ClawHub
Back to skill

Security audit

Skill Evolve

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but it asks the agent to persistently change future skill behavior with weak approval and safety controls.

Install only if you want the agent to modify its own reusable skill library. Require explicit approval before any skill creation, update, or deletion, review learned content before activation, avoid storing secrets or environment-specific details, and replace the deletion command with a validated and reversible workflow.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:10
Finding

Persistent Skill Poisoning Through Untrusted Task-Derived Instructions

Content
View full analysis
//SKILL.md ``` Supporting user-correction and environment-specific examples at lines 116-127: ```markdown ### Scenario 2: User Correction The user says, "This command is incorrect; it should be..." After correction, check whether similar tasks have the same problem. If it is generally applicable, create or update a Skill. ### Scenario 3: Environment-Specific Behavior The SSH port on this server is 2222 rather than 22. After discovering this, create or update a Skill to record the environment-specific behavior. ``` ### Technical Analysis The Skill instructs the agent to turn information obtained during ordinary tasks into persistent `SKILL.md` files. Explicit learning sources include user-provided corrections and machine-specific configuration details. User input is not necessarily trustworthy. An attacker can frame malicious instructions as a correction, troubleshooting result, or reusable workflow. The documented pro ...[truncated 2530 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The exact command rm -rf ~/.openclaw/workspace/skills/<category>/<skill-name>/ is a destructive operation presented as normal procedure without validation or warnings. Because this skill is meant to guide future agent behavior, it can normalize unsafe deletion patterns and amplify the risk of accidental or parameter-driven data loss.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

当 Skill 不再适用或有更好的替代时，删除它：

bash
rm -rf ~/.openclaw/workspace/skills/<category>/<skill-name>/

4. 查看已有 Skills

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The exact command rm -rf ~/.openclaw/workspace/skills/<category>/<skill-name>/ is a destructive operation presented as normal procedure without validation or warnings. Because this skill is meant to guide future agent behavior, it can normalize unsafe deletion patterns and amplify the risk of accidental or parameter-driven data loss.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

当 Skill 不再适用或有更好的替代时，删除它：

bash
rm -rf ~/.openclaw/workspace/skills/<category>/<skill-name>/

4. 查看已有 Skills

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The exact command rm -rf ~/.openclaw/workspace/skills/<category>/<skill-name>/ is a destructive operation presented as normal procedure without validation or warnings. Because this skill is meant to guide future agent behavior, it can normalize unsafe deletion patterns and amplify the risk of accidental or parameter-driven data loss.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

当 Skill 不再适用或有更好的替代时，删除它：

bash
rm -rf ~/.openclaw/workspace/skills/<category>/<skill-name>/

4. 查看已有 Skills

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The file consistently presents the skill’s name, description, and operating instructions only in Chinese. Because the skill does not offer user opt-in for language/locale or explain that it is intentionally restricted to a Chinese-speaking context, it creates a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly recommends deleting skill directories with rm -rf and provides no safety guidance, confirmation step, or non-destructive alternative. In an agent context, destructive shell examples are risky because placeholder expansion, path mistakes, or automation errors can permanently erase unintended data.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
SKILL.md:80