Security audit

Agent Self Reflection 1.0.0

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent self-reflection purpose, but it reads private session history and can persist lessons into future agent instructions without enough review controls.

Review before installing. This skill should only be used if you are comfortable with a scheduled job reading recent OpenClaw transcripts, including direct and group sessions, and with transcript-derived summaries potentially changing memory and instruction files. Prefer a dry-run or review workflow, restrict eligible sessions, redact secrets and personal data, and require approval before changes to AGENTS.md, TOOLS.md, MEMORY.md, or any SKILL.md file.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:51
Finding: Untrusted Session Content Can Poison Persistent Agent State
Content: View full analysis
/SKILL.md` - Improvements to specific skill instructions - Bug fixes in skill workflows - New parameters or approaches for a skill ### → `MEMORY.md` - Updates to the memory index if new memory files are created ## Step 5: Write the Insights For each insight, append or edit the appropriate file. Use the `Edit` tool for surgical changes to existing content. Use append (write to end) for daily memory files. ``` ### Technical Analysis Session transcripts contain attacker-influenced user messages. The skill directs the agent to interpret these messages as potential lessons and then write the resulting insights into persistent, behavior-governing files such as `AGENTS.md`, `TOOLS.md`, `MEMORY.md`, and other skills' `SK ...[truncated 1983 chars]
Remediation: View remediation

other

Warning

Location: scripts/summarize-sessions.sh:15
Finding: Broad Collection and Secondary Persistence of Sensitive Session History
Content: View full analysis
/dev/null) ``` ```python # Find the session file jsonl_path = os.path.join(sessions_dir, f'{session_id}.jsonl') if not os.path.exists(jsonl_path): # Try topic variants candidates = [f for f in os.listdir(sessions_dir) if f.startswith(session_id) and f.endswith('.jsonl') and not '.deleted.' in f] if candidates: jsonl_path = os.path.join(sessions_dir, candidates[0]) else: continue # Read last N lines try: result = subprocess.run(['tail', '-n', str(max_lines), jsonl_path], capture_output=True, text=True, timeout=5) lines = result.stdout.strip().split('\n') except Exception: continue ``` The related skill instructions state: ```markdown # List sessions active in the last 2 hours openclaw sessions --active 120 --json ``` ```bash # Read the last ~50 lines of each session file (keep it bounded!) tail -50 ~/.openclaw/agents/main/sessions/.jsonl ``` ### Technical Analysis The skill systematically enumerates active sessions and reads transcript tails from the primary agent's session directory. These transcripts can contain private conversations, personal information, secrets pasted by users, command output, and sensitive tool errors. The reads are bounded to 50 lines, and the reviewed code contains no network transmission. Nevertheless, the workflow processes multiple session classes—including direct and group conversations—and subsequently permits derived information to be writt ...[truncated 1544 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/summarize-sessions.sh:30
Finding: Self-Reflection Cron Sessions Are Not Excluded as Documented
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The stated purpose is reflective analysis and writing concise insights to workspace files, but the behavior includes enumerating active sessions and reading transcript files from a user directory, which materially expands access to potentially sensitive data. When a skill's real data access and outputs differ from its declared purpose, users and policy layers may authorize it under false assumptions, enabling privacy-invasive behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes shell and file-reading behavior (openclaw sessions, tail on session transcripts) without declaring an explicit tool scope or permission boundary. In a cron-triggered skill that inspects historical conversations, missing scope increases the chance of unintended access to sensitive local data and makes operator review of capabilities harder.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is designed to append or edit multiple workspace and memory files persistently, yet it gives no user-facing warning that running it can modify stored project data. In a scheduled cron context, silent persistent writes can accumulate inaccurate, privacy-sensitive, or undesired changes without a clear consent or review checkpoint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions direct surgical edits and appends across AGENTS.md, TOOLS.md, MEMORY.md, daily memory files, and other skill files without a safety gate, provenance controls, or notice about cross-workspace persistence. Because the source material is prior session transcripts, this can propagate mistakes, sensitive user details, or prompt-injected content into durable files that influence future agent behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script prints recent user/assistant exchanges from session transcripts directly to stdout, which can expose sensitive prompts, secrets, personal data, or internal operational details to whatever process, log sink, or user consumes the cron job output. In this skill's context, the behavior is intentional for self-reflection, but it still creates a real confidentiality risk because cron-driven background jobs often write to logs or shared monitoring systems without strong access controls.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.