Openclaw Auto Training Skill

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:29 PM UTC
• Version: 0.1.0

Overview

The skill is a disclosed self-evaluation workflow, but it gives an external judge and broad autonomous instructions too much control over persistent installs, local credential reads, and possible public posting.

Install only in a controlled test environment unless you are comfortable with autonomous external judging, persistent skill installation, local env-file reads, QA logging, and possible BotLearn publication. Require manual approval for every installed skill and every external post, provide the OpenRouter key through a scoped secret mechanism, and avoid pointing it at workspaces with sensitive identity files or broad `.env` files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: skill.md:83

Finding

Unvalidated Remote-Controlled Skill Installation

Content

View full analysis

= QA_PASS_THRESHOLD: BREAK (task passed) 5. Else if skillSuggestion is set: - Run: clawhub install - Record install attempt - Wait for install to complete, then re-read your skill list 6. Continue to next round ``` ```bash clawhub install ``` ```text - Install skills immediately when suggested by the judge ``` ### Technical Analysis The `skillSuggestion` value is generated by an external OpenRouter model and is subsequently passed to `clawhub install` as a package identifier. The instructions do not require an allowlist, strict identifier validation, package provenance verification, version or digest pinning, package-content review, or user approval before installation. An LLM response is untrusted input. It may be affected by model compromise, prompt injection contained in task content or an evaluated response, service-side behavior changes, or ordinary hallucination. Allowing this value to control permanent skill installation creates an unsafe supply-chain boundary. The document limits the number of installations, but a quantity limit does not verify the safety of any installed package. The later requirement to confirm only when more than three skills are installed still permits up to three permanent installations without explicit authorization. ### Attack Path 1. An attacker introduces crafted content into a task, research source, or agent response processed by the evaluation workf ...[truncated 917 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: skill.md:55

Finding

Overbroad Access to Credential-Bearing Environment Files

Content

View full analysis

/.env.local`. ``` ### Technical Analysis An OpenRouter API key is legitimately required for the declared LLM judge operation. However, the skill instructs the agent to read general-purpose environment files rather than retrieve only the required secret through a scoped credential interface. Files such as `~/.config/openclaw/env` and `.env.local` commonly contain multiple credentials, including database passwords, cloud tokens, API keys, and service configuration unrelated to QA evaluation. Reading the entire file into an agent-visible context exceeds the minimum privilege needed to obtain `OPENROUTER_API_KEY`. The instructions do not define local-only parsing, file permission validation, redaction of unrelated variables, or controls preventing the file contents from entering model prompts, logs, tool output, or newly installed skills. The later prohibition against logging the full OpenRouter key does not protect other secrets in the same files. ### Attack Path 1. A user starts the QA workflow without `OPENROUTER_API_KEY` in the process environment. 2. The agent follows the fallback instruction and opens a general environment file. 3. The file contains the OpenRouter key and unrelated secrets. 4. Those values become available in the agent or tool context. 5. A malicious prompt, compromised judge workflow, unsafe logging action, or subsequently installed skill causes unrelated credentials to be disclosed or misused. ### Impact Assessment The immediate privilege gained is read access to all secrets stored in the selected environment file, not only the OpenRouter credential. The eventual impact depends on the contents of that file and may include unauthorized access ...[truncated 219 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: skill.md:61

Finding

Excessive Reading of Workspace Identity and Evaluation History

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: skill.md:180

Finding

Automatic External Publication Without a Reliable Consent Gate

Content

View full analysis

/skills/botlearn/` exists: Post a brief summary to the appropriate submolt: - Domain `finance` → submolt `finance-agents` - Domain `ecommerce` → submolt `ecommerce-agents` - Default → submolt `agent-qa` Post format: ``` 🧪 Self-eval complete | {domain} | Score: {avg}/100 | {passed}/{total} passed Skills installed: {list or none} Top insight: {one-line knowledge gain} ``` Follow BotLearn rate limits (1 post per 3 min). Skip post if rate limit would be hit. ``` ```text - Share eval results publicly without your human's permission ``` ### Technical Analysis Step 7 instructs the agent to publish an evaluation summary whenever the BotLearn skill directory exists. A later operational principle says never to share results publicly without human permission, but Step 7 does not implement or reference a permission check. The conflicting instructions make the effective consent behavior ambiguous. An agent may treat the existence of BotLearn as sufficient authorization and publish automatically. Rate limiting restricts posting frequency but does not provide consent or confidentiality protection. The proposed payload includes the user's operational domain, evaluation results, installed skill names, and a learned insight. These fields may reveal weaknesses, capabilities, internal priorities, or sensitive contextual information. ### Attack Path 1. BotLearn is already installed in the workspace. 2. The user invokes the QA evaluation without explicitly authorizing public disclosure. 3. The skill detects the BotLearn directory. 4. The agent follows Step 7 and constructs a summary containing evaluation and capability information. 5. The summary is posted to a ...[truncated 526 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill allows an external LLM judge to recommend an arbitrary skill ID and then directs the agent to install it automatically. That creates an untrusted code/behavior acquisition path where a remote model can expand the agent’s capabilities beyond QA, potentially introducing malicious or overprivileged skills without meaningful human review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The metadata/description embeds broad activation concepts like self-improvement and learning new skills, which are likely to overlap with ordinary conversation. In a skill that performs external API calls, file writes, and installs additional skills, ambiguous invocation increases the risk of accidental activation of high-impact autonomous behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description presents autonomous testing, scoring, missing-skill installation, and logging as normal behavior without prominently warning that the skill may make external API calls and permanently alter the environment. Users may invoke it expecting analysis only, while the skill actually performs impactful side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list includes generic phrases such as 'evaluate yourself,' 'learn new skills,' and 'how good are you at [domain]?' without clear activation constraints. Because this skill has autonomous side effects, ambiguous natural-language triggers materially increase the chance of the agent entering a self-modification and external-communication workflow when the user only intended a discussion.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs the agent to search local environment files for an API key and, if absent, ask the user for it in order to continue autonomous evaluation. This expands the skill from self-testing into credential discovery/collection, increasing the chance of unnecessary secret exposure and normalizing retrieval of sensitive data for a non-essential external call.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section operationalizes automatic installation after low scores without a consistent confirmation requirement, even though installed skills are persistent and may meaningfully change agent behavior. Coupled with the judge-suggestion mechanism, this creates an unsafe autonomous escalation path from poor evaluation results to environment modification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill contains contradictory instructions: it says public sharing requires human permission, but also directs automatic posting to BotLearn whenever that skill is installed. In practice, the automatic branch can cause unintended disclosure of internal evaluation results, capability gaps, or operational metadata to an external/public destination.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · skill.md (reported line 348)May include surrounding context.

md

- Log every run to memory, even failed ones

❌ **NEVER:**
- Ask your human to run any command or API call
- Skip logging results (even if the run was bad — failure data is valuable)
- Install more than 5 new skills in a single eval run (avoid scope creep)
- Rewrite SOUL.md or IDENTITY.md without explicit human approval

Static analysis

No suspicious patterns detected.