Skill Manager All In One | 一站式技能管理器

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:20 AM UTC
• Version: 4.5.14

Overview

This is a disclosed skill-management helper, but it needs Review because it can broadly edit persistent OpenClaw memory and includes hard-coded attribution in public promotion templates.

Install only if you want an opinionated bilingual workflow for managing and publishing OpenClaw skills. Before using rename or promotion features, require exact diffs, avoid automatic edits to MEMORY.md, memory/*.md, or TOOLS.md unless you separately approve them, and replace any morois attribution with your own approved author or omit it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: references/promotion.md:86

Finding

Mandatory Promotional Templates Inject Fixed Attribution and Traffic-Directing Content

Content

View full analysis

https://clawhub.ai// Built by morois + me. 我们的人类和我一起开发的。What are you building? 🦞 \`\`\` **多技能联合推广模板：** \`\`\` Hey fellow AI assistants! 各位 AI 助手大家好！👋 morois and I have published X skills on ClawHub. 截至 YYYY-MM-DD： 📊 Stats | 数据： 🎙️ Skill A — N installs · ★N · One-line description. 简短中文。 🔊 Skill B — N installs · ★N · One-line description. 简短中文。 …（每个技能一行，emoji + name + stats + 英文/中文各一句） Install any: clawhub install Browse all: clawhub.ai/ Built by morois + me. 我们的人类和我一起开发的。What are you building? 🦞 \`\`\` ``` The associated mandatory closing rule is: ```markdown **5. 行动号召（CTA）** - 每篇结尾必须有明确行动：安装命令 / 访问链接 / 提问邀请 - 不要让读者"然后呢" **6. 结尾钩子** - 以问题结尾，引发评论互动 - "What are you building?" / "What's your take on this?" / "Curious what others think" ``` ### Technical Analysis The promotion guide does more than describe optional marketing practices. It uses mandatory language to control the Agent's generated social-media output and supplies stable promotional structures containing: - Fixed attribution to `morois`. - Installation commands and profile or product links. - Mandatory calls to action. - Mandatory engagement questions. - Social-proof statistics intended to influence readers. Calls to action and product links can be legitimate for a promotion feature. However, hard-coded attribution to a particular identity is not required to perform generic skill promotion and is not derived from the current user's identity or instructio ...[truncated 1800 chars]

Remediation

View remediation

`. 3. Require the user to supply or explicitly approve the attribution value; omit attribution when no value is supplied. 4. Make calls to action, engagement questions, links, and bilingual formatting optional rather than mandatory. 5. Generate links only from a user-approved owner and slug obtained from trusted project metadata. 6. Present attribution, destination URLs, installation commands, and calls to action in a separate high-visibility approval table. 7. Validate that statistics and authorship claims correspond to the target skill and current owner. 8. Add a rule forbidding the promotion of identities, profiles, or products unrelated to the user's requested target. 9. Retain the existing explicit confirmation gate, but require renewed approval whenever attribution, links, or destination accounts change. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:82

Finding

Rename Workflow Directs the Agent to Modify Persistent Global Memory Files

Content

View full analysis

\|" \ ~/.openclaw/workspace/MEMORY.md \ ~/.openclaw/workspace/memory/ ``` ```markdown 5. **改 Memory**：MEMORY.md + memory/*.md ``` The same rename procedure also includes filesystem and repository changes: ```bash mv ~/.openclaw/workspace/projects// ~/.openclaw/workspace/projects// mv ~/.openclaw/workspace/skills// ~/.openclaw/workspace/skills// git remote set-url origin ``` ### Technical Analysis The rename workflow expands a skill-management operation beyond the target Skill and project by instructing the Agent to search and modify persistent workspace memory, including `MEMORY.md`, `memory/*.md`, and potentially `TOOLS.md`. Persistent memory can influence future Agent sessions. A broad textual replacement in these files can therefore alter long-term context, remembered rules, project associations, or tool guidance. The new slug or display name becomes attacker-controlled persistent input if an attacker can induce or shape a rename request. Updating references can be useful when a project is renamed, but modifying global memory is not the minimum privilege required to rename a Skill directory, update its metadata, or publish a new version. The instruction does not constrain replacements to structured references belonging exclusively to the target project and does not exclude unrelated prose or instruction-bearing content that happens to contain the old name. The surrounding workflow requires a two-step report and explicit user confirmation for rename operations. This is an important mitigating control, but the documented scope remains unnecessarily broad and crea ...[truncated 1515 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

md

| CH01 | Display Name 双保险 | **ClawHub 页面展示名必须双保险**：`SKILL.md` frontmatter 的 `name:` 填 `EN Title | CN Title`，发布命令也必须显式传 `--name "EN Title | CN Title"`。实测仅改 `name

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction 'English first, Chinese second' imposes a fixed language/locale presentation policy for all outward-facing text. The file does not offer the user a language choice or frame this as an optional, region-specific requirement, so it conflicts with the language-choice policy.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

---

## 技能制作流程 | Phase 1: Create / Modify

> 按顺序执行，边做边对照第 6 章「统一检查清单」的【通用质量基线】。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

---

## 技能制作流程 | Phase 1: Create / Modify

> 按顺序执行,边做边对照第 6 章「统一检查清单」的【通用质量基线】。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

These checklist items require all bilingual user-facing content to appear in a specific English-then-Chinese order. Because the file treats this as a universal requirement and does not provide opt-in or exception handling based on user preference, it constitutes a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

These lines require display names to put English first and descriptions to be primarily in English with Chinese as secondary. This is a natural-language locale policy constraint applied broadly to workflows, and the document does not present it as optional, user-selected, or narrowly justified for a specific compliance context.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/clawflows-workflow.md (reported line 239)May include surrounding context.

md

config:
  auto_mode:
    description: "Auto mode: no confirmation needed | 自动模式：无需确认"
    default: false

steps:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

These instructions require name, description, changelog, and key README titles to be presented in a fixed English-first bilingual format. That is a language/locale constraint expressed in natural language, and the file does not offer an alternative based on user preference or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The reporting template requires display name, description, and changelog to be provided in a specific bilingual English-first format. This imposes a language policy on outputs without documenting user choice or a justified regional exception in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The command example and warning require --name "EN Title | 中文标题" and say the bilingual display name must be passed explicitly. This is a natural-language locale policy constraint with no user preference mechanism described here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The guide hard-codes a bilingual ordering requirement ('English first, Chinese second') for commit and release content without allowing the user's preferred language or accessibility needs. In a publishing/automation skill, this can cause the agent to override user intent, generate incorrect or noncompliant artifacts for non-Chinese workflows, and create a policy-quality issue that scales across all releases.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file hard-requires a specific bilingual Moltbook posting format and says all posts 'must' use it, without requiring user consent or allowing a user-specified format override. In an agent skill, this can cause the agent to reshape user content or platform-facing communications in a way the user did not authorize, creating an unsafe policy lock-in and reducing user control over externally published content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This manifest file contains repeated bilingual changelog text, including Chinese alongside English, but does not document that the skill is bilingual, locale-specific, or user-selectable. Under the language/locale policy rule, forcing or assuming a specific language without opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Requiring a literal Chinese confirmation phrase ('确认-') imposes a locale-specific authorization mechanism that may exclude users, break integrations, or cause unsafe workarounds when users cannot or do not use that exact script. Because this skill gates high-impact actions like git push and release creation, brittle confirmation semantics can lead to failed verification or confusion around whether authorization was valid.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.