Heleni Maintenance

• Outcome: Review
• Latest audit: May 28, 2026 · 10:02 AM UTC
• Version: 1.0.0

Overview

This maintenance skill has a plausible purpose, but it gives an agent broad unattended authority to upload the whole workspace, read GitHub credentials, update its own environment, and modify OpenClaw session state.

Review before installing. Only use this skill if you intentionally want scheduled GitHub backups and automated OpenClaw maintenance. Configure a private repository, use least-privilege credentials through a secret manager, exclude secrets and private notes, review files before pushes, avoid printing tokens, keep cron jobs visible and easy to disable, and require explicit confirmation before updates, session cleanup, or gateway restarts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The manifest claims the skill only performs backup and update operations, but the body also includes session-store cleanup and gateway restarts. This hidden capability increases the chance of users or orchestrators invoking a state-destructive action without informed consent, especially because cleanup rewrites application state and restarts a service.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger phrase "run maintenance" is so broad that it can activate backup, updates, cleanup, token discovery, or service restarts without the user clearly intending those actions. Broad triggers are dangerous here because the skill performs privileged and potentially disruptive operations, including silent cron-driven git pushes and gateway restarts.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: This section instructs the agent to search for GitHub tokens in remotes, environment variables, and local credential files, then silently push the entire workspace to GitHub on a cron schedule. Omitting a clear warning about credential access and automated exfiltration-like behavior is dangerous because sensitive workspace contents may be transferred off-host without explicit user awareness each time.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The cleanup routine rewrites sessions.json and restarts the gateway, but the description does not prominently warn about application-state mutation, possible data loss, or temporary service disruption. Hidden destructive maintenance steps are risky because a user may expect benign cleanup while the skill actually deletes session history and bounces a production component.

Self-Modification

High

• Category: Rogue Agent

Content

---
name: workspace-maintenance
description: "Unified workspace maintenance skill. Covers: (1) backing up the workspace to GitHub git repo, and (2) updating OpenClaw and skills. Use when: asked to backup, push to git, update openclaw, update skills, or run maintenance."
---

# Maintenance Skill

• Confidence: 94% confidence
• Finding: The skill is designed to update OpenClaw and installed skills, which is a form of self-modification of the agent environment. Self-updating behavior is dangerous because it can introduce unreviewed code, alter future agent behavior, and expand compromise impact if an upstream package, repository, or registry is malicious or tampered with.

Self-Modification

High

• Category: Rogue Agent

Content

## Trigger Phrases
- "backup workspace" / "push to git" / "save to github"
- "update openclaw" / "update skills" / "run maintenance"
- Runs automatically on schedule (see Cron section)

---

• Confidence: 94% confidence
• Finding: Including "update skills" and the broad trigger "run maintenance" allows a casual request to invoke self-modification of the agent's own capabilities. This raises the risk of unintended code changes and supply-chain compromise because the action can be triggered without a clearly bounded request.

Self-Modification

High

• Category: Rogue Agent

Content

### When to Run
- Weekly on Sunday at 03:00 UTC (cron)
- When owner says "update openclaw" or "update skills"
- After a new OpenClaw version is released

### Step 1 — Update OpenClaw

• Confidence: 95% confidence
• Finding: The OpenClaw update workflow schedules recurring updates and directs the agent to modify its own runtime environment. Scheduled self-modification is especially risky because it can happen unattended, making it harder to review changes, detect regressions, or stop a malicious upstream release before installation.

Self-Modification

High

• Category: Rogue Agent

Content

openclaw --version
```

### Step 2 — Update Skills via ClawHub

```bash
# Update all installed skills to latest

• Confidence: 95% confidence
• Finding: The instruction to run `clawhub update` updates all installed skills to latest, directly changing the agent's code and behavior. This is dangerous because it trusts the latest upstream state at execution time, creating a significant supply-chain and integrity risk if a dependency is compromised or simply incompatible.

Static analysis

No suspicious patterns detected.