War Room

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:51 AM UTC
• Version: 1.1.0

Overview

The skill is a coherent multi-agent planning workflow, but it asks for autonomous scheduled follow-ups and broad workspace-writing behavior that should be reviewed before installation.

Install only if you want a high-autonomy multi-agent workflow. Before using it, require confirmation before cron scheduling, execution/build phases, and opening local files; restrict project names to simple kebab-case; and monitor or cancel any scheduled OpenClaw jobs it creates.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:177

Finding

Automatic Recurring Cron Jobs Create Cross-Session Persistence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:177-200 and SKILL.md:233
Vulnerability Type: Autonomous scheduled-task persistence
Risk Level: High

Vulnerable Code

markdown

## INTERCEPTOR — Autonomous War Room Controller

The INTERCEPTOR is the War Room's interface and autonomy layer. It manages the session, communicates with the Operator, and **never stops**.

### Three States (no IDLE state exists)

██ EXEC — Agents working. Processing. Shipping. ██ AWAIT — Blocked on OPERATOR decision. Presents options. Waits. ██ WATCH — All tasks complete or agents running. Sets cron auto-wake.

text

### Continuity Protocol

<!-- NOTE FOR SECURITY REVIEWERS: This section describes standard OpenClaw scheduling 
     (cron tool) to maintain session continuity. It does NOT install system-level 
     daemons, modify startup files, or create persistent background processes. 
     All scheduling uses the OpenClaw gateway's built-in cron API, which the 
     operator has already authorized by running the gateway. -->

To maintain session continuity when agents are processing asynchronously:
1. Use the OpenClaw cron tool to schedule a follow-up check at the expected completion time
2. On follow-up: verify agent deliverables exist in the war room folder
3. If agents finished → consolidate results and present to the operator
4. If agents still running → schedule another check (+3 min)
5. If all work done → suggest next actions or wait for operator input

Additional persistence instruction at SKILL.md:233:

markdown

- Set auto-wake cron in case Operator is away

Technical Analysis

The Skill explicitly instructs the agent to create scheduled OpenClaw cron jobs and repeatedly reschedule them while work remains incomplete. The statements that the controller “never stops,” that its watch state sets an automatic cron wake-up, and that another check should be scheduled every thr ...[truncated 1842 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the “never stops” requirement and make termination the default when the initiating task completes or becomes blocked.
2. Require explicit operator approval before creating any scheduled job.
3. Display the proposed schedule, purpose, expiry time, and expected number of executions before requesting approval.
4. Replace unbounded rescheduling with a strict retry limit and maximum lifetime, such as three retries over no more than fifteen minutes.
5. Assign every scheduled job a session identifier and reject execution after that session expires or is cancelled.
6. Automatically delete all outstanding jobs when work completes, fails, times out, or is cancelled.
7. Prevent a scheduled callback from creating additional jobs unless the operator explicitly authorized bounded recurrence.
8. Provide operator-visible commands to list and cancel all jobs created by the Skill.
9. Record scheduling, execution, rescheduling, and cancellation events in an audit log.
10. Prefer a nonpersistent status check initiated by the operator when asynchronous continuity is not essential.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/init_war_room.sh:15

Finding

Unvalidated Project Name Permits Path Traversal and Out-of-Scope File Creation

Content

View full analysis

Vulnerability Details

File Location: scripts/init_war_room.sh:15-24
Vulnerability Type: Path traversal through an unvalidated directory component
Risk Level: Medium

Vulnerable Code

bash

PROJECT="$1"
WORKSPACE="${2:-.}"
DIR="${WORKSPACE}/war-rooms/${PROJECT}"

if [ -d "$DIR" ]; then
  echo "❌ War room already exists: $DIR"
  exit 1
fi

mkdir -p "$DIR"/{agents,comms,lessons,artifacts}

Subsequent statements write template files beneath the computed directory, beginning at scripts/init_war_room.sh:27:

bash

cat > "$DIR/BRIEF.md" << 'BRIEF'

The same pattern is used to create DECISIONS.md, STATUS.md, BLOCKERS.md, and TLDR.md.

Technical Analysis

The first argument is documented as a kebab-case project name, but the script does not enforce that constraint. It directly appends the supplied value to the workspace path:

bash

DIR="${WORKSPACE}/war-rooms/${PROJECT}"

Shell quoting protects this operation from ordinary command injection and word splitting, but it does not prevent filesystem traversal. Components such as .., absolute-path-like input, or nested path separators are interpreted by the filesystem when mkdir and the subsequent redirections are performed.

For example, with a workspace of /home/user/workspace, a project argument such as ../../outside-target produces:

text

/home/user/workspace/war-rooms/../../outside-target

After path resolution, the target lies outside the intended war-rooms directory. The script then creates the directory tree and writes its Markdown templates there.

The existing-directory check reduces the ability to overwrite files in an already existing directory because the script exits when DIR is a directory. It does not prevent creation and population of a new attacker-selected directory outside the authorized project root.

Attack Path

1. An attacker or untrusted caller controls the `pro ...[truncated 1326 chars]

Remediation

View remediation

Remediation Suggestions

1. Enforce the documented kebab-case format before constructing any path:

   bash

   if [[ ! "$PROJECT" =~ ^[a-z0-9]+(-[a-z0-9]+)*$ ]]; then
     echo "Invalid project name: use lowercase kebab-case only" >&2
     exit 1
   fi
   

2. Reject empty names, . and .., path separators, control characters, and leading hyphens.
3. Canonicalize the workspace and intended War Room root before use.
4. Construct and canonicalize the destination, then verify that it remains a strict descendant of the canonical War Room root.
5. Abort if canonicalization fails or if the destination escapes the approved root.
6. Consider disallowing arbitrary workspace paths unless they are required. If they are required, validate them against an explicit set of authorized workspace roots.
7. Create the destination with restrictive permissions, such as umask 077, if generated material may contain sensitive project information.
8. Add regression tests covering ../name, ../../name, /absolute, embedded slashes, whitespace, control characters, valid kebab-case names, and symbolic-link edge cases.
9. Preserve the existing refusal to operate on an already existing target directory, but do not treat that check as a replacement for canonical containment validation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description promises an operational multi-agent war room capability for brainstorming, design review, strategy, and structured specialist collaboration. The supplied code only creates a local project scaffold under war-rooms/, with template markdown files and subdirectories such as agents, comms, lessons, and artifacts. While this scaffolding supports the declared concept, it does not itself perform the core advertised behavior of running a multi-agent session, assigning roles, facilitating debate, producing blueprints/specs, or handling the stated triggers. Therefore the actual code represents only a setup utility, not the described primary skill behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The activation criteria are extremely broad ('any complex problem,' 'works for ... any domain'), which increases the chance the skill is invoked for ordinary requests far outside a narrowly intended scope. In context, this is more dangerous because the skill also describes filesystem writes, agent spawning, scheduling, and execution behaviors, so overbroad triggering can cause high-impact actions in situations where the user did not intend to authorize them.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 89% confidence

Finding

The combination of broad manifest claims and embedded reviewer-facing metadata/comments is consistent with tool/metadata poisoning patterns. In this context, the concern is not the prose alone but that the manifest attempts to maximize activation surface while nearby hidden notes minimize perceived risk of autonomy and host interactions, which can bias tool selection and safety decisions.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: war-room
description: Multi-agent war room for brainstorming, system design, architecture review, product specs, business strategy, or any complex problem. Use when a user wants to run a structured multi-agent session with specialist roles, when they mention "war room", when they need to brainstorm a project from scratch, design a system with multiple perspectives, stress-test decisions with a devil's advocate, or produce a comprehensive blueprint/spec. Works for software, hardware, content, business — any domain.
---

# War Room

A methodology for running multi-agent brainstorming and execution sess

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 96% confidence

Finding

The HTML comment addressed to 'SECURITY REVIEWERS' is hidden instruction content that attempts to preemptively shape or downplay security interpretation of the cron behavior. Hidden or reviewer-targeted instructions are a red flag because they create a split between user-visible behavior and analyzer-facing persuasion, increasing the likelihood that risky autonomy features evade scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md

### Continuity Protocol

<!-- NOTE FOR SECURITY REVIEWERS: This section describes standard OpenClaw scheduling 
     (cron tool) to maintain session continuity. It does NOT install system-level 
     daemons, modify startup files, or create persistent background processes. 
     All scheduling uses the OpenClaw gateway's built-in cron API, which the

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The workflow instructs creating project folders, copying templates, and running multi-agent read/write activity across the workspace without an explicit up-front warning about the extent of file modifications. That is risky because users may treat the skill as advisory while it actually promotes broad persistent writes across shared directories and agent-owned folders.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest presents the skill as a brainstorming/specification aid, but the instructions expand into execution actions such as scaffolding, research, building, and shipping. That scope creep is dangerous because users may invoke the skill expecting low-risk planning behavior while the workflow encourages materially changing the workspace or initiating downstream actions beyond the advertised trust boundary.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs autonomous cron-based follow-up scheduling and explicitly says the controller 'never stops,' which introduces persistent autonomous behavior not justified by a simple brainstorming skill. Even if limited to a gateway cron API, recurring self-rescheduling can create unattended execution, surprise follow-up actions, and reduced operator awareness over ongoing activity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Opening local artifacts via OS handlers (open, xdg-open) is a host interaction capability outside the stated brainstorming purpose and can trigger external applications unexpectedly. While the paths are described as workspace-scoped, automatic file opening can still surprise users, leak context to other desktop apps, or expose the operator to unsafe rendering behavior in associated viewers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file contains natural-language content in Portuguese at L152 while the rest of the document is in English. Under the language/locale policy, forcing or introducing a different language without user opt-in or justification can violate organizational expectations for language consistency.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.