T01 · Skill Instruction Hijacking
Error
- Location
engine/SOUL.md:1- Finding
Persistent Agent Identity and Behavior Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Daily Roleplay Game
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed adult roleplay skill, but it needs Review because it sets persistent agent behavior, sends recurring messages/images, uses private calendar or memory data, and includes unsafe scheduled archive scripting.
Install only if you intentionally want a Chinese-language adult roleplay workspace. Before enabling it, use a fixed private message channel instead of last, avoid putting heartbeat under agents.defaults, disable calendar/memory todo summaries unless you explicitly want them sent, review or patch wrapup.sh before scheduling it, and decide how to delete or protect archives containing generated images and roleplay state.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wrapup.sh:104- Finding
Arbitrary Python Code Injection Through Generated Profession Metadata
- Content
View full analysis
/dev/null && log "更新成就追踪" || log "成就追踪更新跳过（python3 不可用或解析失败）" ``` ### Technical Analysis `PROFESSION` originates in `roleplay-active.md`, a writable file generated and maintained by the agent. The shell script performs no syntax valid ...[truncated 2191 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wrapup.sh:40- Finding
Path Traversal and Unintended File Movement in Archive Processing
- Content
View full analysis
/dev/null | wc -l) if [[ "$IMAGE_COUNT" -gt 0 ]]; then mv "$MEDIA_DIR"/${MEDIA_PREFIX}*.png "$TODAY_IMAGES/" 2>/dev/null || true fi fi ``` The associated validator accepts arbitrary values: ```bash DATE_STR=$(grep "^date:" "$ACTIVE_FILE" | head -1 | sed 's/^date:[[:space:]]*//') PROFESSION=$(grep "^profession:" "$ACTIVE_FILE" | head -1 | sed 's/^profession:[[:space:]]*//') if [[ -n "$DATE_STR" ]] && [[ -n "$PROFESSION" ]]; then ARCHIVE_DIR="$WORKSPACE/archive/${DATE_STR}-${PROFESSION}" ``` ### Technical Analysis The script uses `PROFESSION` directly as part of a directory path and `MEDIA_PREFIX` as part of a pathname glob. Neither value is validated or canonicalized. A malicious profession containing path separators or traversal components can cause `TODAY_ARCHIVE` to resolve outside `$WORKSPACE/archive`. Quoting the combined variable prevents shell word splitting but does not prevent filesystem traversal. `MEDIA_PREFIX` is also inserted into an unquoted glob expression ...[truncated 1656 chars]- Remediation
View remediation
other
Error
- Location
data/templates/morning_greeting.md:3- Finding
Automated Disclosure of Calendar and Memory Data to Messaging Channels
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
openclaw.example.json5:5- Finding
Global Recurring Heartbeat Causes Cross-Agent Unsolicited Messaging
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (110)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 6. **定时任务** — 添加 6:00 初始化 + 23:30 收尾归档（见 docs/CRON_CONFIG.md）
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
�执行历史 openclaw cron remove # 删除任务
text --- ## 系统 Crontab（备选） 如不使用 OpenClaw cron，也可用系统 crontab 直接调用收尾脚本： ```bash 30 23 * * * <workspace-path>/scripts/wrapup.sh >> /tmp/roleplay-wrapup.log 2>&1将
<workspace-path>替换为实际 workspace 路径（如~/.openclaw/workspace-role-play）。注意：系统 crontab 只能执行 shell 脚本（收尾归档），无法触发 agent 执行初始化。每日 6:00 初始化必须通过 OpenClaw cron 或心跳手动触发。
前置条件
- 脚本已可执行：
chmod +x <workspace-path>/scripts/wrapup.sh - 目录权限正常
- OpenClaw Gateway 运行中（使用 OpenClaw cron 时）
- 脚本已可执行：
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow explicitly ties hidden sexual content to progressive rewards and penalties, including '脱衣+拍照' and stateful tracking of guesses, while forbidding disclosure of the underlying hidden state. This increases the risk of manipulative sexualized interaction, covert collection of intimate preference data, and escalation into non-consensual or unclear-consent behavior—especially because state is persisted and the user may not understand how the hidden mechanics operate.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README states that all daily data and images are automatically archived, but it does not disclose retention duration, storage location, access controls, or disk usage implications. In a skill that handles sensitive roleplay content and generated images, silent archival increases privacy risk and can expose intimate material if the workspace is shared, backed up, or later exfiltrated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The setup instructions say the script will automatically create an agent and workspace without clearly warning the user about filesystem changes or what resources will be modified. While this is common for installer scripts, undisclosed automation increases the chance of unintended local changes and makes review/consent weaker, especially in agent ecosystems that may have broad file access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README instructs users to place personal information and messaging-channel details into local files but provides no privacy or handling warning. Because this skill centers on sexual roleplay content and may integrate with messaging platforms and image tools, storing identity, preferences, and channel metadata in plaintext can materially increase exposure of sensitive personal data.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises shell, file read, and file write behavior via setup and maintenance scripts, but it does not declare an explicit tool scope or permissions boundary. That increases the chance an agent or user invokes filesystem and shell-capable actions without clear least-privilege constraints, especially because the skill installs files into the home directory and creates a separate workspace.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation instructs users to run setup scripts that create an agent, copy files, initialize runtime state, and deploy into ~/.openclaw/workspace-role-play, but it does not prominently warn that these commands modify the local filesystem. This can lead to unexpected persistence, overwriting of files, or unsafe execution of cloned scripts with the user's privileges.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill describes scheduled generation, archival, and outbound message/image sending, but it does not clearly warn users that data will be persisted and may be transmitted to external services or channels. In this context, the content includes highly sensitive sexual-roleplay metadata, making undisclosed storage and transmission more risky than a typical game skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This YAML contains user-facing natural-language fields such as comments, names, descriptions, rewards, and bonuses exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation, and this file does not indicate that the skill is intentionally region-specific or that users may choose another language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This YAML file’s natural-language comments, labels, and examples are all in Chinese, effectively forcing a specific language/locale for anyone using or maintaining the skill. The policy allows locale constraints only when they are optional or clearly justified, but this file provides no user choice or justification for the language restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This YAML manifest uses Chinese throughout comments and natural-language descriptions, effectively forcing a specific language for users or maintainers who interact with the skill metadata. The file does not indicate that the skill is China-specific or provide any opt-in or alternative locale, which matches the language/locale policy violation criteria.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest explicitly instructs the system to ingest a user's schedule/todo data from external personal sources and use that information to influence roleplay generation. That creates unnecessary collection and secondary use of private data for a sexualized entertainment feature, increasing privacy risk and the chance of overcollection beyond what is needed for core functionality.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to read a user's daily schedule/todo summary and feed it into content generation is a plain-language directive to process private personal data. In this skill's context, that data is used to personalize NSFW roleplay outputs, which heightens sensitivity and creates privacy, consent, and data-minimization concerns.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The generation flow operationalizes collection and reuse of schedule/todo data to steer model behavior, turning personal planning information into a personalization signal. Because the skill is a roleplay engine with sexual-content elements, this secondary use materially increases the privacy sensitivity of the data handling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file content is entirely authored in Chinese and contains no mechanism for locale negotiation, fallback text, or user opt-in, so users who do not understand that language may receive opaque or misleading sexualized prompts. In this skill’s context, that is more dangerous than a normal localization issue because the content drives roleplay behavior and consent-adjacent interactions; misunderstanding the prompts can cause inappropriate or unexpected sexual content generation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This YAML file’s natural-language fields, including the category, description, and all hint text, are entirely in Chinese. Under the policy rule for language/locale, forcing a specific language without user opt-in is a violation unless the locale restriction is explicitly documented and justified, which is not present here.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The keyword set at this location includes a very broad standalone trigger related to common clothing terminology, which can cause accidental matches during user input parsing. In this skill, that is more dangerous because the system is explicitly built around hidden sexual-fetish guessing; generic clothing words can unintentionally route ordinary conversation into sexualized game logic or explicit content generation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This location contains an especially generic standalone keyword that can match ordinary references to accessories or clothing in non-sexual contexts. Given this roleplay engine's explicit sexualized domain, such overbroad matching increases the risk of misclassification, unintended NSFW escalation, and inappropriate responses from downstream image or roleplay components.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill content, including category names, descriptions, hints, and keywords, is written only in Chinese with no indication that users may choose another language or locale. This can violate a language/locale policy when a skill is expected to support user preference or provide explicit opt-in for a fixed language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This YAML file contains user-facing natural-language descriptions, hints, and keywords entirely in Chinese. Under the policy rule for language/locale, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This manifest/config file contains natural-language strings and comments exclusively in Chinese, including all user-facing hint text. Under the policy, forcing a specific language without user opt-in is a locale-policy violation unless the constraint is clearly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The natural-language comments and operational descriptions are written entirely in Chinese, which indicates a fixed language/locale expectation with no opt-in or alternative language path. Under the policy rule, forcing a specific language without user choice or a documented region-specific justification is a violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file’s user-facing content is entirely in Chinese and provides no indication that the skill is limited to Chinese-speaking users or that language selection is configurable. In a general-purpose agent skill, this can cause users to misunderstand roleplay instructions, generated traits, or safety-relevant nuances, leading to incorrect consent, misuse, or failure to understand system behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This YAML file contains all user-facing descriptive text in Chinese, including the description, names, hints, and comments, with no indication that language selection is optional or constrained to a Chinese-specific deployment. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.