Agent Lifecycle Manager

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:54 AM UTC
• Version: 0.1.2

Overview

This skill is mostly purpose-aligned for OpenClaw agent lifecycle work, but its helper scripts handle sensitive local agent files and credentials with unsafe path and temporary-file practices.

Review before installing. Use only with trusted operators and trusted agent IDs, avoid passing real Telegram tokens on the command line, restrict archive locations and permissions, and patch the scripts to validate agent IDs, use mktemp/private temp paths, and redact or minimize archived status and workspace data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/archive-agent.sh:9

Finding

Path Traversal Through an Unvalidated Agent Identifier

Content

View full analysis

/dev/null || true cp -a "$HOME/.openclaw/workspace-$AGENT_ID" "$OUT/workspace" 2>/dev/null || true ``` ### Technical Analysis `AGENT_ID` is incorporated directly into both source and destination filesystem paths. The script does not restrict the identifier to an expected character set, canonicalize the resulting paths, or verify that the paths remain beneath the intended OpenClaw and archive directories. An identifier containing traversal components such as `../` can therefore escape the expected directories. For example, the source path: ```text $HOME/.openclaw/agents/../../.ssh ``` normalizes to a directory outside `$HOME/.openclaw/agents`. The destination is similarly constructed from untrusted input. Suppressing copy errors with `2>/dev/null || true` also allows the script to continue after a failed or partial copy, potentially creating an archive that appears successful but is incomplete. ### Attack Path 1. An attacker or untrusted automation supplies a crafted agent identifier to `archive-agent.sh`. 2. The identifier contains traversal sequences, such as `../../.ssh`. 3. `mkdir` resolves the traversal components while creating the archive destination. 4. `cp -a` resolves the crafted source path outside the intended OpenClaw agent directory. 5. User-readable sensitive files are copied into the archive destination. 6. If the archive directory is exposed to another user or process, the copied information can be retrieved from there. ### Impact Assessment The script does not itself elevate privileges, so access is limited to files readable ...[truncated 433 chars]

Remediation

View remediation

&2 exit 1 fi ``` 2. Canonicalize source and destination paths with `realpath` or an equivalent mechanism. 3. Verify that the canonical source remains beneath `$HOME/.openclaw/agents` or the expected workspace root. 4. Verify that the canonical destination remains beneath the configured archive root. 5. Reject absolute paths, path separators, `.` components, and `..` components in identifiers. 6. Remove `|| true` from archive copy operations. If an optional source does not exist, test that condition explicitly; otherwise, fail on copy errors. 7. Record which source directories were successfully archived and verify their presence before declaring the archive successful. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/delete-agent-safe.sh:114

Finding

Predictable Temporary File Permits Symlink-Based File Clobbering

Content

View full analysis

/tmp/openclaw.agent-delete.$AGENT_ID.json ``` ### Technical Analysis The deletion result is written to a predictable filename in the shared `/tmp` directory. The file is opened through ordinary shell redirection without exclusive creation, ownership verification, restrictive permissions, or symlink protection. A local attacker who can predict the agent identifier may pre-create the destination as a symbolic link. On systems where the operating system's temporary-directory symlink protections do not prevent the operation, shell redirection follows the link and truncates or overwrites its target. Using the unvalidated `AGENT_ID` in the filename also allows path separators or traversal components to influence the output path, subject to whether such an identifier passes the preceding OpenClaw agent-existence check. ### Attack Path 1. A local attacker learns or predicts the identifier of an agent that an operator will delete. 2. The attacker creates `/tmp/openclaw.agent-delete..json` as a symbolic link to another file. 3. The operator runs `delete-agent-safe.sh` under an account that can write the symlink target. 4. Shell redirection opens the predictable path before starting `openclaw`. 5. If platform symlink protections permit it, the target file is truncated and then receives the JSON deletion output. ### Impact Assessment The attack does not grant direct privilege escalation, but it can overwrite or corrupt any file writable by the account running the script. If a privileged operator invokes the script, the scope increases to files writable by that privileged account. Possible consequences include denial of service, corruption of configuration or application state, ...[truncated 194 chars]

Remediation

View remediation

"$DELETE_RESULT" ``` 2. Do not derive temporary filenames from untrusted identifiers. 3. Set a restrictive `umask`, such as `umask 077`, before writing potentially sensitive output. 4. If the deletion output must be retained, move it from the private temporary directory to a validated destination using an atomic operation. 5. Apply the same strict agent-ID validation recommended for all other scripts. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create-telegram-agent.sh:23

Finding

Telegram Bot Token Exposed Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/lifecycle-log.sh:9

Finding

Unescaped Values Permit Markdown Log and Dashboard Injection

Content

View full analysis

> "$LOG_FILE" ``` ```bash jq -r '.agents[] | [ .id, (.name // "-"), (((.identityEmoji // "") + " " + (.identityName // "-")) | gsub("^ ";"")), (.workspace // "-"), (.model // "-"), (if .heartbeat.enabled then .heartbeat.every else "disabled" end), (if .isDefault then "yes" else "no" end) ] | @tsv' "$REGISTRY_JSON" | while IFS=$'\t' read -r id name ident ws model hb def; do printf "| %s | %s | %s | %s | %s | %s | %s |\n" "$id" "$name" "$ident" "$ws" "$model" "$hb" "$def" >> "$ROOT/AGENT_STATUS.md" done ``` ### Technical Analysis Lifecycle arguments and agent metadata are written directly into Markdown table rows without escaping Markdown delimiters, line breaks, HTML fragments, or link syntax. An attacker-controlled value containing a pipe character can create additional columns. A value containing a line break can terminate the current row and insert arbitrary Markdown content or forged table entries. Depending on the Markdown renderer, embedded HTML or crafted links may also produce deceptive rendered content. The lifecycle log is intended to act as an audit record, making output integrity particularly important. The dashboard has a similar trust issue because generated content may be treated as an authoritative representation of agent status. ### Attack Path 1. An attacker supplies or causes OpenClaw to store crafted agent metadata, or provides a crafted action, agent ID, summary, or operator value to `lifecycle-log.sh`. 2. The value contains Markdown delimiters, line breaks, links, or HTML-like content. ...[truncated 817 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This is a clear description-behavior mismatch. The implementation is narrowly scoped to logging lifecycle events to a file. While lifecycle logging is one declared sub-capability, the overall declared purpose emphasizes broad lifecycle operations and maintenance tasks that are absent from the code. The code does not interact with agents, node services, configuration, credentials, dashboards, or deletion/archive operations, so its actual behavior is materially narrower than the declared primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code’s actual behavior is narrowly focused on status collection and dashboard generation. It reads current OpenClaw state via CLI commands, merges heartbeat and agent-list data into JSON, and renders a markdown table. While this does match the declared sub-capability of refreshing status dashboards, the declared description presents the skill as a full lifecycle management tool with mutation and audit functions that are absent from the code shown. This is a material description/behavior mismatch because the primary declared scope is much broader than the implementation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 73% confidence

Finding

The skill explicitly instructs operators to write lifecycle change logs and maintain audit records, which can create session persistence of sensitive operational data such as agent IDs, pairing codes, channel details, workspace paths, or credential-inheritance events. In the context of agent lifecycle management, careless logging increases exposure because these records may later be read by other users, agents, or processes and used for reconnaissance or follow-on compromise.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: agent-lifecycle-manager
description: "Manage full OpenClaw agent lifecycle operations on a node: create/register agents, configure channel bindings, optionally inherit credentials with explicit consent, approve pairing, archive and delete agents, refresh status dashboards, and write lifecycle change logs. Use when a user asks to onboard a new agent, reconfigure an existing agent, retire/archive/delete agents, or maintain agent status boards and lifecycle audit records."
metadata:
  {
    "openclaw": {

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/openclaw-agent-lifecycle-playbook.md (reported line 10)May include surrounding context.

• openclaw
• jq

1) Create agent workspace + registry

bash

openclaw agents add <AGENT_ID> --workspace ~/.openclaw/workspace-<AGENT_ID>

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script copies an agent directory, per-agent workspace, and multiple OpenClaw status snapshots into a timestamped archive on disk without any notice, confirmation, minimization, or access-control checks. In the context of an agent lifecycle manager, these locations are likely to contain credentials, configuration secrets, prompts, logs, or user data, so silent archival increases the risk of sensitive data retention and later disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code performs file-writing operations by redirecting command output into status files and later rewrites a markdown report, but the script provides no disclosure before modifying files in the user-supplied root directory. For a code file, safety-relevant writes should have some visible warning, confirmation, or documented notice when they may affect user data or workspace state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The openclaw status commands retrieve system and agent information and save it to local JSON files, which may include workspace and identity details. There is no prompt, warning, or explanatory comment indicating that operational metadata will be gathered and stored.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script hardcodes Chinese text in the generated markdown output, which imposes a specific language on users regardless of their locale or preferences. The policy allows locale constraints only when user choice is offered or the restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.