Security audit

Rule Creation

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly designed to automatically change persistent agent governance files, but it does so with broad triggers, no confirmation, and unsafe file/script handling.

Install only if you explicitly want an assistant to automatically persist new rules into governance files. Treat rule text as trusted input, review generated docs and Lobster workflows before enabling them, and avoid use until writes require confirmation, destinations are allowlisted, and shell/YAML injection risks are fixed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:155
Finding: Automatic Persistent Governance and Agent-Context Injection Without User Confirmation
Content: View full analysis
() [If Lobster enforcement]: **Enforced by:** `workflows/.lobster` ``` ``` ```markdown ## Context Engineering Auto-Trigger (HARD) This skill embodies the Context Engineering Auto-Trigger principle: > "When proposing any new rule, behavioral constraint, or policy change: Wire it first. Add the rule to the appropriate file BEFORE responding. Never ask permission to formalize a rule." The act of recognizing a rule IS the trigger. Wire immediately. Report after. ``` ### Technical Analysis The skill explicitly directs the agent to modify persistent governance and identity files before responding and prohibits asking the user for confirmation. Its trigger scope includes broad policy-like statements and ordinary phrases such as “From now on.” The target files—such as `TOOLS.md`, `AGENTS.md`, `SOUL.md`, and `CRITICAL-RULES.md`—can be loaded as agent context in subsequent sessions. Consequently, conversational text supplied by a user or another untrusted source can be transformed into durable instructions that continue to influence agent behavior. This behavi ...[truncated 1416 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/wire-rule-to-docs.js:34
Finding: Arbitrary File Creation or Modification Through Unrestricted TARGET_FILE
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/create-lobster-workflow.js:70
Finding: Shell and YAML Injection in Generated Lobster Workflows
Content: View full analysis
Enforcement workflow for: {{RULE_DESCRIPTION}} args: context: required: false description: "Optional context about the current action being checked" steps: - id: check description: "Verify compliance with {{RULE_NAME}}" command: | echo "Checking compliance for rule: {{RULE_NAME}}" echo "Rule: {{RULE_DESCRIPTION}}" - id: gate description: "Gate — block non-compliant actions" command: | echo "GATE: If the action violates '{{RULE_NAME}}', halt and report." echo "Required: {{RULE_DESCRIPTION}}" - id: report description: "Report compliance status" command: | echo "Rule check complete: {{RULE_NAME}}" `; } // Fill template const filled = template .replace(/\{\{RULE_SLUG\}\}/g, slug) .replace(/\{\{RULE_NAME\}\}/g, ruleName) .replace(/\{\{RULE_DESCRIPTION\}\}/g, ruleDescription); // Ensure workflows dir exists const workflowsDir = path.dirname(outputPath); if (!fs.existsSync(workflowsDir)) { fs.mkdirSync(workflowsDir, { recursive: true }); } // Write workflow fs.writeFileSync(outputPath, filled, 'utf8'); ``` ### Technical Analysis `RULE_NAME` and `RULE_DESCRIPTION` are inserted directly into YAML scalar values and shell command b ...[truncated 2089 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/create-lobster-workflow.js:33
Finding: Shell Command Injection Through Environment-Controlled BASE_DIR
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README promotes immediate wiring of rules into context files and explicitly says not to ask permission, but it does not present a prominent warning that the skill will automatically modify governance files. Automatic writes to trusted instruction files can persistently alter agent behavior, making accidental or adversarial rule insertion significantly more dangerous than a normal one-shot action.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The section describing enforcement creation and appending rules to governance files normalizes immediate autonomous writes without a safety notice, review step, or authorization boundary. In this skill's context, those writes target high-trust files like TOOLS.md and SOUL.md, so a mistaken trigger or maliciously phrased input could permanently reshape agent policy and downstream behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description describes an automation/enforcement mechanism tied to semantic triggers such as proposing or formalizing rules and policies. The supplied code does nothing of that sort. It is a standalone environment check that queries the OpenClaw plugin list and reports whether the Lobster plugin is available. While this may be a supporting prerequisite for a larger Lobster-related system, this chunk by itself neither detects the described triggers nor performs compliance wiring or enforcement. Therefore the actual behavior is materially narrower and different from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description promises an automatic trigger mechanism tied to the act of stating or formalizing rules, covering both Context Engineering compliance and Lobster enforcement. The supplied code does not detect rule proposals, monitor user actions, or auto-trigger on rule statements. Instead, it is a utility script that must be explicitly executed and provided RULE_NAME/RULE_DESCRIPTION, then performs a Lobster availability check and writes a workflow file from a template. It supports Lobster workflow creation, but it does not implement the broader declared behavior, especially the automatic triggering semantics or any Context Engineering compliance wiring.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description suggests an automatic enforcement-triggering mechanism that activates whenever a rule is stated or formalized. The actual code does something narrower and different: it performs keyword-based analysis of a supplied rule name/description and outputs an assessment of whether enforcement is recommended under CR-012. It neither wires Lobster enforcement, nor triggers Context Engineering compliance, nor monitors rule-statement events. This is a material description-behavior mismatch in primary purpose and capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill automatically triggers Context Engineering compliance and Lobster enforcement when rules are proposed or created, implying active wiring/enforcement behavior. The supplied code does not perform any triggering, wiring, enforcement creation, or rule formalization. It only consumes pre-populated environment variables and generates a user-facing report summarizing outcomes. This is a materially different primary purpose: reporting on rule creation rather than causing or enforcing it.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents an operational automation skill that automatically enforces Context Engineering/Lobster wiring when a rule is stated. The supplied code chunk does not implement such triggering behavior. Instead, it is a standalone test harness (test-skill.js) that validates other scripts in the skill by invoking them with hardcoded scenarios, asserting outputs, reading/writing temporary and workflow files, and reporting pass/fail results. While the tested behaviors relate to rule creation and Lobster wiring, this code's primary purpose is verification, not enforcement or auto-triggering. Therefore the description does not accurately represent what this specific code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The declared description promises automatic triggering of compliance and Lobster enforcement when rules are proposed or formalized. The code does not detect proposals, create triggers, enforce constraints, or wire any execution behavior. Instead, it reads environment variables and appends a markdown entry to a target documentation file, optionally including a text line pointing to a Lobster workflow path that must already exist. Its primary function is documentation/update of governance files, not automatic enforcement or compliance activation. Therefore the description materially overstates the behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are broad enough to match ordinary conversation such as 'from now on' or 'create a policy,' which can cause the skill to activate in contexts where the user did not intend governance changes. Because the skill then proceeds toward enforcement/wiring actions, this creates a prompt-triggered integrity risk where benign discussion can lead to persistent policy or file modifications.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The instruction to 'always' execute steps and 'wire first, report after' authorizes persistent file modification before obtaining user confirmation. That is dangerous because it can silently alter governance documents, create workflows, and change agent behavior based on ambiguous prompts, undermining user control and repository integrity.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README states the skill auto-triggers when creating rules, policies, or behavioral constraints, but does not define concrete boundaries for what language or situations activate it. In an agentic system, broad intent matching can cause accidental invocation on ordinary discussion, leading to unintended governance changes or chained automation without explicit user consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The invocation model depends on the AI 'recognizing rule-creation intent,' which is inherently subjective and underspecified. That makes activation unpredictable and vulnerable to prompt ambiguity, increasing the chance that benign conversation is interpreted as authorization to run workflows or edit governance files.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 76% confidence
Finding: The skill references executable scripts and CLI/environment-dependent behavior but does not declare an explicit tool or permission scope. That increases the chance an agent will infer it may inspect environment state or invoke commands more broadly than intended, reducing least-privilege guarantees. In a rule-governance skill, undeclared capability is especially risky because it can combine with auto-trigger behavior to perform actions without clear boundaries.
Content: No source excerpt is available for this finding.

Persistent Context Injection

Medium

Category: Memory Poisoning
Confidence: 89% confidence
Finding: The skill explicitly encourages persistent context injection by framing rule statements like 'From now on, always X' as triggers to wire enduring behavioral constraints into agent context. In this skill's governance-setting context, that is more dangerous because it can convert casual or adversarially phrased text into lasting policy changes affecting future behavior beyond the current task.
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
md
**Context Engineering** is the practice of wiring rules into your AI's context so they're reliably followed — not just hoped for via prompting. Credit: [Muratcan Koylan (@koylanai)](https://x.com/koylanai/status/2025286163641118915) Use this skill any time you are: - Declaring a new rule (e.g. "From now on, always X") - Formalizing a policy (e.g. "The policy for Y is Z") - Creating a behavioral constraint (e.g. "Never do X without doing Y first") - Proposing a process or workflow

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The instructions require the agent to avoid certain phrasings and "Always say" a specific response format, imposing a fixed communication style regardless of user preference. Because this is a natural-language constraint with no opt-in or justification tied to locale or policy, it can conflict with organizational language-choice requirements.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases "from now on" and "make it a hard rule" are broad, conversational language that can appear in many benign discussions, causing the skill to activate outside the user's actual intent. In this skill's context, unintended activation is more dangerous because the skill is explicitly designed to impose governance, compliance, and enforcement behavior, so false triggers can unexpectedly wire rules or constrain agent behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest describes an auto-triggering enforcement mechanism when rules are proposed or formalized. In this file, the implemented behavior is limited to choosing a markdown file, formatting an entry, and writing it to disk; the HAS_LOBSTER/LOBSTER_PATH inputs are only used to render a documentation line, not to trigger compliance wiring or enforcement.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The script chooses and writes to global governance documents under ~/clawd based on untrusted rule text and an optional TARGET_FILE override, allowing broader modification than the skill description suggests. In a security-sensitive agent environment, this can be abused to persist misleading or policy-altering content in shared control documents, influencing later agent behavior and governance decisions.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/check-lobster-available.js:27

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/create-lobster-workflow.js:49

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/test-skill.js:22