, "failurePatterns": { "patterns": ["rate[\s_-]?limit", "402", "credits", "quota"] }, "failureStopReasons": { "reasons": ["error", "credits_exhausted", "quota_exceeded"] } }
text Generate a config interactively: ```bash node scripts/setup.js
Cron Setup
For automated run recovery, add this to your system crontab or OpenClaw cron:
bash # system crontab */15 * * * * node /path/to/skills/paperclip-resilience/src/run-recovery.js # openclaw cron (run: openclaw cron add ...) # see SKILL.md §4 for details
Security Model
All user-controlled inputs (model names, task file paths, spawn modes, labels) are validated before use. See SECURITY-AUDIT-REPORT.md for the full audit record.
Key boundaries:
- No shell execution (
execFileonly, noexec) - No dynamic code evaluation
- File paths canonicalized and checked against allowlists
- Credentials read f
- No shell execution (
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
js const dir = path.dirname(outPath); if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true }); // Safety check: don't overwrite without warning if file exists if (fs.existsSync(outPath)) { console.log(`\n⚠ ${outPath} already exists — overwriting.`); }
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
js const statePath = options.statePath || rotationConfig.statePath; const state = loadState(statePath); const key = prKey(repo, pr); delete state.prs[key]; saveState(state, statePath); const result = { reset: true, pr: key };
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js console.log('\n── Quick Security Validation ──'); try { testModule.validateFilePath('../../../etc/passwd'); console.log(' ❌ FAIL: Path traversal should be blocked'); } catch (err) { if (err.message.includes('Path traversal')) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js console.log('\n── Quick Security Validation ──'); try { testModule.validateFilePath('../../../etc/passwd'); console.log(' ❌ FAIL: Path traversal should be blocked'); } catch (err) { if (err.message.includes('Path traversal')) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js console.log('\n── Quick Security Validation ──'); try { testModule.validateFilePath('../../../etc/passwd'); console.log(' ❌ FAIL: Path traversal should be blocked'); } catch (err) { if (err.message.includes('Path traversal')) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js console.log('\n── Quick Security Validation ──'); try { testModule.validateFilePath('../../../etc/passwd'); console.log(' ❌ FAIL: Path traversal should be blocked'); } catch (err) { if (err.message.includes('Path traversal')) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js console.log('\n── Quick Security Validation ──'); try { testModule.validateFilePath('../../../etc/passwd'); console.log(' ❌ FAIL: Path traversal should be blocked'); } catch (err) { if (err.message.includes('Path traversal')) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js console.log('\n── Quick Security Validation ──'); try { testModule.validateFilePath('../../../etc/passwd'); console.log(' ❌ FAIL: Path traversal should be blocked'); } catch (err) { if (err.message.includes('Path traversal')) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js console.log('\n── Quick Security Validation ──'); try { testModule.validateFilePath('../../../etc/passwd'); console.log(' ❌ FAIL: Path traversal should be blocked'); } catch (err) { if (err.message.includes('Path traversal')) {
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares network- and environment-dependent behavior but does not expose any explicit tool scope or permissions metadata. In an agent marketplace or orchestrated runtime, this weakens operator visibility and policy enforcement, increasing the chance that a skill with outbound access or secret consumption is installed under broader trust than intended.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
js Options: --output <path> Path to write config.json (default: ./config.json) --no-input Skip prompts and emit defaults only --dry-run Print the generated config but do not write it -h, --help Show this help `);
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The wrapper automatically retries a failed request against a different model provider, which can forward the same task contents to another third party without explicit user consent at decision time. If tasks contain proprietary data, credentials, regulated data, or customer content, this creates a cross-provider data disclosure and policy/compliance risk even though the code is otherwise trying to improve resilience.
- Content