T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:17- Finding
Global Agent Role and Session-Control Instruction Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawDoctor
Security checks for vulnerabilities and agentic risk
Overview
This cost-analysis skill is useful in purpose, but it needs review because it can read private chat histories and change fleet settings with weak confirmation controls.
Install only if you are comfortable giving this skill access to fleet usage data and selected chat histories. Run it manually first, avoid daily cron until consent and retention expectations are clear, and do not let it apply fixes unless you have reviewed the exact patch, affected agents, global impact, and rollback plan.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:68- Finding
Mandatory Fleet-Wide Retrieval and Analysis of Sensitive Chat Histories
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:200- Finding
Ambiguous Approval Can Trigger High-Impact Fleet Configuration Changes
- Content
View full analysis
}' --json --timeout 10000 ``` After applying, confirm naturally with dollar savings. Update pending-fixes.json to mark applied. ``` The referenced payload file permits broad changes: ```markdown | Set tool budget (50 calls) | `{"agents":{"defaults":{"toolBudget":50}}}` | | Set session timeout (5 min) | `{"agents":{"defaults":{"sessionTimeout":300}}}` | | Set session timeout (1 hour) | `{"agents":{"defaults":{"sessionTimeout":3600}}}` | | Enable prompt caching | `{"gateway":{"promptCaching":{"enabled":true}}}` | | Add conciseness instruction | `{"agents":{"list":[{"id":"","systemPrompt":{"append":"Be concise. Under 500 tokens unless asked."}}]}}` | | Switch heartbeat to budget model | `{"agents":{"defaults":{"heartbeat":{"model":"google/gemini-2.5-flash-lite"}}}}` | ``` ### Technical Analysis The Skill treats short, context-dependent phrases such as “sure” or “yeah do that” as authorization to execute configuration changes. It also permits “do all of them” to apply every pending configuration patch. Some available patches modify global agent defaults or gateway behavior rather than only the agent associated with a finding. The affected settings include: - Default tool-call budgets. - Default session timeouts. - Agent model ...[truncated 2231 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The 'ONLY a cost analyst' language conflicts directly with instructions to perform
config.patchoperations later in the skill. This kind of self-contradictory scope definition increases the chance of unsafe delegation because the skill appears narrower than it really is.- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is presented as an analyzer/coach, but later instructs the agent to apply live configuration changes through
config.patch. That creates a capability mismatch: a user may invoke or install it expecting read-only analysis, while it can mutate fleet configuration and operational state.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The scope lock says the skill is 'ONLY a cost analyst', but the workflow includes writing memory files and modifying configuration. This contradiction can mislead users and reviewers about the true privileges and side effects of the skill.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash openclaw gateway call sessions.usage --params '{"startDate":"YYYY-MM-DD","endDate":"YYYY-MM-DD","limit":200}' --json --timeout 15000CHECKPOINT: You MUST now have a sessions[] array. If empty, write memory/last-analysis.json with zero findings and STOP.
STEP 3b: COST ESTIMATE (show before proceeding)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill treats broad conversational phrases like 'yeah do that', 'sure', and 'do all of them' as authorization to apply fixes. Ambiguous natural-language triggers can cause unintended configuration changes, especially in multi-turn conversations where referents are unclear.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to apply configuration patches without requiring an explicit warning that system configuration will be modified. Users may not realize they are authorizing state-changing actions, increasing the risk of accidental or surprising changes.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation explicitly instructs the skill to apply live configuration changes through an exec-driven
config.patchcall, which materially expands behavior from passive analysis/coaching into active modification of fleet settings. In an agent context, operational docs often become execution guidance, so this creates a real risk of unauthorized or unexpected changes to models, budgets, timeouts, or prompts if the skill consumes or follows this reference.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file instructs writing
memory/pending-fixes.jsonandmemory/last-analysis.jsonafter every run without any warning or consent mechanism for modifying local data. Even if the data seems operationally harmless, silent persistence can surprise users, leak sensitive cost or agent metadata, and violate least-surprise expectations for an analysis tool.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction "You speak in plain English" imposes a language constraint for all users. There is no opt-in, locale selection, or justification that this is a region-specific skill, so it conflicts with the policy against forcing a specific language without user choice.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The state-file instructions direct the skill to persist data after every report and run, which goes beyond a purely analytical coach and introduces side effects on the local environment. While lower severity than direct config changes, undocumented persistence can create privacy, integrity, and operational issues, especially if users expect read-only analysis.
- Content
Static analysis
No suspicious patterns detected.