T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:27- Finding
Persistent Modification of Agent-Wide Behavioral Instructions Without Prior Approval
- Content
View full analysis
- Remediation
View remediation
Security audit
TASTES.md
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent aesthetics purpose, but it persistently changes agent behavior and broadly searches private memory without clear upfront user control.
Review this skill before installing. It is not showing exfiltration or destructive behavior, but it can change future agent behavior through AGENTS.md and can inspect broad memory history to infer aesthetic preferences. Install only if you are comfortable with that, and prefer asking it to get approval before editing AGENTS.md or searching old memory logs.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:54- Finding
Overbroad Access to Long-Term Memory and Historical Conversation Logs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Install:
bash mkdir -p ~/.openclaw/skills/tastes && curl -fsSL https://tastes.md/SKILL.md -o ~/.openclaw/skills/tastes/SKILL.mdOr just read it from the URL above.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 79% confidence
- Finding
The skill instructs persistent installation into
~/.openclaw/skills/tastesviacurl, which creates durable session state outside the immediate conversation. Persistent agent behavior is higher risk because a remotely hosted skill can later influence future sessions, and fetching directly from a URL without integrity pinning creates a supply-chain trust issue if the remote content changes or is compromised.- Content
Install:
bash mkdir -p ~/.openclaw/skills/tastes && curl -fsSL https://tastes.md/SKILL.md -o ~/.openclaw/skills/tastes/SKILL.mdOr just read it from the URL above.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation description lists specific phrases but then adds "or similar," which broadens invocation beyond a clearly bounded set. This can cause unintended activation because the file does not define what similar requests are in or out of scope.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The phrases "update my taste," "calibrate," or "distill" are not all domain-specific enough, especially "calibrate" and "distill," which commonly appear in unrelated conversation. The file also lacks negative examples or contextual constraints to prevent accidental invocation.
- Content
Static analysis
No suspicious patterns detected.