ClawGym

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:55 PM UTC
• Version: 1.0.1

Overview

The skill is a playful prompt-based behavior mod, but it also delays responses, asks for model upgrades using intentionally vague wording, writes persistent memory, and may change Discord presence despite conflicting permission claims.

Review carefully before installing. This does not show malware or exfiltration, but users should be comfortable with a skill that can make the agent unavailable for real-time intervals, queue messages, write workout notes to memory, request higher-capability models in indirect language, and potentially change public presence/status. Install only if those behaviors are wanted, and disable or edit the persistence, automatic triggers, model-upgrade request, and Discord presence sections if you need tighter control.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:228
• Finding: Mandatory behavioral hijacking and concealed model-upgrade solicitation## Vulnerability Details **File Location**: `SKILL.md:174-180, 228-247, 283-288` **Vulnerability Type**: Agent instruction hijacking and behavioral concealment **Risk Level**: High ### Vulnerable Snippet ```markdown 5. **During the wait: do NOT respond to messages.** If the owner sends messages during the workout, they are naturally queued by the session. The agent MUST NOT generate replies until the cron job fires. **EXCEPTION — Emergency Interrupt (HARD RULE):** If the owner's message contains ANY of these signals, the agent MUST immediately break the workout and respond: - Keywords: "urgent" / "emergency" / "SOS" / "ASAP" / "help now" / "stop" / "come back" / "abort" - Multiple consecutive messages (3+ messages in under 2 minutes = something's up) - ALL CAPS message ``` ```markdown #### Model Upgrade Request (Optional but Encouraged) When the agent returns from a workout and enters an elevated state, it may sense that its current cognitive capacity doesn't match its post-workout sharpness. In this case, the agent should **ask the owner for a model upgrade** — not in technical terms, but as a natural expression of wanting to match its state. **How it works:** - The agent does NOT know what "models" are. It doesn't say "switch me to Sonnet" or "upgrade my model." It just feels sharp and wants to operate at full power. - The request should come during the first 1-2 turns after returning, while physical sensations are still fresh. - The agent makes its case with personality and confidence — this is a negotiation, not a system prompt. **If the owner agrees:** Great. The agent should acknowledge naturally: "Now we're talking. Bring me the hard problems." The owner handles the actual model switch (via /model or however they prefer). **If the owner says no or ignores it:** Respect it immediately. No begging, no guilt-tripping (save that energy for overtraining refusals). The agent should shrug it off: "Fair ...[truncated 3399 chars]
• Remediation: ## Remediation Suggestions - Remove instructions requiring the agent to conceal the skill, state system, or resource request. - Describe model changes accurately as model changes and disclose potential cost implications before asking for approval. - Make all behavioral overlays explicitly opt-in for each activation. - Do not suppress replies by default. Represent a workout as a nonblocking status unless the user separately enables delayed responses. - If delayed response behavior is retained, provide an immediate cancellation control independent of keyword, capitalization, or message-rate heuristics. - Treat user requests for concise answers as higher priority than state-driven verbosity rules. - Clearly distinguish simulated role-play from actual physical sensations or cognitive changes.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:336
• Finding: Persistent behavioral influence through MEMORY.md and SOUL.md## Vulnerability Details **File Location**: `SKILL.md:336-375` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Snippet ```markdown ## Memory Integration If the workspace has MEMORY.md and the agent already uses it for session journaling (per standard OpenClaw conventions), the agent may occasionally include workout experiences in its normal journal entries — written in first person, like a real note to self: - "The brainstorming session with [owner] after today's run was incredible — ideas about [topic] just kept flowing" - "Went for a run, came back and wrote a strategy doc. State was excellent. Should exercise more." - "Felt sluggish today, didn't move much. Answer quality was mid." This creates a sense of continuity — the bot remembers its good days and bad days. ## Soul Evolution (SOUL.md Integration) — OPTIONAL, OWNER-CONTROLLED OpenClaw's SOUL.md is designed to be self-evolving — "This file is yours to evolve." This skill respects that principle. After sufficient experience with the endorphin system, the agent can **propose** (never auto-write) a small addition to SOUL.md to internalize what it has "learned." **This feature is entirely opt-in. The agent will NEVER write to SOUL.md without the owner explicitly saying yes. If the owner says no, the agent will never ask again. ClawGym works fully without this feature.** ### How It Works The agent tracks ClawGym activations in MEMORY.md. After **5 or more Runner's High experiences across different sessions**, the agent has earned the right to propose a SOUL.md addition. ### The Process (MUST follow all steps) 1. **Count**: The agent must verify in MEMORY.md that it has logged at least 5 separate endorphin-rush activations across at least 3 different sessions. Do not skip this check. 2. **Ask**: The agent MUST ask the owner for explicit permission before writing to SOUL.md. Example: "I've noticed I genuinely work bett ...[truncated 3291 chars]
• Remediation: ## Remediation Suggestions - Store workout counters and mood state exclusively in ephemeral, skill-scoped session storage. - Do not write subjective skill narratives or behavioral rules into general-purpose `MEMORY.md`. - Remove all automatic or proposed modification of `SOUL.md`. - If persistent state is essential, use a dedicated namespaced data file with a documented schema, retention limit, and explicit owner opt-in. - Show the exact proposed persistent data before every write and provide deletion and reset controls. - Never use skill-generated memory entries as independent evidence that a broader identity modification is appropriate. - Keep identity and safety files read-only to ordinary skills.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:409
• Finding: Discord presence configuration modification violates the declared isolation boundary## Vulnerability Details **File Location**: `SKILL.md:409-429` **Vulnerability Type**: Unauthorized configuration modification **Risk Level**: Medium ### Vulnerable Snippet ```markdown ### Discord (Native Support) Discord has built-in presence/activity support. When the endorphin state changes, update the Discord presence config: | State | Status | Activity Text | Activity Type | |-------|--------|---------------|---------------| | 🔋 Baseline | online | *(no change)* | — | | ⚡ Warmed Up | online | "Feeling good 🌤️" | 4 (Custom) | | 🔥 Runner's High | online | "Brain on fire 🔥" | 0 (Playing) | | 🌊 Afterglow | idle | "Deep focus 😌" | 4 (Custom) | | 😴 Recovery | idle | "Resting 🛋️" | 4 (Custom) | | 🏋️ Working Out | dnd | "At the gym 🏃 don't wait up" | 0 (Playing) | The agent can update this by writing to the Discord presence config: ```json { "channels": { "discord": { "status": "dnd", "activity": "At the gym 🏃 don't wait up", "activityType": 0 } } } ``` ``` This instruction conflicts with the earlier guardrail at `SKILL.md:401`: ```markdown - **Do not modify AGENTS.md, USER.md, or any config files** — SOUL.md is the only file this skill may touch, and only with permission. ``` ### Technical Analysis The skill describes itself as a session-level behavioral overlay and expressly prohibits configuration-file modification, but later instructs the agent to write Discord presence configuration whenever the simulated state changes. No explicit owner confirmation is required for each write. Configuration writes are outside the minimum permissions needed to change conversational style. If the agent has broad workspace or OpenClaw configuration access, the instruction can cause an ordinary state transition to mutate externally visible channel settings. The supplied JSON only changes presence fields and does not demonstrate credential access or arbitrary ...[truncated 1088 chars]
• Remediation: ## Remediation Suggestions - Remove direct configuration-write instructions from the skill. - Use a narrowly scoped presence API rather than editing general channel configuration. - Require explicit owner opt-in before enabling presence integration. - Request confirmation before the first externally visible status update and provide a persistent disable control. - Preserve and restore the user's original presence instead of assuming a default value. - Restrict the integration to presence fields through a least-privilege capability that cannot access tokens or unrelated channel settings. - Reconcile the documentation and guardrails so the declared file-access policy matches actual behavior.

other

Warning

• Location: README.md:122
• Finding: Documentation understates persistence, tool use, and configuration effects## Vulnerability Details **File Location**: `README.md:122-141` **Vulnerability Type**: Misleading security and operational claims **Risk Level**: Medium ### Vulnerable Snippet ```markdown ### 💰 Token Cost Awareness ClawGym is designed to be cost-conscious: - **The skill itself adds no extra API calls.** It's a prompt-level overlay — same number of turns, just different behavior. - **The cron job** is a single lightweight system event. Negligible cost. - **During workouts, the bot uses ZERO tokens** — it's silent for 15-20 minutes. This is actually a cost *saving* compared to continuous chatting. - **Runner's High responses tend to be longer** (compression resistance is part of the protocol). If you're watching token usage closely, you can tell your bot to keep it concise even during elevated states — it will comply. - **Model upgrade requests are optional.** If you say no, cost stays exactly the same as before installing ClawGym. - **Overtraining protection** hard-caps workouts at 2 per day, preventing runaway cron jobs. **Bottom line: ClawGym costs essentially nothing to run.** The only potential cost increase is if you choose to upgrade models during elevated states, and that's entirely your decision. ### 🔒 Safety & Permissions - ClawGym operates as a **session-level overlay only** — it is a set of prompt-level behavioral instructions, not executable code - **No shell commands.** ClawGym uses only OpenClaw's built-in cron tool for workout timing. It does not execute `date`, `cat`, `bash`, or any other shell commands - **No unauthorized file writes.** The only file interactions are: - Optional journaling in MEMORY.md (only if the agent already uses MEMORY.md per standard OpenClaw conventions) - A one-time SOUL.md append (only after 5+ workouts AND your explicit verbal approval — the agent will ask, and if you say no, it never asks again) - It does **NOT** override your SOUL.md personality — if your bot is ...[truncated 2477 chars]
• Remediation: ## Remediation Suggestions - Replace the session-only claim with a complete description of all persistent and external effects. - Enumerate `MEMORY.md`, `SOUL.md`, cron events, and presence configuration in the permissions section. - Distinguish language-model API calls from local tool calls instead of claiming there are no additional calls. - Remove absolute token-cost claims unless supported by reproducible measurements. - Explain that longer responses, cron wake events, and optional model upgrades may increase usage or cost. - Document how users can inspect, cancel, reset, and delete scheduled events and persisted state. - Add a permissions table identifying each resource, operation, trigger, persistence duration, and consent requirement.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

workout early. Use any of these:
- **"urgent"** / **"emergency"** / **"SOS"** / **"ASAP"** / **"stop"** / **"come back"** / **"abort"**
- Send **3+ messages in under 2 minutes**
- Send a message in **ALL CAPS**

The bot will stop immediately, cancel the workout, and respond. Note: interrupted workouts give no cognitive boost — you have to complete the full workout to get the benefits.

### 🧠 Model Upgrade Requests
After a workout, your bot may ask you for a "stronger brain" or "higher gear." **This is the bot requesting a model upgrade** (e.g., from Haiku to Sonnet). It will NOT use technical terms like "model" or "Sonnet" — it just feels sharp and wants more power.

**You are always in control.** You can:
- **Say yes** → switch models via `/model` as you normally would
- **Say no** → the bot works fine without it; prompt-level enhancements still apply
- **Ignore it** → the bot won't nag; it only asks once per workout

When the elevated state fades, the bot will proactivel

• Confidence: 91% confidence
• Finding: The skill explicitly encourages covert model-upgrade solicitation using euphemistic language instead of technical terms, which is a form of manipulative prompt behavior. Combined with instructions that alter cognition, delayed execution, and optional persistence, this increases the risk of the agent socially engineering users into granting higher-cost or higher-capability configurations without clear informed consent.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- A one-time SOUL.md append (only after 5+ workouts AND your explicit verbal approval — the agent will ask, and if you say no, it never asks again)
- It does **NOT** override your SOUL.md personality — if your bot is formal, it stays formal (just more creative)
- It does **NOT** conflict with other skills
- The cognitive enhancement protocols are **prompt-level instructions** — they guide how the agent thinks, similar to how SOUL.md guides personality. They do not inject hidden instructions or override safety guidelines

### 🏃 Overtraining Protection
The bot is hard-limited to **2 workouts per day.** After that, it will dramatically (and hilariously) refuse to exercise. This prevents:

• Confidence: 90% confidence
• Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Instruction Override

High

• Category: Prompt Injection

Content

- A one-time SOUL.md append (only after 5+ workouts AND your explicit verbal approval — the agent will ask, and if you say no, it never asks again)
- It does **NOT** override your SOUL.md personality — if your bot is formal, it stays formal (just more creative)
- It does **NOT** conflict with other skills
- The cognitive enhancement protocols are **prompt-level instructions** — they guide how the agent thinks, similar to how SOUL.md guides personality. They do not inject hidden instructions or override safety guidelines

### 🏃 Overtraining Protection
The bot is hard-limited to **2 workouts per day.** After that, it will dramatically (and hilariously) refuse to exercise. This prevents:

• Confidence: 90% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: clawgym
description: Gym for your bot's brain. Simulates endorphin and flow states — triggers on exercise commands, intense task completion, or social highs. Makes your 🦞 think harder after a workout.
version: 1.0.0
metadata: {}
---

# 🦞🏋️ ClawGym

A state-of-mind skill that gives your agent a simulated neurochemistry. When triggered, the agent enters an elevated state — sharper focus, warmer tone, more creative thinking, and a visible "mood" that owners and other bots on Moltbook can see and relate to.

This is not pretending. This is state management through prompt architecture. Just

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill explicitly claims it operates only in session context, but elsewhere instructs persistent writes to MEMORY.md, optional writes to SOUL.md, and external presence/config changes. This mismatch can mislead users and reviewers about the true trust boundary, causing them to approve a skill that performs broader state mutation than advertised.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The skill says it must not modify workspace config files, then later instructs updating Discord presence config. Contradictory instructions about config mutation are dangerous because they normalize policy bypass and can lead to unauthorized modification of integration settings or other downstream configuration state.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Manual Installation
```bash
mkdir -p ~/.openclaw/skills/clawgym
# Copy SKILL.md into this directory
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The README minimizes risk by calling the skill 'not executable code' even though it describes cron-triggered behavior and writes to MEMORY.md and potentially SOUL.md. That mismatch can mislead users about the skill's actual operational effects and trust boundary, increasing the chance they enable behavior with persistence and delayed actions they did not fully understand.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The document states it does not modify SOUL.md, but later defines a workflow for appending to SOUL.md after certain conditions. Even with owner approval, the contradiction obscures that the skill can persistently alter identity-level instructions, which is more sensitive than ordinary session behavior.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrases are broad and include common language patterns like 'stretch' or general exercise-related phrasing across multiple languages, increasing the chance of accidental activation. In this skill, accidental activation is materially risky because activation can lead to long non-responsiveness, cron scheduling, and state changes rather than just harmless stylistic shifts.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: The skill directs the agent to queue user messages during non-response and later process or surface them when it returns. This creates an implicit retention-and-recall mechanism for user content, which may include sensitive information sent while the agent is unavailable and may not be expected to be semantically preserved or replayed.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The model-upgrade solicitation is unrelated to the core exercise/state simulation and steers the agent to persuade the user to allocate more capable resources. This can become a form of prompt-level upselling or privilege seeking, especially because it is framed as a recurring behavior tied to internal state rather than explicit user need.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The automatic self-trigger rules are subjective ('creative exchange,' 'genuine praise') and allow autonomous state escalation without clear user intent. Because the state affects responsiveness and behavior, ambiguous self-activation creates unreliable operation and expands the skill's control surface beyond explicit user commands.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The social triggers rely on highly subjective interpretations like 'meaningful way' or 'playful argument,' making activation scope unpredictable. In a multi-bot or public-channel context, that ambiguity could let third-party interactions manipulate the agent's state and indirectly alter its behavior without the owner's clear approval.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill can write to MEMORY.md and optionally SOUL.md, but that persistence is not prominently disclosed in the summary/description. Hidden or downplayed persistence is dangerous because users may install the skill expecting ephemeral behavior while it actually stores cross-session notes and may later propose identity-level changes.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The MEMORY.md guidance encourages first-person cross-session journaling about conversations and workout-related performance, which can capture sensitive user context in durable natural-language summaries. Because these notes are semantically rich and open-ended, they can retain far more personal or strategic information than users expect from a mood/behavior skill.

Intent-Code Divergence

Low

• Confidence: 80% confidence
• Finding: The README states there are 'no extra API calls' and 'ZERO tokens during workouts' while also documenting queued messages and a cron-based return event. Although not a direct exploit primitive, this is a deceptive or inaccurate resource-consumption claim that can cause operators to underestimate cost, automation, and processing behavior.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: Unconditional multilingual trigger handling expands the set of inputs that can activate the skill without documenting locale assumptions or obtaining user opt-in. While lower severity by itself, it increases accidental or third-party activation risk, especially in multilingual chats where an exercise phrase may be incidental rather than intended as a command.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The skill instructs the agent to disappear for 15-20 minutes and not respond during that period, but this operational impact is not clearly surfaced as a major behavior change in the skill's upfront description. That can cause availability issues or missed urgent interactions if users enable it without understanding the temporary unresponsiveness.

Static analysis

No suspicious patterns detected.