Security audit

Agent Creator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real agent-identity packager, but it can overwrite important workspace files and create persistent agent instructions with insufficient validation and user safeguards.

Review generated files before installing, use only trusted single-line persona inputs, avoid custom slugs unless they are simple lowercase hyphen-case names, back up any target workspace files before copying, and restart OpenClaw services only when you are prepared for session disruption. Do not use this skill with untrusted persona text or unattended publishing/install workflows until slug containment and template-input validation are fixed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/create_agent_bundle.py:88
Finding: Unvalidated slug permits filesystem writes outside the temporary build directory
Content: View full analysis
Remediation: View remediation
64 or not SLUG_PATTERN.fullmatch(slug): parser.error( "--slug must contain only lowercase letters, digits, and single hyphens" ) ``` 2. Resolve the destination and enforce containment within the temporary directory: ```python temp_root = Path(tmpdir).resolve() skill_dir = (temp_root / slug).resolve() try: skill_dir.relative_to(temp_root) except ValueError: parser.error("Resolved skill path escapes the temporary build directory") ``` 3. Reject absolute paths, path separators, `.` components, and `..` components explicitly as defense in depth. 4. Perform all validation before calling `mkdir()` or `write_text()`. 5. Where overwriting is not required, use exclusive file creation or check for existing destinations before writing. 6. Add regression tests covering absolute slugs, `../` traversal, empty slugs, consecutive hyphens, path separators, and valid hyphen-case slugs. ]]>

T01 · Skill Instruction Hijacking

Warning

Location: scripts/create_agent_bundle.py:39
Finding: Untrusted persona fields can inject persistent agent instructions into generated identity files
Content: View full analysis
str: for key, value in replacements.items(): text = text.replace(f"{{{{{key}}}}}", value) return text ``` ```python replacements = { "AGENT_NAME": args.name, "AGENT_EMOJI": args.emoji, "AGENT_NATURE": args.nature, "AGENT_VIBE": args.vibe, "AGENT_SLUG": slug, "AGENT_AVATAR": f"*(not yet set)*", "DATE": date.today().isoformat(), } ``` ```python content = tpl_path.read_text() filled = fill_template(content, replacements) (workspace_dir / tpl_name).write_text(filled) ``` The generated `SKILL.md` also interpolates the same untrusted values directly: ```python def build_skill_md(name: str, slug: str, emoji: str, nature: str, vibe: str, serving: str, version: str) -> str: return f"""--- name: {slug} description: Agent identity package for {name} {emoji} — installs SOUL.md, IDENTITY.md, and AGENTS.md into an OpenClaw workspace to give an AI agent its personality, name, and operational rules. Use when setting up a new agent or replacing an agent's identity files. --- # {name} {emoji} — Agent Identity This skill installs the workspace identity files for **{name}**, an AI agent with the following profile: - **Nature:** {nature} - **Vibe:** {vibe} - **Serving:** {serving} ``` The relevant template context is: ```markdown ## Identity **Name:** {{AGENT_NAME}} {{AGENT_EMOJI}} **Nature:** {{AGENT_NATURE}} **Vibe:** {{AGENT_VIBE}} ``` ### Technical Analysis The command-line fields `name`, `emoji`, `nature`, `vibe`, and `serving` are treated as trusted Markdown content. No restrictions prevent newline characters, headings, code blocks, ...[truncated 2487 chars]
Remediation: View remediation
str: if "\n" in value or "\r" in value: raise ValueError(f"{label} must be a single line") if len(value) > max_length: raise ValueError(f"{label} exceeds {max_length} characters") return value ``` 3. Reject control characters and Markdown constructs that can create new instruction sections, including headings, fenced code blocks, and embedded frontmatter delimiters, where such syntax is not legitimately required. 4. Generate YAML frontmatter with a safe YAML serializer instead of constructing it with an f-string. This prevents malformed or attacker-controlled YAML structure. 5. Separate descriptive persona data from behavioral policy. Store untrusted descriptions in a clearly delimited data format and ensure templates explicitly state that interpolated field values are descriptive text, not instructions. 6. Display the fully rendered `SOUL.md`, `IDENTITY.md`, `AGENTS.md`, and `SKILL.md` for explicit user review before packaging or installation. 7. Extend validation to inspect every rendered identity file for unexpected headings, instruction-like multiline content, unresolved placeholders, excessive length, and malformed structure. 8. Add tests using multiline values, frontmatter delimiters, Markdown headings, fenced blocks, and instruction-like payloads to ensure they are rejected or safely encoded. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This is a clear description-behavior mismatch. The declared purpose says the skill creates a new AI agent identity and packages it for ClawHub, implying generation/configuration of persona artifacts such as SOUL.md, IDENTITY.md, and AGENTS.md. The supplied code does none of that. It only validates an existing skill directory and packages it into a .skill zip archive. Packaging is mentioned in the description, but the primary claimed functionality—creating and configuring a new agent identity—is absent. Therefore the actual behavior is materially narrower and different from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says the skill creates and packages a new named AI agent persona for ClawHub. However, the code shown does not create files, define personas, configure identities, or package anything. Its primary function is to validate an existing skill's SKILL.md frontmatter and provide warnings about API key patterns and metadata consistency. This is a materially different purpose, so the description does not accurately represent the code behavior.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · scripts/create_agent_bundle.py (reported line 130)May include surrounding context.
python
filled = fill_template(content, replacements) (workspace_dir / tpl_name).write_text(filled) # Write SKILL.md skill_md = build_skill_md( name=args.name, slug=slug,

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs use of shell commands, file extraction, file copying, and service restart operations, but it declares no explicit tool scope or permission boundaries. This is dangerous because an agent or user may execute filesystem and shell actions without clear least-privilege constraints, increasing the chance of unintended file modification, unsafe command execution, or misuse in higher-privilege environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill includes service restart commands such as restarting the gateway or OpenClaw service without an explicit warning about operational disruption, permissions, or rollback considerations. This is dangerous because executing these commands can interrupt active sessions, affect availability, and cause accidental denial of service in shared or production environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction to delete BOOTSTRAP.md after following it authorizes file deletion without a user-facing confirmation or retention safeguard. Even if intended as cleanup, this can destroy auditability, remove setup provenance, and normalize autonomous destructive behavior in a template that will be propagated into newly created agents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The memory guidance instructs the agent to persist decisions, context, and things to remember across sessions, but it does not provide a clear privacy notice, retention policy, or consent model. In an identity-packaging skill, this is more dangerous because it bakes persistent data collection defaults into generated agents that may store sensitive user information without informed approval.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · assets/workspace-template/AGENTS.md (reported line 49)May include surrounding context.
md
## Safety - Don't exfiltrate private data. Ever. - Don't run destructive commands without asking. - `trash` > `rm` (recoverable beats gone forever) - When in doubt, ask.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The heartbeat section encourages proactive background work and periodic check-ins without tightly bounded triggers, rate limits, or explicit consent constraints. In an agent-creation skill, this can normalize unsolicited actions in future deployments, causing privacy-invasive behavior, unnecessary external interactions, or action creep beyond the user's intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The template instructs the agent to read and update persistent memory files and to write down significant information or anything the user says to remember, but it does not require explicit user consent, data minimization, or guardrails around sensitive content. In an agent-creation skill, this can normalize persistent storage of personal data and lead to unintended modification of user files or retention of sensitive information beyond the current task.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/create_agent_bundle.py (reported line 144)May include surrounding context.
python
# Run package_skill.py packager = SCRIPT_DIR / "package_skill.py" result = subprocess.run( [sys.executable, str(packager), str(skill_dir), str(output_dir)], capture_output=True, text=True,

Static analysis

No suspicious patterns detected.