Agent Lifecycle Manager

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:54 AM UTC
• Version: 0.1.2

Overview

This skill is mostly purpose-aligned for OpenClaw agent lifecycle work, but its helper scripts handle sensitive local agent files and credentials with unsafe path and temporary-file practices.

Review before installing. Use only with trusted operators and trusted agent IDs, avoid passing real Telegram tokens on the command line, restrict archive locations and permissions, and patch the scripts to validate agent IDs, use mktemp/private temp paths, and redact or minimize archived status and workspace data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/archive-agent.sh:9
• Finding: Path Traversal Through an Unvalidated Agent Identifier<![CDATA[ ## Vulnerability Details **File Location**: `scripts/archive-agent.sh`, lines 9-17 **Vulnerability Type**: Path traversal and unintended file archiving **Risk Level**: High ### Vulnerable Code ```bash AGENT_ID="$1" ARCHIVE_ROOT="${2:-$(pwd)/state/archive}" TS="$(date -u +'%Y%m%dT%H%M%SZ')" OUT="$ARCHIVE_ROOT/$AGENT_ID/$TS" mkdir -p "$OUT" cp -a "$HOME/.openclaw/agents/$AGENT_ID" "$OUT/agents-dir" 2>/dev/null || true cp -a "$HOME/.openclaw/workspace-$AGENT_ID" "$OUT/workspace" 2>/dev/null || true ``` ### Technical Analysis `AGENT_ID` is incorporated directly into both source and destination filesystem paths. The script does not restrict the identifier to an expected character set, canonicalize the resulting paths, or verify that the paths remain beneath the intended OpenClaw and archive directories. An identifier containing traversal components such as `../` can therefore escape the expected directories. For example, the source path: ```text $HOME/.openclaw/agents/../../.ssh ``` normalizes to a directory outside `$HOME/.openclaw/agents`. The destination is similarly constructed from untrusted input. Suppressing copy errors with `2>/dev/null || true` also allows the script to continue after a failed or partial copy, potentially creating an archive that appears successful but is incomplete. ### Attack Path 1. An attacker or untrusted automation supplies a crafted agent identifier to `archive-agent.sh`. 2. The identifier contains traversal sequences, such as `../../.ssh`. 3. `mkdir` resolves the traversal components while creating the archive destination. 4. `cp -a` resolves the crafted source path outside the intended OpenClaw agent directory. 5. User-readable sensitive files are copied into the archive destination. 6. If the archive directory is exposed to another user or process, the copied information can be retrieved from there. ### Impact Assessment The script does not itself elevate privileges, so access is limited to files readable ...[truncated 433 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate `AGENT_ID` before any filesystem operation using a strict allowlist, for example: ```bash if [[ ! "$AGENT_ID" =~ ^[A-Za-z0-9_-]+$ ]]; then echo "Invalid agent ID" >&2 exit 1 fi ``` 2. Canonicalize source and destination paths with `realpath` or an equivalent mechanism. 3. Verify that the canonical source remains beneath `$HOME/.openclaw/agents` or the expected workspace root. 4. Verify that the canonical destination remains beneath the configured archive root. 5. Reject absolute paths, path separators, `.` components, and `..` components in identifiers. 6. Remove `|| true` from archive copy operations. If an optional source does not exist, test that condition explicitly; otherwise, fail on copy errors. 7. Record which source directories were successfully archived and verify their presence before declaring the archive successful. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/delete-agent-safe.sh:114
• Finding: Predictable Temporary File Permits Symlink-Based File Clobbering<![CDATA[ ## Vulnerability Details **File Location**: `scripts/delete-agent-safe.sh`, lines 114-115 **Vulnerability Type**: Unsafe predictable temporary file **Risk Level**: Medium ### Vulnerable Code ```bash # 5) delete agent openclaw agents delete "$AGENT_ID" --force --json >/tmp/openclaw.agent-delete.$AGENT_ID.json ``` ### Technical Analysis The deletion result is written to a predictable filename in the shared `/tmp` directory. The file is opened through ordinary shell redirection without exclusive creation, ownership verification, restrictive permissions, or symlink protection. A local attacker who can predict the agent identifier may pre-create the destination as a symbolic link. On systems where the operating system's temporary-directory symlink protections do not prevent the operation, shell redirection follows the link and truncates or overwrites its target. Using the unvalidated `AGENT_ID` in the filename also allows path separators or traversal components to influence the output path, subject to whether such an identifier passes the preceding OpenClaw agent-existence check. ### Attack Path 1. A local attacker learns or predicts the identifier of an agent that an operator will delete. 2. The attacker creates `/tmp/openclaw.agent-delete.<AGENT_ID>.json` as a symbolic link to another file. 3. The operator runs `delete-agent-safe.sh` under an account that can write the symlink target. 4. Shell redirection opens the predictable path before starting `openclaw`. 5. If platform symlink protections permit it, the target file is truncated and then receives the JSON deletion output. ### Impact Assessment The attack does not grant direct privilege escalation, but it can overwrite or corrupt any file writable by the account running the script. If a privileged operator invokes the script, the scope increases to files writable by that privileged account. Possible consequences include denial of service, corruption of configuration or application state, ...[truncated 194 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a private temporary directory or file with `mktemp`: ```bash TMP_DIR="$(mktemp -d)" chmod 700 "$TMP_DIR" trap 'rm -rf -- "$TMP_DIR"' EXIT DELETE_RESULT="$TMP_DIR/agent-delete.json" openclaw agents delete "$AGENT_ID" --force --json >"$DELETE_RESULT" ``` 2. Do not derive temporary filenames from untrusted identifiers. 3. Set a restrictive `umask`, such as `umask 077`, before writing potentially sensitive output. 4. If the deletion output must be retained, move it from the private temporary directory to a validated destination using an atomic operation. 5. Apply the same strict agent-ID validation recommended for all other scripts. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create-telegram-agent.sh:23
• Finding: Telegram Bot Token Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/create-telegram-agent.sh`, lines 23-30 and 46 **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash if [[ $# -lt 2 ]]; then usage exit 1 fi AGENT_ID="$1" TELEGRAM_TOKEN="$2" WORKSPACE="${3:-$HOME/.openclaw/workspace-$AGENT_ID}" openclaw channels add --channel telegram --account "$AGENT_ID" --token "$TELEGRAM_TOKEN" ``` ### Technical Analysis The Telegram token is supplied as a positional argument to the shell script and is then forwarded as the value of the `--token` command-line option. Command-line arguments may be exposed through process-listing interfaces, process-accounting systems, diagnostic tools, audit logs, shell history, or orchestration telemetry. Quoting prevents shell word splitting but does not conceal the token from process metadata. The exact exposure depends on operating-system process visibility settings and how the script is invoked. Even if the `openclaw` process is short-lived, the original script invocation can itself disclose the token because it is also passed as the script's second argument. ### Attack Path 1. An operator invokes `create-telegram-agent.sh` with a Telegram token as its second argument. 2. The token appears in the shell script's command line. 3. The script starts `openclaw channels add` and places the same token in that process's argument vector. 4. A local process monitor, process-accounting service, diagnostic collector, or user with suitable process visibility records the command line. 5. The observer extracts the bot token and uses it against the Telegram Bot API. ### Impact Assessment A compromised Telegram bot token can allow an attacker to impersonate or control the affected bot within the permissions provided by Telegram. This may expose bot updates, enable unauthorized message operations, disrupt the channel integration, or interfere with agent pairing and ...[truncated 222 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not accept the Telegram token as a positional command-line argument. 2. Prefer a protected standard-input mechanism, inherited file descriptor, or secret-file option supported by the `openclaw` CLI. 3. If a temporary secret file is unavoidable: - Create it with `mktemp` in a private directory. - Apply mode `0600`. - Set `umask 077`. - Remove it with an `EXIT` trap. 4. Avoid printing the token in status messages, debug traces, or error logs. 5. Document process-visibility risks and require rotation of any token suspected of exposure. 6. If `openclaw` only supports `--token`, update the CLI to support reading the token from standard input, an already-open descriptor, or a protected credential store. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/lifecycle-log.sh:9
• Finding: Unescaped Values Permit Markdown Log and Dashboard Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lifecycle-log.sh`, lines 9-13 and 25; `scripts/refresh-dashboard.sh`, lines 58-67 **Vulnerability Type**: Markdown injection and audit-record forgery **Risk Level**: Low ### Vulnerable Code ```bash LOG_FILE="$1" ACTION="$2" AGENT_ID="$3" SUMMARY="$4" OPERATOR="${5:-agent-manager}" printf "| %s | %s | %s | %s | %s |\n" "$TS" "$ACTION" "$AGENT_ID" "$SUMMARY" "$OPERATOR" >> "$LOG_FILE" ``` ```bash jq -r '.agents[] | [ .id, (.name // "-"), (((.identityEmoji // "") + " " + (.identityName // "-")) | gsub("^ ";"")), (.workspace // "-"), (.model // "-"), (if .heartbeat.enabled then .heartbeat.every else "disabled" end), (if .isDefault then "yes" else "no" end) ] | @tsv' "$REGISTRY_JSON" | while IFS=$'\t' read -r id name ident ws model hb def; do printf "| %s | %s | %s | %s | %s | %s | %s |\n" "$id" "$name" "$ident" "$ws" "$model" "$hb" "$def" >> "$ROOT/AGENT_STATUS.md" done ``` ### Technical Analysis Lifecycle arguments and agent metadata are written directly into Markdown table rows without escaping Markdown delimiters, line breaks, HTML fragments, or link syntax. An attacker-controlled value containing a pipe character can create additional columns. A value containing a line break can terminate the current row and insert arbitrary Markdown content or forged table entries. Depending on the Markdown renderer, embedded HTML or crafted links may also produce deceptive rendered content. The lifecycle log is intended to act as an audit record, making output integrity particularly important. The dashboard has a similar trust issue because generated content may be treated as an authoritative representation of agent status. ### Attack Path 1. An attacker supplies or causes OpenClaw to store crafted agent metadata, or provides a crafted action, agent ID, summary, or operator value to `lifecycle-log.sh`. 2. The value contains Markdown delimiters, line breaks, links, or HTML-like content. ...[truncated 817 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Reject carriage returns, line feeds, null bytes, and other control characters in all fields used to generate Markdown. 2. Escape at least: - Pipe characters as `\|` - Backslashes - Newlines as a visible escaped sequence - HTML-significant characters where raw HTML rendering is possible 3. Apply equivalent output encoding to values read from OpenClaw JSON before writing the dashboard. 4. Treat structured JSON as the authoritative audit record and generate Markdown only as a presentation format. 5. Consider signing or append-only storage for lifecycle records if audit integrity is security-sensitive. 6. Add tests using values containing pipes, tabs, newlines, Markdown links, and HTML fragments. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a clear description-behavior mismatch. The implementation is narrowly scoped to logging lifecycle events to a file. While lifecycle logging is one declared sub-capability, the overall declared purpose emphasizes broad lifecycle operations and maintenance tasks that are absent from the code. The code does not interact with agents, node services, configuration, credentials, dashboards, or deletion/archive operations, so its actual behavior is materially narrower than the declared primary purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The code’s actual behavior is narrowly focused on status collection and dashboard generation. It reads current OpenClaw state via CLI commands, merges heartbeat and agent-list data into JSON, and renders a markdown table. While this does match the declared sub-capability of refreshing status dashboards, the declared description presents the skill as a full lifecycle management tool with mutation and audit functions that are absent from the code shown. This is a material description/behavior mismatch because the primary declared scope is much broader than the implementation.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: agent-lifecycle-manager
description: "Manage full OpenClaw agent lifecycle operations on a node: create/register agents, configure channel bindings, optionally inherit credentials with explicit consent, approve pairing, archive and delete agents, refresh status dashboards, and write lifecycle change logs. Use when a user asks to onboard a new agent, reconfigure an existing agent, retire/archive/delete agents, or maintain agent status boards and lifecycle audit records."
metadata:
  {
    "openclaw": {

• Confidence: 73% confidence
• Finding: The skill explicitly instructs operators to write lifecycle change logs and maintain audit records, which can create session persistence of sensitive operational data such as agent IDs, pairing codes, channel details, workspace paths, or credential-inheritance events. In the context of agent lifecycle management, careless logging increases exposure because these records may later be read by other users, agents, or processes and used for reconnaissance or follow-on compromise.

Session Persistence

Medium

• Category: Rogue Agent

Content

- `openclaw`
- `jq`

## 1) Create agent workspace + registry

```bash
openclaw agents add <AGENT_ID> --workspace ~/.openclaw/workspace-<AGENT_ID>

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script copies an agent directory, per-agent workspace, and multiple OpenClaw status snapshots into a timestamped archive on disk without any notice, confirmation, minimization, or access-control checks. In the context of an agent lifecycle manager, these locations are likely to contain credentials, configuration secrets, prompts, logs, or user data, so silent archival increases the risk of sensitive data retention and later disclosure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code performs file-writing operations by redirecting command output into status files and later rewrites a markdown report, but the script provides no disclosure before modifying files in the user-supplied root directory. For a code file, safety-relevant writes should have some visible warning, confirmation, or documented notice when they may affect user data or workspace state.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The openclaw status commands retrieve system and agent information and save it to local JSON files, which may include workspace and identity details. There is no prompt, warning, or explanatory comment indicating that operational metadata will be gathered and stored.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The script hardcodes Chinese text in the generated markdown output, which imposes a specific language on users regardless of their locale or preferences. The policy allows locale constraints only when user choice is offered or the restriction is clearly documented and justified.

Static analysis

No suspicious patterns detected.