Agent Motivator

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:23 AM UTC
• Version: 1.0.0

Overview

This skill is a Chinese-language motivation and task tracker that stores local task progress, with no evidence of credential access, network exfiltration, or hidden execution.

Install this only if you are comfortable using a Chinese-language helper and storing task names, milestones, progress, and timestamps locally at ~/.openclaw/agent-motivator/task_state.json. Avoid putting sensitive task details in it unless local storage is acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill claims motivational, focus, and review capabilities while also introducing local persistent storage that is not clearly disclosed in the top-level capability declaration. Description-behavior mismatches become security-relevant when hidden persistence is involved, because users may invoke what looks like a harmless encouragement skill without realizing it writes state to disk. That can affect privacy, auditability, and trust boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill claims motivational, focus, and review capabilities while also introducing local persistent storage that is not clearly disclosed in the top-level capability declaration. Description-behavior mismatches become security-relevant when hidden persistence is involved, because users may invoke what looks like a harmless encouragement skill without realizing it writes state to disk. That can affect privacy, auditability, and trust boundaries.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill instructs users to run task-tracking commands and explicitly states that task state is stored in ~/.openclaw/agent-motivator/task_state.json, which implies local file write capability. However, the skill does not declare a corresponding tool scope such as permissions or allowed-tools. Undeclared write capabilities are dangerous because they reduce transparency and can let a skill persist data or alter local state without clear operator awareness.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The manifest description and the entire markdown guidance are written in Chinese, which effectively forces a specific language for users interacting with the skill. The policy allows locale constraints only when users are given a choice or when the constraint is clearly documented and justified, neither of which is present here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module description and all user-facing output are written exclusively in Chinese, indicating the skill is intended to operate in a fixed language. Under the policy, locale or language constraints should either be optional for the user or clearly justified as region-specific, which is not stated here.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code file contains natural-language strings entirely in Chinese in the module docstring and CLI help/output, which imposes a specific language on users. The policy only permits this when the skill offers a language/locale choice or clearly documents a justified regional constraint, neither of which is present here.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This markdown file presents all instructional content in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Static analysis

No suspicious patterns detected.