T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:32- Finding
Unvalidated External Protocol Can Override Agent Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
Adaptive Rag Engine
Security checks for vulnerabilities and agentic risk
Overview
This RAG memory skill is not clearly malicious, but it asks agents to implicitly follow unreviewed workspace files and can index private memory content into a plaintext local file.
Review this before installing if your OpenClaw memory folder contains private, medical, financial, business, or credential-like notes. Only use it in a workspace where you control the referenced protocol file and are comfortable with automatic retrieval behavior and creation of a plaintext memory index.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/build-capsule-index.py:14- Finding
Broad Agent-Memory Content Is Aggregated into a Plaintext Index
- Content
View full analysis
max_chars: break summary = ' '.join(summary_lines)[:max_chars] return summary if summary else "(空胶囊)" except Exception: return "(读取失败)" ``` ```python def build_index(): """扫描所有胶囊，构建索引""" capsules = [] md_files = sorted(TOPICS_DIR.glob("*.md")) for f in md_files: name = f.stem size = f.stat().st_size mtime = datetime.fromtimestamp(f.stat().st_mtime).isoformat() summary = extract_summary(f) tags = classify_capsule(name) capsules.append({ "id": name, "name": name, "size_bytes": size, "modified": mtime, "summary": summary, "tags": tags, "path": str(f.relative_to(Path(os.path.expanduser("~/.openclaw/workspace")))), }) index = { "version": "1.0", "built_at": datetime.now().isoformat(), "total_capsules": len(capsules), "categories": { "medical": [c["id"] for c in ...[truncated 3049 chars]- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill is described as an autonomous adaptive RAG engine with routing, CRAG correction, and validation, but the documented concrete behavior is limited to reading local files and running indexing/evaluation scripts. This mismatch can mislead operators and downstream agents into granting trust, autonomy, or broader activation than the implementation justifies, which is a security concern because capability transparency is required for safe delegation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill advertises behavior that reads protocol and index files and invokes local Python scripts, but it does not declare any explicit tool scope such as file access permissions. In an agent environment, undeclared file read/write capability weakens least-privilege boundaries and can cause the skill to access or modify workspace data without clear review or consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger description is very broad, covering memory search, retrieval, and answering complex questions, which overlaps with many normal conversations. In an agentic system, overly broad activation criteria can cause the skill to run unexpectedly, expanding access to files and scripts in contexts where the user did not intend retrieval or background processing.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
文件中的名称说明和整体使用文案均以中文固定表述，且未声明这是面向特定中文环境的受限技能，也未向用户提供语言/locale 选择。按照语言/locale 策略，若技能实际强制特定语言而无用户选择或合理约束说明，属于自然语言政策风险。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Stating that the skill operates at the protocol layer and does not require explicit invocation makes activation implicit, while the document does not define concrete constraints or guardrails for when it should run. Implicit auto-execution increases the chance of unauthorized or unintended behavior, especially for a skill that reads files and influences memory/search workflows across conversations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file includes natural-language strings such as the title, usage comments, argument help text, and runtime output only in Chinese. That imposes a specific language on all users without any documented opt-in or locale selection, which matches the language/locale policy violation category.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python file contains natural-language descriptions and console output in Chinese only, including the header comments and runtime status messages. Under the policy for natural-language violations, forcing a specific language without opt-in can be a locale-policy issue when no alternative or user choice is offered.
- Content