Security audit

Agent Motivator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Chinese-language motivation and task tracker that stores local task progress, with no evidence of credential access, network exfiltration, or hidden execution.

Install this only if you are comfortable using a Chinese-language helper and storing task names, milestones, progress, and timestamps locally at ~/.openclaw/agent-motivator/task_state.json. Avoid putting sensitive task details in it unless local storage is acceptable.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill claims motivational, focus, and review capabilities while also introducing local persistent storage that is not clearly disclosed in the top-level capability declaration. Description-behavior mismatches become security-relevant when hidden persistence is involved, because users may invoke what looks like a harmless encouragement skill without realizing it writes state to disk. That can affect privacy, auditability, and trust boundaries.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill claims motivational, focus, and review capabilities while also introducing local persistent storage that is not clearly disclosed in the top-level capability declaration. Description-behavior mismatches become security-relevant when hidden persistence is involved, because users may invoke what looks like a harmless encouragement skill without realizing it writes state to disk. That can affect privacy, auditability, and trust boundaries.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill instructs users to run task-tracking commands and explicitly states that task state is stored in ~/.openclaw/agent-motivator/task_state.json, which implies local file write capability. However, the skill does not declare a corresponding tool scope such as permissions or allowed-tools. Undeclared write capabilities are dangerous because they reduce transparency and can let a skill persist data or alter local state without clear operator awareness.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description and the entire markdown guidance are written in Chinese, which effectively forces a specific language for users interacting with the skill. The policy allows locale constraints only when users are given a choice or when the constraint is clearly documented and justified, neither of which is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module description and all user-facing output are written exclusively in Chinese, indicating the skill is intended to operate in a fixed language. Under the policy, locale or language constraints should either be optional for the user or clearly justified as region-specific, which is not stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code file contains natural-language strings entirely in Chinese in the module docstring and CLI help/output, which imposes a specific language on users. The policy only permits this when the skill offers a language/locale choice or clearly documents a justified regional constraint, neither of which is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file presents all instructional content in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.