Outclaw Plan

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:03 AM UTC
• Version: 1.0.6

Overview

This outreach skill has a coherent purpose, but it should be reviewed because it can silently run prerequisite workflows, persist scheduled outreach, automate external account actions, and store sensitive drafts in predictable temporary files.

Install only if you are comfortable with an outreach agent that reads sales KB/style data, polls connected messaging accounts, writes campaign memory/state, and schedules future contact actions. Review account permissions carefully, require visible confirmations for prerequisite research and all live account actions, and avoid shared machines until the fixed /tmp file handling is replaced with secure per-run temporary files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/channel-adapters.md:20

Finding

Predictable Shared Temporary File Exposes Outreach Content to Symlink and Collision Attacks

Content

View full analysis

/tmp/outclaw_msg.txt` 2. Draft (non-trust mode): `gog gmail drafts create --to "" --subject "" --body-file /tmp/outclaw_msg.txt -j` 3. Send (trust mode): `gog gmail send --to "" --subject "" --body-file /tmp/outclaw_msg.txt -j` 4. Capture `id` and `threadId` from the JSON response for response detection ``` The main Skill instructions also use fixed shared paths: ```text /tmp/outclaw-plan-draft.md /tmp/outclaw-reply.md ``` The validation workflow reads these same predictable paths: ```bash python3 ~/.openclaw/skills/outclaw/shared/scripts/channel_validator.py \ --from-file /tmp/outclaw-plan-draft.md --format human python3 ~/.openclaw/skills/outclaw/shared/scripts/draft_checker.py \ --from-file /tmp/outclaw-plan-draft.md --format human ``` ### Technical Analysis The Skill instructs the Agent to place prospect details and outbound email content in globally predictable files under `/tmp`. It does not require: - Exclusive file creation; - A private temporary directory; - Restrictive file permissions; - Symbolic-link checks; - File ownership verification; - Unique paths for concurrent campaigns; - Guaranteed deletion after use. The shell redirection in: ```bash printf '%s' "$body" > /tmp/outclaw_msg.txt ``` follows symbolic links. If another local process creates `/tmp/outclaw_msg.txt` as a symbolic link before the command runs, the Agent can overwrite the link target with the privileges of the Agent process, provided that account can write to the target. The fixed filename also creates a time-of-check/time- ...[truncated 2608 chars]

Remediation

View remediation

"$body_file" ``` 8. Delete temporary files immediately after the corresponding draft, validation, or send operation. Retain the cleanup trap as a fallback for failures and interruptions. 9. Add concurrency tests that run multiple campaigns simultaneously and verify that no message body, plan, or validation result crosses campaign boundaries. 10. Add a symlink regression test that pre-creates the historical fixed paths and confirms that the Skill refuses to write through them. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (7)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 424)May include surrounding context.

md

Channel heuristics (see `references/channel-adapters.md`):

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list contains broad natural-language phrases like 'follow up', 'just send it', and 'check replies' that could match benign conversation and route users into a high-impact outreach/sending skill unexpectedly. In this context, unintended invocation is especially risky because the skill can draft, schedule, monitor, and manage outbound contact workflows, so a false trigger may expose campaign data or initiate sensitive planning flows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly authorizes silent auto-invocation of other skills and scripts when prerequisites are missing, without user disclosure or approval. This creates hidden side effects such as background research, style generation, or capability refreshes that may read/write tenant data and expand the action surface beyond what the user knowingly requested.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The instruction to 'auto-invoke' prerequisite skills 'silently' and 'do NOT ask the user' delegates material decisions to the agent without informed user approval. In a workflow that can trigger research, style adaptation, capability refreshes, and later scheduling/execution, this increases the risk of unauthorized data processing and action chaining from a simple user prompt.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

silently and tell the user: "Plan shortened — we don't have <cap>."

When a required prerequisite is missing, **auto-invoke** the right skill
silently — do NOT ask the user:

- Target's KB page missing or stale → invoke `outclaw-research`.
- A channel in the plan has no learned style for this tenant → invoke

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Writing full plan drafts to a predictable path in /tmp creates session persistence outside the immediate interaction and may expose sensitive campaign content, target identities, and message drafts to other local processes or later sessions on shared systems. Because these drafts are intended to be presented verbatim and may contain prospect data and outreach strategy, leakage from temporary storage has real confidentiality impact.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

in flight since ; include anyway?").

Self-audit before presenting the plan — run BOTH checker scripts. Write the whole plan draft to /tmp/outclaw-plan-draft.md (using your Write tool), then run in order:

bash

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill creates campaign state and schedules durable taskflow nodes that persist beyond the current session, enabling future autonomous execution of outreach actions. Persistent scheduled actions are high-risk in this context because they can continue operating on personal contact data and send messages later, potentially after user context has changed or if approval/state checks are incomplete.

Content

Scanner excerpt · SKILL.md (reported line 519)May include surrounding context.

After full plan approval:

bash

python3 "$SHARED/scripts/campaign_state.py" create <slug> ...
# taskflow integration: schedule each touchpoint as a durable task

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented LinkedIn fallback directs the agent to use browser automation to navigate a profile, click Connect, and add a note, which are externally visible account actions. In this skill, those actions are part of a messaging/outreach workflow, so performing them without an explicit approval gate and clear warning about account impact can cause unintended contact, reputational harm, and policy violations if triggered automatically or on ambiguous user intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.