Security audit

Agent Hive

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious, but it creates persistent shared multi-agent workspaces with broad writable shared state and has concrete file-safety and enforcement gaps users should review before installing.

Install only if you intentionally want persistent shared OpenClaw agent workspaces and are prepared to review filesystem changes. Use simple trusted agent IDs only, keep shared memory/scripts/skills under access control, do not rely on budget demotion as actual spawn-permission revocation unless you also update OpenClaw authorization, and consider adding rollback and validation before use.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/create_agent.sh:7
Finding: Unsanitized Agent Identifier Allows Filesystem Path Traversal
Content: View full analysis
}" MAIN="$HOME/.openclaw/workspace" WS="$HOME/.openclaw/workspace-$AGENT_ID" ``` ```bash # Create agent directory in shared workspace mkdir -p "$MAIN/agents/$AGENT_ID" touch "$MAIN/agents/$AGENT_ID/INBOX.md" touch "$MAIN/agents/$AGENT_ID/OUTBOX.md" # Create budget file TODAY=$(date +%Y-%m-%d) cat > "$MAIN/agents/$AGENT_ID/BUDGET.json" << EOF { "daily_limit_output_tokens": 50000, "today": "$TODAY", "used_output_tokens": 0, "spawns": [], "status": "active", "warnings": [], "consecutive_overbudget_days": 0 } EOF ``` ### Technical Analysis The script accepts `AGENT_ID` from the command line and interpolates it directly into several filesystem paths. Shell quoting prevents word splitting and shell metacharacter expansion, but it does not prevent path separators or `..` traversal components from being interpreted by the filesystem. Consequently, the constructed path under `$MAIN/agents` is not guaranteed to remain within that directory. The script then creates directories, creates or updates `INBOX.md` and `OUTBOX.md`, and truncates or creates `BUDGET.json` at the resolved location. The workspace path is constructed using the same unvalidated identifier. Depending on the identifier, embedded slashes and traversal components can also place workspace content outside the expected `~/.openclaw/workspace-` location. ### Attack Path 1. An attacker or untrusted automation invokes the script with an identifier containing traversal components, such as `../../../target`. 2. The script constructs `$MAIN/agents/../../../target`. 3. The operating system normalizes the traversal components and resolves the path outside `$MAIN/agents`. 4. `mkdir -p` creates the attacker-selecte ...[truncated 906 chars]
Remediation: View remediation
&2 exit 1 fi ``` - Set a reasonable maximum identifier length. - Explicitly reject `/`, `\`, `.`, `..`, control characters, and leading hyphens. - Canonicalize each destination and verify that it remains beneath its intended parent before creating or writing files. - Refuse to operate if any relevant parent or destination is a symbolic link. - Create files with restrictive permissions, such as through `umask 077`. - Add regression tests covering absolute paths, repeated traversal components, embedded slashes, control characters, whitespace, and symlinked destinations. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/budget_audit.py:92
Finding: Budget Demotion Does Not Revoke Actual Agent Spawn Permissions
Content: View full analysis
= DEMOTION_CONSECUTIVE_DAYS and budget["status"] != "demoted": budget["status"] = "demoted" report["actions"].append(f"DEMOTED: {consecutive} consecutive days over budget") log_event(agent_name, "demotion", { "reason": f"{consecutive} consecutive days over budget", }) elif budget["status"] == "demoted": pass # Stay demoted until manually reinstated else: budget["status"] = "active" ``` Emergency demotion similarly changes only `BUDGET.json`: ```python if pct >= EMERGENCY_MULTIPLIER and budget["status"] != "demoted": budget["status"] = "demoted" report["actions"].append(f"EMERGENCY DEMOTION: {report['pct']}% of daily budget") log_event(agent_name, "demotion", { "reason": f"Emergency: {report['pct']}% in single day", "used": used, "limit": limit, }) ``` However, the documentation represents demotion as revocation of mesh privileges: ```markdown Thresholds: Green (<80%), Yellow (80-100%), Red (>100%), Emergency demotion (>200%). 3 consecutive overbudget days → automatic demotion (mesh privileges revoked). ``` The documented demotion process requires an access-control configuration change that the script does not perform: ```markdown ## Demotion Process 1. Set `allowAgents: []` in openclaw.json for the agent 2. Set `status: "demoted"` in BUDGET.json 3. Log event to `agents/governance/log.jsonl` 4. Restart gateway 5. Alert the human operator ``` ### Technical Analysis `BUDGET.json` is application state rather than the authoritative OpenClaw authorization configuration. The actual spawn ...[truncated 1870 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: scripts/create_agent.sh:20
Finding: Shared Writable Memory and Instruction Files Permit Cross-Agent Poisoning
Content: View full analysis
/ ← per-agent outbox, inbox, budget ├── agents/governance/ ← governance rules + audit log ├── memory/, projects/, scripts/, skills/ ← shared resources └── content/ ← shared content Agent Workspace (~/.openclaw/workspace-/) ├── SOUL.md ← unique personality (local file) ├── AGENTS.md ← unique instructions (local file) ├── HEARTBEAT.md ← agent-specific heartbeat (local file) ├── .openclaw/ ← agent-specific config dir └── everything else ← SYMLINKS to main workspace ``` ### Technical Analysis Each agent workspace receives direct symbolic links to shared long-term memory and instruction-bearing resources, including: - `MEMORY.md` - `.learnings` - `IDENTITY.md` - `USER.md` - `TOOLS.md` - `memory/` - `scripts/` - `skills/` No read-only mount, per-agent access control, validation layer, provenance check, or trusted update broker is established by the Skill. Agents running under the same operating-system account will ordinarily have the same write permissions as the owner of the shared files. This architecture makes the shared files a cross-agent trust boundary without enforcing ...[truncated 1641 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/budget_audit.py:35
Finding: Budget Auditor Follows Untrusted Symbolic Links During Privileged File Writes
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description claims broad multi-agent team management capabilities, including workspace setup, adding agents, networking/spawn permission configuration, and governance. The supplied code only implements one narrow subset: budget governance auditing and enforcement. It reads and writes budget files, resets daily usage, logs events, and changes status to warning/red/demoted based on token usage. While this partially matches the declared mention of auditing spend and enforcing demotions, the primary described purpose is much broader and most listed use cases are unsupported by the code shown. Therefore the description materially overstates what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents a broad multi-agent team management capability: creating and managing teams, configuring shared workspace, budget governance, mesh networking/spawn permissions, and auditing/enforcing spending controls. The supplied code is much narrower. It only scaffolds a single new agent workspace, symlinks shared resources, creates a few placeholder files, and initializes a simple budget record in JSON. Critical described behaviors such as editing configuration, establishing networking/spawn permissions, enforcing governance, auditing spend, and demotions are not implemented; they are merely suggested as manual next steps in echoed instructions. While the script partially aligns with the sub-use-case of adding a new agent to an existing shared workspace, it does not accurately represent the broader declared functionality, so this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill contains actionable filesystem operations such as creating directories, touching files, and writing configuration artifacts, but it does not declare any explicit tool scope or permissions. In an agentic environment, this can cause the runtime or operator to underestimate the skill's write capabilities, increasing the risk of unauthorized workspace/config modification.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 76% confidence
Finding: The skill is explicitly designed to establish persistent multi-agent state through shared workspaces, symlinks, agent inbox/outbox files, budgets, and long-lived configuration changes. Persistence itself is not inherently malicious, but in this context it expands attack surface by creating durable cross-agent trust relationships and filesystem state that could survive beyond a single session and be abused if an agent is compromised.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: agent-hive version: 1.0.2 description: "Create and manage multi-agent teams in OpenClaw with shared workspace, budget governance, and mesh networking. Use when: (1) adding a new agent to an existing team, (2) setting up a multi-agent workspace from scratch, (3) configuring agent-to-agent spawn permissions (mesh/hub-spoke), (4) implementing budget governance for agent teams, (5) auditing agent spend and enforcing demotions. NOT for: single-agent setups or modifying agent personalities (edit SOUL.md directly)." metadata: version: 1.0.0 openclaw:

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This shell script creates directories, writes several markdown and JSON files, and force-updates symlinks via ln -sf, which can overwrite existing links in the target workspace. Although the script prints progress messages, it does not explicitly warn the user that it will modify files under ~/.openclaw/workspace-* and $MAIN/agents/$AGENT_ID before doing so.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.