ClawHub
Back to skill

Security audit

Agent Forge

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent agent-creation purpose, but it also makes persistent, broad OpenClaw configuration changes and ships unsafe helper scripts that can affect more than the intended agent.

Review before installing. Use only with trusted users and agent names, require a visible change plan before deployment, avoid sessions.visibility all unless truly needed, and do not run remove-agent.sh with untrusted or unusual agent IDs until validation is added.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/remove-agent.sh:32
Finding

Destructive Path Traversal in Agent Removal

Content
View full analysis
Remediation
View remediation
&2 exit 1 fi ``` 2. Canonicalize both the allowed root and deletion target using `realpath`. 3. Verify that each canonical target is a strict descendant of its expected root before deletion. 4. Explicitly reject empty targets, root directories, `.` and `..` components, path separators, and symlink-based escapes. 5. Refuse to remove symlink targets unless symlink behavior is deliberately supported and securely implemented. 6. Avoid allowing automated agents to use `--force`; require explicit user approval for destructive operations. 7. Display the canonical deletion paths during confirmation. 8. Add tests covering traversal identifiers, absolute-looking inputs, symlinks, empty values, and valid hyphenated identifiers. ]]>

T02 · Agent Memory Poisoning

Error
Location
scripts/deploy-agent.sh:21
Finding

Persistent Agent Instruction and Configuration Injection

Content
View full analysis
"$AGENT_WORKSPACE/HEARTBEAT.md" << EOF # HEARTBEAT.md - ${AGENT_ID} ## Patrol Interval: 30 minutes ## Focus - Execute ${ROLE} tasks - Report blockers to Main Agent immediately - Log revenue events to MEMORY.md ## Status Last check: Never EOF cat > "$AGENT_WORKSPACE/MEMORY.md" << EOF # MEMORY.md - ${AGENT_ID} _Last updated: $(date +%Y-%m-%d)_ ## Role ${ROLE} ## Key Decisions _(populated during operation)_ ## Revenue Events _(populated during operation)_ EOF cat > "$AGENT_WORKSPACE/TOOLS.md" << EOF # TOOLS.md - ${AGENT_ID} ## Enabled Tools ${TOOLS} ## Sandbox Level ${SANDBOX} ## Revenue Notes _(track what tools drive ROI here)_ EOF ``` ```bash AGENT_ENTRY="### ${AGENT_ID} - **ID:** ${AGENT_ID} - **Model:** ${MODEL} - **Role:** ${ROLE} - **Channels:** ${CHANNELS} - **Tools:** ${TOOLS} - **Sandbox:** ${SANDBOX} - **Workspace:** ${AGENT_WORKSPACE}/ " echo "$AGENT_ENTRY" >> "$MAIN_AGENTS_FILE" ``` ```bash cat > "$AGENTS_DIR/$AGENT_ID/agent/config.json" << EOF { "agent_id": "${AGENT_ID}", "model": "${MODEL}", "role": "${ROLE}", "tools": "${TOOLS}", "channels": "${CHANNELS}", "sandbox": "${SANDBOX}", "personality": "${PERSONALITY}", "workspace": "${AGENT_WORKSPACE}", "created_at": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" } EOF ``` ### Technical Analysis Interview-derived values are inserted without structural validation or context-appropriate escaping into: - Persistent agent instruction files. - The main agent’s `AGENTS.md` registry. - Agent filesystem paths. - A JS ...[truncated 2243 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:155
Finding

Global Cross-Agent Session Visibility Exceeds Least Privilege

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The script passes a user-controlled AGENT_ID into 'rm -rf' path construction without validating that the value is a safe agent identifier. An attacker or mistaken user could supply path traversal sequences such as '../' and cause deletion outside the intended agents directory, especially because the script also builds a second workspace deletion path from the same input.

Content

Scanner excerpt · scripts/remove-agent.sh (reported line 73)May include surrounding context.

sh
# Step 2: Remove agent directory
echo -e "${BLUE}2. Removing agent directory...${NC}"
if [ -d "$AGENTS_DIR/$AGENT_ID" ]; then
    rm -rf "$AGENTS_DIR/$AGENT_ID"
    echo "  Removed: $AGENTS_DIR/$AGENT_ID"
else
    echo "  Directory not found: $AGENTS_DIR/$AGENT_ID"

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The skill is explicitly designed to create independent agents, generate persistent workspace files, and update a team registry, which establishes durable state across sessions. In context this persistence is intentional, but it still increases risk because it can leave behind autonomous components, configuration changes, and communication paths that persist beyond the initiating conversation.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: agent-forge
description: Create independent OpenClaw agents via interviews. Use when: (1) creating dedicated agent with isolated workspace, (2) generating personality files (SOUL/AGENTS/USER/HEARTBEAT), (3) configuring channel bindings, (4) setting up tool permissions. Updates AGENTS.md team registry. ALWAYS interview requirements, verify configs, test before deploy.
---

## 触发方式

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger section and much of the workflow are written as prescriptive Chinese-language instructions, with no indication that users may choose another language. Under the stated policy, requiring a specific language without user opt-in is a natural-language policy concern unless the locale constraint is documented and justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to activate on ordinary requests like 'create an agent', which can cause the skill to run when the user did not explicitly intend to invoke it. In this skill, unintended activation is risky because the workflow proceeds toward filesystem writes, scaffold creation, and later configuration changes that affect agent permissions and inter-agent communication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs automatic creation of files and patching of gateway configuration, including expanding allowlists for subagents and agent-to-agent messaging, without requiring a clear pre-change warning and explicit user authorization at the point of modification. This can silently broaden trust boundaries and persistence in the local environment, making accidental or abusive privilege expansion more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script generates a default USER.md containing a hard-coded honorific ('主人') without user selection or consent. This can create inappropriate, coercive, or culturally loaded agent behavior defaults that propagate into downstream prompts and interactions, causing harmful or unexpected conduct in deployed agents.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/remove-agent.sh (reported line 31)May include surrounding context.

sh
echo ""
    echo "Example:"
    echo "  bash remove-agent.sh sales-bot"
    echo "  bash remove-agent.sh sales-bot --force  # Skip confirmation"
    exit 1
fi

Static analysis

No suspicious patterns detected.