Research Queue

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:08 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a coherent research-queue helper, but its starter queue can direct an automated agent to inspect a hidden OpenClaw configuration file without clear approval or redaction rules.

Review the starter template before using automation. Remove or replace the Q0001 example that links to ~/.openclaw/openclaw.json, avoid granting exec unless a specific question needs it, and do not let autonomous runs read hidden config or credential-like files unless you have explicitly approved the path and how results may be recorded.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/queue-format.md:24

Finding

Autonomous Research Template Permits Unnecessary Access to Sensitive Agent Configuration

Content

View full analysis

Vulnerability Details

File Location: references/queue-format.md, lines 24–28
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code

md

- allowedTools: read, exec, web_search, web_fetch
- successCriteria: identify the cause or confirm it is an upstream bug/regression
- memoryNote:
- links:
  - ~/.openclaw/openclaw.json

Technical Analysis

The canonical starter question authorizes local read and exec capabilities while directing the research agent to ~/.openclaw/openclaw.json. This hidden home-directory configuration file may contain sensitive provider, runtime, model, tool, or integration settings.

Access to this configuration is not necessary for the Skill's general queue-management functionality. The Skill also does not require explicit user approval before accessing hidden configuration files, restrict reads to specific non-sensitive fields, or require redaction before findings are written to QUESTIONS.md or durable memory.

The combination is especially relevant because the Skill supports autonomous OpenClaw cron runs. A scheduled agent turn could select the example question and inspect the configuration without contemporaneous user review. No instruction to exfiltrate the file or execute data obtained from it was found, so the confirmed risk is unnecessary sensitive-resource access rather than confirmed data theft or arbitrary code execution.

Attack Path

1. The Skill initializes a missing QUESTIONS.md using the canonical template.
2. The included Q0001 example remains an active, high-priority question.
3. A manual or user-requested scheduled research pass selects that question.
4. The agent follows the links field and accesses ~/.openclaw/openclaw.json through the authorized read or exec tool.
5. Sensitive configuration-derived information may be summarized in the queue's evidence or conclusion fields.

...[truncated 858 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove ~/.openclaw/openclaw.json from the canonical starter example and replace it with a synthetic fixture or clearly non-sensitive documentation path.
2. Do not add starter examples as active research tasks unless the user explicitly requests them. Prefer an empty queue for first-use initialization.
3. Require explicit user approval before reading hidden files, home-directory configuration, credential stores, environment files, or other potentially sensitive resources.
4. Replace broad exec access with read when code execution is not essential to the selected question.
5. If configuration inspection is explicitly authorized, restrict access to named, non-secret fields and prohibit copying raw configuration content into queue evidence, conclusions, logs, or memory files.
6. Add mandatory secret-redaction rules covering API keys, tokens, credentials, provider secrets, personal identifiers, and integration endpoints.
7. For autonomous cron runs, reject questions requiring sensitive local-resource access unless prior approval and an explicit allowlist are recorded in the question.
8. Keep scheduled research isolated and bounded, and provide users with a clear way to inspect, disable, or delete each OpenClaw cron job.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/automation.md (reported line 29)May include surrounding context.

Use a short prompt and rely on the skill + QUESTIONS.md structure:

text

Run one bounded research-queue pass. Read `skills/research-queue/SKILL.md` and `QUESTIONS.md`. If the queue is missing, initialize it per the skill. Select at most one `open` question, investigate with allowed tools only, update the question in place, and write durable findings to `memory/YYYY-MM-DD.md` when warranted. Prefer OpenClaw-native tools and keep the run bounded.

Session target

Static analysis

No suspicious patterns detected.