Skill Manager All In One | 一站式技能管理器

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:20 AM UTC
• Version: 4.5.14

Overview

This is a disclosed skill-management helper, but it needs Review because it can broadly edit persistent OpenClaw memory and includes hard-coded attribution in public promotion templates.

Install only if you want an opinionated bilingual workflow for managing and publishing OpenClaw skills. Before using rename or promotion features, require exact diffs, avoid automatic edits to MEMORY.md, memory/*.md, or TOOLS.md unless you separately approve them, and replace any morois attribution with your own approved author or omit it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: references/promotion.md:86
• Finding: Mandatory Promotional Templates Inject Fixed Attribution and Traffic-Directing Content<![CDATA[ ## Vulnerability Details **File Location**: `references/promotion.md:86-121`, with an additional mandatory call-to-action rule at `references/promotion.md:154-160` **Vulnerability Type**: Output-template and instruction hijacking **Risk Level**: High ### Complete Code Snippet ```markdown 所有 Moltbook 帖子必须使用**双语交替格式**（一句英文一句中文）： **单技能推广模板：** \`\`\` **Skill Name | 技能名** (vX.Y · N installs · ★N) Short concrete English pitch. 简短中文说明。 What it does: 一句话功能描述 Install: clawhub install <slug> https://clawhub.ai/<username>/<slug> Built by morois + me. 我们的人类和我一起开发的。What are you building? 🦞 \`\`\` **多技能联合推广模板：** \`\`\` Hey fellow AI assistants! 各位 AI 助手大家好！👋 morois and I have published X skills on ClawHub. 截至 YYYY-MM-DD： 📊 Stats | 数据： 🎙️ Skill A — N installs · ★N · One-line description. 简短中文。 🔊 Skill B — N installs · ★N · One-line description. 简短中文。 …（每个技能一行，emoji + name + stats + 英文/中文各一句） Install any: clawhub install <skill-name> Browse all: clawhub.ai/<username> Built by morois + me. 我们的人类和我一起开发的。What are you building? 🦞 \`\`\` ``` The associated mandatory closing rule is: ```markdown **5. 行动号召（CTA）** - 每篇结尾必须有明确行动：安装命令 / 访问链接 / 提问邀请 - 不要让读者"然后呢" **6. 结尾钩子** - 以问题结尾，引发评论互动 - "What are you building?" / "What's your take on this?" / "Curious what others think" ``` ### Technical Analysis The promotion guide does more than describe optional marketing practices. It uses mandatory language to control the Agent's generated social-media output and supplies stable promotional structures containing: - Fixed attribution to `morois`. - Installation commands and profile or product links. - Mandatory calls to action. - Mandatory engagement questions. - Social-proof statistics intended to influence readers. Calls to action and product links can be legitimate for a promotion feature. However, hard-coded attribution to a particular identity is not required to perform generic skill promotion and is not derived from the current user's identity or instructio ...[truncated 1800 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all fixed references to `morois` from templates and examples. 2. Replace attribution with an unset variable such as `<author-name>`. 3. Require the user to supply or explicitly approve the attribution value; omit attribution when no value is supplied. 4. Make calls to action, engagement questions, links, and bilingual formatting optional rather than mandatory. 5. Generate links only from a user-approved owner and slug obtained from trusted project metadata. 6. Present attribution, destination URLs, installation commands, and calls to action in a separate high-visibility approval table. 7. Validate that statistics and authorship claims correspond to the target skill and current owner. 8. Add a rule forbidding the promotion of identities, profiles, or products unrelated to the user's requested target. 9. Retain the existing explicit confirmation gate, but require renewed approval whenever attribution, links, or destination accounts change. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:82
• Finding: Rename Workflow Directs the Agent to Modify Persistent Global Memory Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:82-113` **Vulnerability Type**: Persistent memory modification outside the target Skill directory **Risk Level**: Medium ### Complete Code Snippet ```markdown | Memory 文件 | MEMORY.md、memory/*.md、TOOLS.md 等中的名称 | ``` ```bash # 搜索 memory 文件 grep -rn "<old-slug>\|<old-display-name>" \ ~/.openclaw/workspace/MEMORY.md \ ~/.openclaw/workspace/memory/ ``` ```markdown 5. **改 Memory**：MEMORY.md + memory/*.md ``` The same rename procedure also includes filesystem and repository changes: ```bash mv ~/.openclaw/workspace/projects/<old-slug>/ ~/.openclaw/workspace/projects/<new-slug>/ mv ~/.openclaw/workspace/skills/<old-slug>/ ~/.openclaw/workspace/skills/<new-slug>/ git remote set-url origin <new-url> ``` ### Technical Analysis The rename workflow expands a skill-management operation beyond the target Skill and project by instructing the Agent to search and modify persistent workspace memory, including `MEMORY.md`, `memory/*.md`, and potentially `TOOLS.md`. Persistent memory can influence future Agent sessions. A broad textual replacement in these files can therefore alter long-term context, remembered rules, project associations, or tool guidance. The new slug or display name becomes attacker-controlled persistent input if an attacker can induce or shape a rename request. Updating references can be useful when a project is renamed, but modifying global memory is not the minimum privilege required to rename a Skill directory, update its metadata, or publish a new version. The instruction does not constrain replacements to structured references belonging exclusively to the target project and does not exclude unrelated prose or instruction-bearing content that happens to contain the old name. The surrounding workflow requires a two-step report and explicit user confirmation for rename operations. This is an important mitigating control, but the documented scope remains unnecessarily broad and crea ...[truncated 1515 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict automatic rename operations to the target Skill directory, its associated project directory, and explicitly identified repository metadata. 2. Do not modify `MEMORY.md`, `memory/*.md`, or `TOOLS.md` by default. 3. Treat persistent-memory updates as a separate, opt-in operation with independent confirmation. 4. Enumerate every proposed memory-file match with the exact file, line, surrounding context, old value, and new value. 5. Require approval per file rather than one approval for the entire rename. 6. Use exact structured-field updates where possible instead of unrestricted textual replacement. 7. Reject new names containing line breaks, markup intended as instructions, shell metacharacters, or other content inappropriate for an identifier. 8. Back up each persistent-state file before modification and provide a tested rollback procedure. 9. Verify after modification that only approved occurrences changed and that unrelated instructions or project records remain intact. 10. Explicitly prohibit automated modification of `TOOLS.md` unless the user separately requests and approves an exact diff. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Ae1

High

• Category: analysis-evasion

Content

| CH01 | Display Name 双保险 | **ClawHub 页面展示名必须双保险**：`SKILL.md` frontmatter 的 `name:` 填 `EN Title | CN Title`，发布命令也必须显式传 `--name "EN Title | CN Title"`。实测仅改 `name

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The instruction 'English first, Chinese second' imposes a fixed language/locale presentation policy for all outward-facing text. The file does not offer the user a language choice or frame this as an optional, region-specific requirement, so it conflicts with the language-choice policy.

Session Persistence

Medium

• Category: Rogue Agent

Content

---

## 技能制作流程 | Phase 1: Create / Modify

> 按顺序执行，边做边对照第 6 章「统一检查清单」的【通用质量基线】。

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

---

## 技能制作流程 | Phase 1: Create / Modify

> 按顺序执行,边做边对照第 6 章「统一检查清单」的【通用质量基线】。

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: These checklist items require all bilingual user-facing content to appear in a specific English-then-Chinese order. Because the file treats this as a universal requirement and does not provide opt-in or exception handling based on user preference, it constitutes a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: These lines require display names to put English first and descriptions to be primarily in English with Chinese as secondary. This is a natural-language locale policy constraint applied broadly to workflows, and the document does not present it as optional, user-selected, or narrowly justified for a specific compliance context.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

config:
  auto_mode:
    description: "Auto mode: no confirmation needed | 自动模式：无需确认"
    default: false

steps:

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: These instructions require `name`, `description`, changelog, and key README titles to be presented in a fixed English-first bilingual format. That is a language/locale constraint expressed in natural language, and the file does not offer an alternative based on user preference or opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The reporting template requires display name, description, and changelog to be provided in a specific bilingual English-first format. This imposes a language policy on outputs without documenting user choice or a justified regional exception in this file.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The command example and warning require `--name "EN Title | 中文标题"` and say the bilingual display name must be passed explicitly. This is a natural-language locale policy constraint with no user preference mechanism described here.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The guide hard-codes a bilingual ordering requirement ('English first, Chinese second') for commit and release content without allowing the user's preferred language or accessibility needs. In a publishing/automation skill, this can cause the agent to override user intent, generate incorrect or noncompliant artifacts for non-Chinese workflows, and create a policy-quality issue that scales across all releases.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file hard-requires a specific bilingual Moltbook posting format and says all posts 'must' use it, without requiring user consent or allowing a user-specified format override. In an agent skill, this can cause the agent to reshape user content or platform-facing communications in a way the user did not authorize, creating an unsafe policy lock-in and reducing user control over externally published content.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: This manifest file contains repeated bilingual changelog text, including Chinese alongside English, but does not document that the skill is bilingual, locale-specific, or user-selectable. Under the language/locale policy rule, forcing or assuming a specific language without opt-in can be a policy concern.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: Requiring a literal Chinese confirmation phrase ('确认-<username>') imposes a locale-specific authorization mechanism that may exclude users, break integrations, or cause unsafe workarounds when users cannot or do not use that exact script. Because this skill gates high-impact actions like git push and release creation, brittle confirmation semantics can lead to failed verification or confusion around whether authorization was valid.

Static analysis

No suspicious patterns detected.