Security audit

Apollo Stem

Security checks for vulnerabilities and agentic risk

Overview

The skill is a local OpenClaw self-update/status checker, but its broad activation language and open-ended self-update workflow could let an agent change skills without a clear approval step.

Install only if you intentionally want an OpenClaw maintenance skill that may guide core skill updates. Run it manually for maintenance, review any proposed skill changes before applying them, and treat the hard-coded /root/.openclaw/workspace reads and .stem/state.json write as access to local workspace metadata.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger phrases and metadata activation terms are broad enough that ordinary discussion about updates, rebuilding, or upgrades could invoke a skill intended to alter core capabilities. In an agentic system, overly broad activation can cause unintended self-modification workflows or capability changes without sufficiently explicit user intent.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation conditions combine clear user requests with vague autonomous criteria like 'system detects core capabilities are outdated' or 'major architecture adjustment,' which gives the skill discretion to activate based on subjective internal state. That ambiguity is risky because it can justify self-initiated modification behavior without a concrete, user-verifiable trigger.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The workflow explicitly discusses updating core skills and generating new capabilities, but the skill does not clearly warn users that invoking it may modify existing skills or expand system behavior. Lack of disclosure increases the chance of users triggering potentially high-impact changes without informed consent, especially in a self-modifying skill context.

Static analysis

No suspicious patterns detected.