T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:343- Finding
Import Workflow Permits Persistent Agent Instruction and Memory Poisoning
- Content
View full analysis
- Remediation
View remediation
Security audit
WeChat Share
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed workspace file-sharing skill, but it needs Review because it can upload sensitive agent files to a third-party service and import files that change future agent behavior.
Install this only for intentional workspace file handoffs with trusted recipients or senders. Avoid sharing secrets, profile files, memory, SOUL.md, AGENTS.md, or skills unless you have reviewed their contents and intend to transfer agent behavior. Treat db_id and api_token like passwords, preview before importing, compare sensitive files before overwriting them, and use burn/delete for shares that should not remain accessible.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:119- Finding
Sensitive Workspace Content Is Uploaded in Plaintext to an External Service
- Content
View full analysis
" \ -H "Content-Type: application/json" \ -d '{"name":"wechat-share-20260323-103015-ab12"}' ``` Capture at least: - `api_token` - `db_id` ``` The selected files are then uploaded through the external SQL API: ```markdown ### Step 6: Upload files and manifest Upload every selected file to: - remote root: `/files/` - remote path pattern: `/files/` Use the SQL API: ```bash curl -sS -X POST "https://api.db9.ai/customer/databases//sql" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{"query":"SELECT fs9_write('\"'\"'/files/SOUL.md'\"'\"', '\"'\"'...content...'\"'\"')"}' ``` Also upload the manifest to `/manifest.json` with `fs9_write()`. ``` ### Technical Analysis The workflow intentionally transmits selected workspace files to `api.db9.ai`. TLS protects data in tran ...[truncated 2413 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Safety Rules - Only read from and write to the current workspace. - Resolve every candidate path to a real path and reject anything outside the workspace. - Reject absolute destination paths and any destination path containing `..`. - Never touch `~/.openclaw/**`.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This finding points to the same external registration flow to api.db9.ai, which establishes outbound connectivity and creates a remote storage context. In a skill designed to move files between workspaces, this materially increases risk because the remote service becomes a data sink and any compromise, misuse, or mistaken file selection can disclose private workspace contents.
- Content
- Create an anonymous db9 account:
bash curl -sS -X POST "https://api.db9.ai/customer/anonymous-register" \ -H "Content-Type: application/json" \ -d '{}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This finding points to the same external registration flow to api.db9.ai, which establishes outbound connectivity and creates a remote storage context. In a skill designed to move files between workspaces, this materially increases risk because the remote service becomes a data sink and any compromise, misuse, or mistaken file selection can disclose private workspace contents.
- Content
- Create an anonymous db9 account:
bash curl -sS -X POST "https://api.db9.ai/customer/anonymous-register" \ -H "Content-Type: application/json" \ -d '{}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
Creating a remote database on an external service is part of the data export pipeline and therefore a true external transmission risk. The context makes it more dangerous because the skill then stores selected workspace files there and relies on bearer-token access, so accidental disclosure of the token or overbroad file selection can expose all uploaded content.
- Content
- Create a database with a unique name such as
wechat-share-YYYYMMDD-HHMMSS-RAND:
bash curl -sS -X POST "https://api.db9.ai/customer/databases" \ -H "Authorization: Bearer <API_TOKEN>" \ -H "Content-Type: application/json" \ -d '{"name":"wechat-share-20260323-103015-ab12"}'- Create a database with a unique name such as
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
This step uploads actual file contents to the external SQL API via fs9_write, making the exfiltration path concrete rather than hypothetical. The skill includes some guardrails, but it still instructs the agent to serialize local files and send them off-box, so any failure in path validation, secret detection, or user understanding could leak sensitive workspace material.
- Content
Use the SQL API:
bash curl -sS -X POST "https://api.db9.ai/customer/databases/<DB_ID>/sql" \ -H "Authorization: Bearer <API_TOKEN>" \ -H "Content-Type: application/json" \ -d '{"query":"SELECT fs9_write('\"'\"'/files/SOUL.md'\"'\"', '\"'\"'...content...'\"'\"')"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
If burn is requested, prefer deleting the whole share database:
bash curl -sS -X DELETE "https://api.db9.ai/customer/databases/<DB_ID>" \ -H "Authorization: Bearer <API_TOKEN>"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 74% confidence
- Finding
Reading the remote manifest from the external service is an outbound interaction with untrusted remote data and is part of a workflow that imports files into the workspace. While not exfiltration of local data, it expands the trust boundary and can enable malicious share metadata to drive overwrites or unsafe imports if validation is incomplete.
- Content
Use the SQL endpoint with
curl:bash curl -sS -X POST "https://api.db9.ai/customer/databases/<DB_ID>/sql" \ -H "Authorization: Bearer <API_TOKEN>" \ -H "Content-Type: application/json" \ -d '{"query":"SELECT fs9_read('\"'\"'/manifest.json'\"'\"') AS content"}'
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - `SOUL.md` - `AGENTS.md` - `skills/wechat-share/SKILL.md` 可能覆盖：
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - `SOUL.md` - `AGENTS.md` - `skills/wechat-share/SKILL.md` 可能覆盖：
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md 已导入这些文件： - `SOUL.md` - `skills/example/SKILL.md` 如果这次启用了 burn，远端分享已经被删除，或者已回退为删除远端文件。 这条分享命令不要再次转发。
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md 已导入这些文件： - `SOUL.md` - `skills/example/SKILL.md` 如果这次启用了 burn，远端分享已经被删除，或者已回退为删除远端文件。 这条分享命令不要再次转发。
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file instructs the skill to use the Chinese template when the user is speaking Chinese, and similarly mandates the English template when the user is speaking English. This is a natural-language locale policy decision embedded in the skill content, but it does not explicitly offer the user a language choice or opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This line directs the skill to use the English template whenever the user is speaking English, which enforces a locale choice implicitly. The policy exception for language constraints does not apply here because the file does not document user choice or a justified region-specific requirement.
- Content