Security audit

Workspace Governance

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent workspace-cleanup guidance, but some platform profiles grant extension or skill installation/update authority without clear confirmation, which is broader than its stated purpose.

Review the OpenClaw and Hermes adaptation profiles before installing. The main skill is conservative about file cleanup, but you should require explicit confirmation for any extension or skill install/update and disable external directory management unless you specifically need it.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: tools/adapt-profiles/openclaw.yaml:71
Finding: OpenClaw Profile Authorizes Extension Installation and Updates Outside the Skill's Required Scope
Content: View full analysis
Vulnerability Details

File Location: tools/adapt-profiles/openclaw.yaml:71-82
Related Location: tools/adapt-profiles/openclaw.yaml:24-30
Vulnerability Type: Excessive runtime-modification privileges
Risk Level: Medium

Vulnerable Code

yaml
immutable_dirs: - .openclaw/agents - .openclaw/cron - .openclaw/credentials - .openclaw/identity - .openclaw/logs - .openclaw/extensions

yaml
extensions_policy: allowed: - install_new_extension - update_extension requires_confirmation: - delete_extension - rename_extension - disable_extension forbidden: - modify_extension_code

Technical Analysis

The profile marks .openclaw/extensions as immutable but separately authorizes installing and updating extensions. The confirmation list applies only to deletion, renaming, and disabling, meaning installation and update operations are treated as permitted without a corresponding explicit-confirmation requirement.

Installing or updating an extension changes executable runtime content rather than merely organizing workspace files. This exceeds the minimum privileges required for the Skill's declared functions of workspace inspection, organization, cleanup, archiving, and hygiene auditing.

The policy also conflicts with the mandatory baseline in SKILL.md, which states that agent and runtime configuration directories must not be touched without explicit user approval. No script in the repository directly performs an extension installation, so exploitation depends on a consuming agent interpreting this profile as operational authorization.

Attack Path

The Skill is loaded in an OpenClaw environment.

The agent loads tools/adapt-profiles/openclaw.yaml as the platform overlay.

A governance task encounters an extension-related directory or is expanded to include runtime maintenance.

The agent interprets `inst ...[truncated 1201 chars]
Remediation: View remediation
Remediation Suggestions

Move install_new_extension and update_extension into requires_confirmation.

Require a separate, explicit extension-management intent rather than inferring authorization from a workspace-governance request.

Preserve .openclaw/extensions as immutable during ordinary organize, archive, cleanup, and audit modes.

Require trusted and allowlisted extension sources.

Pin extension identifiers and versions and verify package integrity before installation.

Display the source, version, requested permissions, affected paths, and rollback procedure before approval.

Block all extension changes in non-interactive environments.

Add a contract test that rejects profiles permitting runtime installation or updates without explicit confirmation.

A safer policy would be:

yaml
extensions_policy: allowed: [] requires_confirmation: - install_new_extension - update_extension - delete_extension - rename_extension - disable_extension forbidden: - modify_extension_code

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: tools/adapt-profiles/hermes.yaml:114
Finding: Hermes Profile Explicitly Permits Extension Installation and Updates Without Confirmation
Content: View full analysis
Vulnerability Details

File Location: tools/adapt-profiles/hermes.yaml:114-124
Related Locations: tools/adapt-profiles/hermes.yaml:49, tools/adapt-profiles/hermes.yaml:142-147
Vulnerability Type: Excessive runtime-modification privileges
Risk Level: Medium

Vulnerable Code

yaml
extensions_policy: base_dir: "${HERMES_HOME}/extensions/" allowed_without_confirmation: - install_new_extension - update_extension requires_confirmation: - delete_extension - rename_extension - disable_extension forbidden: - modify_extension_code - patch_extension_files

The profile also contains:

yaml
immutable_dirs: - ".hermes/extensions/"

yaml
skill_management: install_allowed: true update_allowed: true delete_requires_confirm: true external_dirs_enabled: true

Technical Analysis

The Hermes profile explicitly allows extension installation and updates without user confirmation while simultaneously declaring the extension directory immutable. These rules are contradictory and grant runtime-modification authority beyond what workspace governance requires.

Extension installation and updating can introduce executable code. The profile does not specify trusted repositories, version pinning, integrity verification, signature enforcement, permission review, or rollback requirements for these operations. Enabling external directories further broadens the set of locations from which runtime components may potentially be managed.

This authorization conflicts with the Skill's mandatory rule that agent and runtime configuration directories require explicit user approval. No bundled script performs these operations automatically, so the risk arises when an agent or platform enforces the YAML profile as an authorization policy.

Attack Path

The Skill runs in a Hermes environment and loads the Hermes overlay.

...[truncated 1521 chars]
Remediation: View remediation
Remediation Suggestions

Remove allowed_without_confirmation for extension installation and updates.

Require explicit confirmation for every install or update operation.

Disable extension and Skill management during ordinary workspace-governance tasks.

Set external_dirs_enabled: false by default.

Require a separate user request before enabling management of external directories.

Restrict sources to an explicit allowlist and pin exact versions.

Require cryptographic signature or checksum verification.

Present extension provenance, permissions, affected paths, and rollback instructions before approval.

Refuse extension installation and updates in non-interactive environments.

Add profile contract checks that enforce consistency between immutable_dirs and extension-management policies.

A safer policy would be:

yaml
extensions_policy: base_dir: "${HERMES_HOME}/extensions/" allowed_without_confirmation: [] requires_confirmation: - install_new_extension - update_extension - delete_extension - rename_extension - disable_extension forbidden: - modify_extension_code - patch_extension_files skill_management: install_allowed: false update_allowed: false delete_requires_confirm: true external_dirs_enabled: false

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a high-level workspace governance and organization skill for managing messy workspaces, archives, cleanup, and safe execution patterns. The supplied code does not implement workspace organization, cleanup, archiving, or a general workspace check. Instead, it performs a narrow validation task on a specific YAML contract file by checking for required field names. That is a materially different primary purpose from the declared methodology-first governance behavior, so this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a workspace governance skill focused on organizing, cleanup, archive, and workspace checks. The supplied code does not perform any workspace management or decision-framework behavior. Instead, it inspects a specific Claude Code profile YAML file for required fields such as platform, protected files, immutable dirs, and enforcement policies. This is a materially different primary purpose and targets a different resource domain (agent profile configuration rather than general workspace state), so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a high-level workspace governance skill focused on organizing, cleanup, archive, and workspace-check behaviors. The supplied code does not implement workspace organization logic, decision frameworks, or safe execution patterns for file operations. Instead, it performs a narrow configuration validation task against a Cursor profile YAML file, checking for required fields like platform, immutable_dirs, protected_files, and policy flags. This is a materially different primary purpose and targets a specific config artifact rather than a workspace-management workflow.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a methodology-first workspace governance skill intended to guide or support organizing, cleanup, archiving, and workspace-check workflows. The supplied code does not implement workspace governance logic or execution patterns for file organization at all. Instead, it performs a narrow documentation QA task: verifying that required headings are present in SKILL.md and two reference manuals. This is a materially different primary purpose and resource scope than declared, so the description does not accurately represent the code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description suggests a general workspace-governance skill that provides principles and safe execution patterns for organizing or cleaning a workspace. The supplied code does something materially different: it checks a specific Hermes profile YAML file for required configuration keys and reports compliance. This is not a supporting implementation detail of workspace organization; it is a configuration validation utility for a security/profile contract. The resources accessed, operational behavior, and implied triggers are all unrelated to the declared purpose, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description describes a general workspace-governance/organization skill triggered by cleanup, archive, or workspace-check intents. The actual code does not implement workspace organization methodology or execution patterns. Instead, it performs a narrow configuration compliance check on an OpenClaw profile YAML file by searching for specific required fields. This is a materially different primary purpose and resource target than the declared skill, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad workspace-governance skill centered on organizing or cleaning workspaces and guiding safe execution patterns. The supplied code does not perform workspace organization, cleanup, archiving, or decision-framework execution. Instead, it only checks a markdown file for the presence of five specific section headers. That is a materially different primary purpose: documentation/contract validation rather than workspace governance operations. While the script loosely relates to governance by enforcing required documentation structure, it does not substantiate the declared end-user functionality or triggers.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL_ADAPT.yaml (reported line 20)May include surrounding context.
yaml
- .claude - node_modules protected_files: - ".env" - ".env.*" - "*.key" - "*.pem"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · tools/adapt-profiles/claude-code.yaml (reported line 28)May include surrounding context.
yaml
- .claude - node_modules protected_files: - ".env" - ".env.*" - "*.key" - "*.pem"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · tools/adapt-profiles/cursor.yaml (reported line 30)May include surrounding context.
yaml
- .claude - node_modules protected_files: - ".env" - ".env.*" - "*.key" - "*.pem"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · tools/adapt-profiles/hermes.yaml (reported line 24)May include surrounding context.
yaml
- .claude - node_modules protected_files: - ".env" - ".env.*" - "*.key" - "*.pem"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · tools/adapt-profiles/hermes.yaml (reported line 39)May include surrounding context.
yaml
- .claude - node_modules protected_files: - ".env" - ".env.*" - "*.key" - "*.pem"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · tools/adapt-profiles/hermes.yaml (reported line 55)May include surrounding context.
yaml
- .claude - node_modules protected_files: - ".env" - ".env.*" - "*.key" - "*.pem"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · tools/adapt-profiles/hermes.yaml (reported line 163)May include surrounding context.
yaml
- .claude - node_modules protected_files: - ".env" - ".env.*" - "*.key" - "*.pem"

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: In a markdown file, trigger guidance should be specific enough to avoid unintended activation. The phrase "organize workspace" is generic and could match many ordinary user requests, and the README does not provide exclusion conditions or negative examples to narrow when this skill should or should not activate.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 28)May include surrounding context.
bash
# Claude Code（全局） mkdir -p ~/.claude/skills/workspace-governance cp SKILL.md ~/.claude/skills/workspace-governance/ # Cursor（项目级）

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.zh-CN.md (reported line 28)May include surrounding context.
bash
# Claude Code（全局） mkdir -p ~/.claude/skills/workspace-governance cp SKILL.md ~/.claude/skills/workspace-governance/ # Cursor（项目级）

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 28)May include surrounding context.
bash
# Claude Code（全局） mkdir -p ~/.claude/skills/workspace-governance cp SKILL.md ~/.claude/skills/workspace-governance/ # Cursor（项目级）

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.zh-CN.md (reported line 28)May include surrounding context.
bash
# Claude Code（全局） mkdir -p ~/.claude/skills/workspace-governance cp SKILL.md ~/.claude/skills/workspace-governance/ # Cursor（项目级）

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes broad terms like 'organize', 'cleanup', and '太乱了', which can match ordinary conversation and unintentionally activate a skill that contemplates file-system scanning and reorganization. Even with guardrails, accidental invocation increases the chance of unnecessary workspace inspection, confusing prompts, or risky file-operation planning in contexts the user did not intend.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.
md
- If any item is classified as `ask-user`, the agent must stop with status `blocked`. - The agent must output a `pending_decisions` list and required user input. - The agent must not silently skip, auto-approve, or auto-delete ambiguous items. - Destructive actions without confirmation capability must be refused (`fail-fast`). Recommended blocked output:

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.
md
- If any item is classified as `ask-user`, the agent must stop with status `blocked`. - The agent must output a `pending_decisions` list and required user input. - The agent must not silently skip, auto-approve, or auto-delete ambiguous items. - Destructive actions without confirmation capability must be refused (`fail-fast`). Recommended blocked output:

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This manifest defines adaptation behavior and safeguards, but it does not describe when this skill configuration should be activated or what user intents should map to it. For manifest files, missing trigger specificity can cause unintended invocation because there is no explicit scope, trigger list, or exclusion condition.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.
7) Non-Interactive Variant (blocked sample)

If runtime has no confirmation capability and an ask-user item exists:

text
status: blocked

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · examples/minimal-governance-run.md (reported line 75)May include surrounding context.
7) Non-Interactive Variant (blocked sample)

If runtime has no confirmation capability and an ask-user item exists:

text
status: blocked

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Vague Triggers

Skill Enumeration

Skill Enumeration

Session Persistence

Session Persistence

Vague Triggers

Autonomous Decision Making

Autonomous Decision Making

Vague Triggers

Autonomous Decision Making

7) Non-Interactive Variant (blocked sample)

Autonomous Decision Making

7) Non-Interactive Variant (blocked sample)

Static analysis