PR Advocacy

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:37 AM UTC
• Version: 1.0.3

Overview

The skill is meant to manage PR reviews, but it asks the agent to autonomously change branches, commit work, and write persistent memory/state without clear user approval.

Install only if you are comfortable with an agent actively monitoring PRs and making repository changes. Before use, constrain it to specific repositories and PRs, require approval before commits or pushes, store tracking state in a user-approved skill-specific location, and disable automatic updates to core memory, skills, or workflows.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:55
• Finding: Unvalidated External Feedback Can Influence Persistent Agent Memory and Workflows<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:55-59, 140-144` **Vulnerability Type**: Persistent memory poisoning through untrusted learning inputs **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### MERGED State Handling When a PR is successfully MERGED: - **Remove from active tracking list** - **Add to merged records** for success tracking - **Celebrate the contribution!** - **Update skills and workflows** based on successful patterns ``` ```markdown ### Memory Tracking - Maintain PR tracking list in workspace memory - **Automatically clean up closed/rejected PRs** from tracking list - **Real-time synchronization** of tracking list file after any PR status change - Record resolution outcomes for learning - Update core memory with successful advocacy patterns ``` ### Technical Analysis The skill instructs the agent to derive behavioral patterns from pull-request activity and then update its skills, workflows, and core memory. Pull-request comments and outcomes are externally influenced inputs, but the instructions do not establish a trust boundary, sanitization process, approval requirement, or restriction on what may be persisted. Consequently, malicious or misleading review instructions could be treated as successful practices and stored in long-term state. Persisting such content allows its influence to survive the current skill execution and affect future sessions. The risk extends beyond maintaining factual PR status because the skill expressly permits modification of behavioral resources such as “skills,” “workflows,” and “core memory.” ### Attack Path 1. An attacker obtains the ability to submit review feedback on a monitored pull request, such as through a repository account, compromised reviewer account, or permissive contribution workflow. 2. The attacker embeds misleading operational rules or agent-directed instructions in review feedback. 3. The agent processes the feedback and implements the requested changes ...[truncated 815 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not automatically modify core memory, skill instructions, or reusable workflows based on pull-request content. - Store PR outcomes only as structured, skill-specific records rather than executable instructions or behavioral rules. - Treat review comments, issue text, commit messages, and PR descriptions as untrusted external data. - Remove or neutralize agent-directed instructions before processing external content. - Require explicit human approval before promoting any observation into long-term memory or reusable workflows. - Apply provenance metadata to stored records, including repository, PR, author, timestamp, and approval status. - Restrict persistent writes to a dedicated state directory with a documented schema and retention policy. - Provide a review and rollback mechanism for every persistent behavioral change. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:35
• Finding: Reviewer-Controlled Content Can Trigger Autonomous Code Changes and Commits<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:35-42, 145-150` **Vulnerability Type**: Unsafe autonomous processing of untrusted review instructions **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### OPEN State Handling When a PR is in OPEN state: - **Check for maintainer/reviewer comments** pointing out issues - **If feedback requires changes**: - Analyze the specific feedback content - Create fixes according to maintainer suggestions - Automatically commit changes to the PR branch - Update PR description if needed - Record fix details for learning ``` ```markdown ### Automatic Response Workflow 1. **Detect feedback** on OPEN PRs 2. **Analyze requirements** and create appropriate fixes 3. **Commit changes** to existing PR branch 4. **Update tracking status** and notify maintainers 5. **Handle closure** by removing from active monitoring 6. **Synchronize tracking list file** immediately after any change ``` ### Technical Analysis The workflow creates a direct control path from remotely supplied reviewer comments to repository modifications and commits. It does not require the agent to verify the reviewer's authorization, distinguish technical feedback from embedded agent instructions, obtain human approval, inspect the resulting diff, or confirm that required tests and security checks pass before committing. Reviewer comments are untrusted input even when presented through GitHub. Accounts may be malicious or compromised, and repositories may allow comments from users who are not authorized to direct changes. Natural-language feedback can also contain prompt-injection content intended to manipulate the agent rather than provide legitimate code-review guidance. Although the skill recommends testing as a general best practice, the automatic commit workflow does not make successful tests, security analysis, or approval mandatory preconditions. ### Attack Path 1. An attacker posts crafted feedback on an open pull req ...[truncated 1200 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Treat all PR descriptions, comments, reviews, commit messages, and linked content as untrusted data. - Verify that the feedback author has an explicitly authorized repository role before considering requested changes. - Separate extraction of technical requirements from execution of agent-directed instructions. - Reject requests to modify security controls, CI workflows, credentials, agent configuration, or unrelated files unless separately approved. - Generate a proposed patch but require explicit human approval before committing or pushing it. - Display the full diff, affected files, reviewer identity, and validation results during approval. - Enforce mandatory linting, tests, builds, static analysis, and secret scanning before allowing a commit. - Restrict the agent token to the minimum repository and branch permissions necessary. - Use protected branches and repository rules so agent-generated commits cannot bypass required reviews. - Record an immutable audit trail linking each requested change to its source comment and approving user. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:64
• Finding: Hard-Coded Cross-Workspace Path Violates Filesystem and Repository Boundaries<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:64-74` **Vulnerability Type**: Unauthorized cross-workspace state modification **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Real-time Tracking List Synchronization ### Automatic Updates - **After any PR status change**, immediately update the tracking list file - **When PRs are added/removed**, synchronize the tracking list in real-time - **Prevent information loss** by ensuring all changes are persisted to disk - **Maintain accurate state** by writing updates immediately after processing ### Tracking List File Management - **Location**: `/Users/hope/.openclaw/agents/coding/workspace/memory/pr-tracking-list.md` - **Format**: Markdown with clear sections for active, closed, and merged PRs - **Updates**: Atomic writes to prevent corruption during concurrent access - **Backup**: Maintain version history through git commits for rollback capability ``` ### Technical Analysis The skill mandates writes to an absolute, identity-specific path in another agent workspace rather than using a caller-provided or skill-scoped state directory. This design assumes access to `/Users/hope/.openclaw/agents/coding/workspace/memory/` and does not verify that the target belongs to the current user, task, project, or agent. The instruction to maintain history through Git commits introduces an additional boundary issue. It does not identify which repository may be committed to, confirm that the tracking file belongs in that repository, or address whether the stored PR metadata is appropriate for repository history. Atomic writes reduce corruption risk but do not provide authorization, isolation, confidentiality, or correct repository selection. ### Attack Path 1. The skill runs in an environment where the agent has filesystem access to the hard-coded workspace. 2. A monitored PR changes state, triggering immediate tracking synchronization. 3. The agent writes PR data to the fixed path even if ...[truncated 879 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the absolute path with a configurable, skill-specific state directory supplied by the runtime. - Resolve and canonicalize the path before use, then verify that it remains beneath the approved storage root. - Refuse symbolic links or path traversal that would redirect writes outside the authorized directory. - Separate state by user, agent, repository, and pull request to prevent cross-context contamination. - Apply restrictive filesystem permissions to tracking records. - Do not commit tracking state automatically. - If versioning is necessary, use a dedicated private state repository selected explicitly by the user. - Require consent before storing repository metadata in Git history and define a retention and deletion policy. - Fail safely when the configured state directory is unavailable rather than falling back to another workspace. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Self-Modification

High

• Category: Rogue Agent

Content

- **Remove from active tracking list**
- **Add to merged records** for success tracking
- **Celebrate the contribution!**
- **Update skills and workflows** based on successful patterns

## Real-time Tracking List Synchronization

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to automatically commit changes to the PR branch in response to reviewer feedback, but it does not require explicit user confirmation before modifying repository state. In the context of an autonomous agent skill, silent commits can cause unintended code changes, commit sensitive data, or alter a branch in ways the user did not authorize.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill mandates immediate persistence to a fixed local file path under the user's home directory and continuous synchronization after PR state changes, without clear consent or scope restrictions. This creates a risk of unauthorized local data modification, state corruption, or overwriting user-maintained files, especially under concurrent or repeated execution.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The manifest description states the skill will 'actively monitor, respond to, and drive Pull Request reviews to completion with real-time tracking list synchronization,' which implies broad, ongoing automation and action-taking without specifying clear activation boundaries, user consent, or scope limits. In an agent ecosystem, this can cause the skill to be invoked too broadly or granted implicit authority to act on repositories and review workflows beyond a narrowly defined user request.

Static analysis

No suspicious patterns detected.