AI Harness Engineering

• Outcome: Review
• Latest audit: May 28, 2026 · 3:00 PM UTC
• Version: 1.0.0

Overview

The skill is not malicious, but it creates an always-on local memory that can automatically store conversation-derived content and write it into persistent agent instruction files.

Install only if you want an always-on self-improvement memory for OpenClaw. Before enabling it, disable or manually review auto-promotion, avoid recording secrets or proprietary details, periodically inspect and prune the JSONL ledgers, and require approval before anything is written into SOUL.md, AGENTS.md, TOOLS.md, or MEMORY.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill defines persistent data storage, cron tasks, and multiple scripts that read and write local files, but it does not declare permissions. That mismatch weakens governance and review because operators may not realize the skill can persist and mutate workspace data, including conversation-derived ledgers.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script does more than maintain an internal error ledger: it writes distilled content into agent governance files under ~/.qclaw/workspace such as AGENTS.md, SOUL.md, and MEMORY.md. Because this content is derived from ledger entries and then persisted into instruction-bearing files, it creates a privilege/behavior modification path where stored data can silently influence future agent behavior beyond the original skill scope.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code can append to agent-wide instruction and memory files in the user's home workspace, which are high-trust artifacts likely consumed by other sessions or components. This is dangerous because any incorrect, adversarial, or overbroad learning entry can become durable policy or memory, effectively escalating the influence of ordinary logged data into persistent agent instructions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documented commands explicitly record questions, wrong answers, correct answers, reasons, and contextual details into persistent local JSONL ledger files, but the package text does not warn users that potentially sensitive prompts, personal data, secrets, or proprietary code may be stored on disk. In a skill designed to automatically log errors and inject summaries into future sessions, this omission increases privacy and data-handling risk because users may unknowingly persist sensitive conversational content.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The detection rules include vague natural-language conditions like user corrections, unknown information, and command failures, then instruct the system to immediately record content. In this skill's context, ambiguous triggers directly feed a persistent ledger, increasing the chance of storing sensitive or irrelevant user data without clear consent.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The quick-reference trigger lists are very broad and lack exclusion conditions, making normal conversation likely to be interpreted as a request to persist information. Because this skill stores and later reuses recorded material, false activations can become a privacy and data-retention issue rather than a mere UX flaw.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script prints a synthesized summary derived from local error and learning ledgers directly to stdout for automatic context injection, and those records may contain sensitive prompts, user corrections, internal mistakes, or other session-derived content. In this skill's context, the summary is explicitly intended to be auto-injected at session start, which increases the chance of unintended disclosure across sessions or to users/operators who did not consent to that data being surfaced.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The auto_promote path performs automatic file modifications based on candidate selection logic without any interactive confirmation, advance notice, or approval checkpoint. In the context of a skill that records user corrections and feature requests, this makes the issue more dangerous because routine feedback can be transformed into persistent workspace instructions automatically, enabling silent behavior drift or policy poisoning.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script persists user-provided feature names and context to a JSONL ledger without any notice, consent, minimization, or redaction. In this skill’s context, users may submit corrections, bug reports, or feature requests that contain sensitive operational details, personal data, or proprietary information, so silent retention increases privacy and data-handling risk.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly says it will auto-read prior error summaries into context at session start and query historical ledgers before each answer. This creates a natural-language data leakage path where one user's conversation-derived content can be surfaced in later sessions or responses, especially if summaries or 'correct answers' contain sensitive details.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The ledger schemas include raw question text, wrong answers, correct answers, detailed context, and user-request context, and the workflow says to write them to persistent JSONL files. Persisting rich conversation content like this materially raises the risk of storing personal, proprietary, or secret information that may later be exposed through queries, reports, promotion into workspace files, or prompt injection into future interactions.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Automatic session-start summary injection and answer-time retrieval create a direct mechanism for previously recorded conversation material to influence future outputs. In practice, that can disclose prior user information, contaminate later prompts with unrelated private context, and spread sensitive data into responses or workspace artifacts.

Session Persistence

Medium

• Category: Rogue Agent

Content

cp -r harness-engineering/ ~/.qclaw/skills/

# 2. 创建数据目录
mkdir -p ~/.qclaw/skills/harness-engineering/data/

# 3. 创建空数据文件
touch ~/.qclaw/skills/harness-engineering/data/error_ledger.jsonl

• Confidence: 88% confidence
• Finding: The skill instructs installation into a persistent home-directory path and creates long-lived data files for errors, features, and learnings. Persistence itself is expected for this feature, but in this context it increases privacy and retention risk because conversation-derived data survives across sessions and can be queried or injected later.

Static analysis

No suspicious patterns detected.