Outclaw Style

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:03 AM UTC
• Version: 1.0.6

Overview

The skill has a legitimate style-learning purpose, but it needs review because it can collect and persist private outbound messages across connected channels with under-specified controls.

Review this before installing if your sent messages may contain customer data, business-sensitive content, personal conversations, secrets, or regulated information. Prefer installing only after raw-message retention is removed or tightly controlled, LinkedIn browser scraping is disabled or separately confirmed, and all style files use the tenant-scoped resolver path.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:96

Finding

Raw Private Communications Are Persisted Without Defined Security Controls

Content

View full analysis

--.jsonl` (NOT into the KB's people/orgs — this is training data, filed under raw/). ``` From `SKILL.md:136`: ```markdown - Raw outbound samples (the training data): `kb/raw/style---.jsonl`. ``` From `references/style-learning.md:15`: ```markdown | Email | Sent folder | `gog gmail messages search "from:me" -j --include-body --max 50` + filters | 30-50 messages | ``` ### Technical Analysis The skill retrieves complete outbound message bodies from connected email and messaging services and explicitly persists them as JSONL files. These messages may contain personal information, confidential business discussions, recipient details, contractual information, authentication links, or other sensitive content. The specification does not define: - File permission restrictions. - Encryption at rest. - Redaction or data minimization. - A retention period. - Secure deletion after training. - Isolation from other skills or processes with knowledge-base access. - Handling requirements for credentials, tokens, or sensitive links found inside message bodies. Although the skill includes a consent mechanism for sample collection, consent alone does not protect the resulting files. Persisting complete message bodies indefinitely creates a larger exposure surface than is necessary to generate a writing-style model. ### Attack Path 1. A user grants consent for style learning. 2. The skill invokes a connected service and retrieves outbound messages, including full message bodies. 3. The messages are written to `kb/raw/style---.jsonl`. 4. The ...[truncated 1333 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: agents/style-learner.md:99

Finding

Delegated Style Storage Omits Tenant Isolation

Content

View full analysis

/_style.md`. NEVER hand-craft a different path. ``` ### Technical Analysis The delegated subagent specification does not accept a tenant identifier and instructs the subagent to save every tenant's style for a given channel to the same path: ```text ~/.openclaw/outclaw/styles/{channel}_style.md ``` The parent skill instead requires a tenant-scoped location: ```text styles//_style.md ``` An implementation following the subagent specification cannot reliably enforce the parent skill's tenant boundary because the tenant is absent from both the declared inputs and the generated path. Consequently, separate tenants training the same channel can read, reuse, or overwrite a shared style file. The generated style prompt is derived from private communications and may reveal behavi ...[truncated 1948 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is designed to auto-invoke silently when a planned channel lacks a learned style, which means it can collect and process a user's outbound communications without a contemporaneous user-facing notice. Although the skill later includes a consent section, the silent runtime behavior still creates a privacy and transparency risk because sensitive message history may be analyzed and persisted in the background.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

2. **Analysis** — a thinking model identifies dimensions of quality,
   structural/stylistic patterns, anti-patterns the samples avoid.
3. **Candidate prompt** — direct, actionable instructions
   ("Write sentences that average 12-18 words"), target 500-2 000 words,
   with an explicit Avoid section.
4. **Iteration loop (5 cycles default)** per channel:
   - Generate test output with moderate temperature (0.6-0.8)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The skill explicitly writes raw outbound samples to a persistent JSONL file under kb/raw, which can contain sensitive personal, professional, or regulated communications. Persisting verbatim communications materially increases exposure in the event of overbroad access, later misuse, retention failures, or cross-tenant leakage, especially because the skill is intended to ingest many channels automatically.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

no connected plugin entirely (no point training).

2. **For each selected channel**, run a sub-task:
   a. Pull outbound samples via the channel's plugin. Write raw samples
      to `kb/raw/style-<tenant>-<channel>-<ts>.jsonl` (NOT into the KB's
      people/orgs — this is training data, filed under raw/).
   b. If the sample count is <20 or <1 000 words, log a memory

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

source: "observed", confidence: <N/10>}`.

3. **If auto-invoked** (from `outclaw-plan`): do ONE channel (the one
   requested), silent, then return to the caller. **NEVER ask the user
   for "preferred tone" or "desired format"** — the whole point of this
   skill is that we infer style from samples. If a channel has no
   outbound samples at all (e.g. user just connected Discord today),

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md

## Consent

Sample collection is a one-time opt-in, captured during
`outclaw-setup` Step 2 as a memory `preference` entry. If no consent
entry exists when this skill runs:
- Explicit invocation: ask once, record the decision.
- Auto-invocation from plan: proceed only if the tenant has an opt-in

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md

- Explicit invocation: ask once, record the decision.
- Auto-invocation from plan: proceed only if the tenant has an opt-in
  `style_consent` entry. If missing, log an observation and fall back
  to a neutral template style. Never silently scrape without consent.

## Output format (style prompt file)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The skill generates a reusable style prompt as imperative instructions derived from prior messages, then stores and later reuses it. This creates session-persistent prompt state that can carry forward overbroad behavioral instructions or embedded unsafe patterns from historical data, influencing future generations without fresh validation.

Content

Scanner excerpt · agents/style-learner.md (reported line 43)May include surrounding context.

Step 2: Generate Candidate Style Prompt

Write a style prompt as direct instructions (imperative mood, not descriptive):

markdown

# {Channel} Outreach Style — {User Name}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill is designed to retrieve private outbound messages from multiple channels, but the documentation provides no user-facing privacy warning or explicit consent checkpoint before accessing those communications. That omission is dangerous because these messages can contain confidential business, personal, or regulated information, and users may not realize the breadth of review required for style profiling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The reference expands collection scope beyond the manifest by covering additional channels and allowing lower sample fallbacks, which can cause the agent to access more tenant data than users or reviewers expect. In a style-learning skill, scope drift is security-relevant because it increases silent collection of sensitive communications across connected platforms.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documented use of browser automation to scrape LinkedIn sent messages introduces an intrusive acquisition method that bypasses normal least-privilege API patterns and may interact with authenticated sessions in risky ways. Because the skill's purpose is style learning, adding scraping materially increases account exposure, privacy risk, and the chance of collecting more content than necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Browser automation against LinkedIn is especially sensitive because it may reuse an authenticated session, expose account contents beyond the intended messages, and create platform-account risk without warning the user. Absent an explicit notice, users cannot meaningfully assess privacy, compliance, or account-safety implications before the skill acts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/style-learning.md (reported line 99)May include surrounding context.

markdown

# {Channel} Outreach Style — {User Name}

Write {type} outreach {messages/emails} following these rules:

STRUCTURE:
- [specific structural rules discovered]

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs the agent to persist a learned style prompt under the user's home directory without any explicit user-facing disclosure or consent in the skill text. While the content is not inherently dangerous, it creates undisclosed local persistence of derived user data, which can surprise users, leak writing-style metadata across sessions, or be reused by other components without the user's awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Persisting learned style prompts on disk creates a durable behavioral profile derived from the user's communications, yet the documentation gives no notice that this artifact will be stored locally. Even if the stored file is derived rather than raw text, it can still reveal communication habits, business intent, or recognizable personal traits if accessed by other local users or malware.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.