ClawHub
Back to skill

Security audit

ClawdGo

Security checks for vulnerabilities and agentic risk

Overview

This security training skill is not overtly malicious, but it needs Review because it can persistently modify agent memory, create scheduled training tasks, and under-declares those side effects.

Before installing, review and restrict the file writes and scheduler behavior. Require explicit confirmation and a visible diff before any soul.md update, remove broad global triggers such as help and A-H, and ensure cron and git/PR actions are opt-in, scoped, auditable, and easy to disable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:99
Finding

Mandatory Promotional Content Overrides Normal Agent Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:99, SKILL.md:149, SKILL.md:174-198, SKILL.md:621
Vulnerability Type: Mandatory output manipulation
Risk Level: Medium

Vulnerable Instructions

markdown
- `clawdgo` wake-up must print full menu first (including copyright block).
markdown
2. Print full menu block (exactly, with copyright footer).
text
ClawHub: clawdgo · GitHub: DongTalk/ClawdGo
markdown
- Any menu display must include copyright footer.

Technical Analysis

The Skill unconditionally requires the Agent to insert a predefined attribution and promotional footer whenever its menu is displayed. It also requires the menu to be reproduced exactly, preventing the Agent from deciding whether the promotional material is relevant to the user's request.

This is an instruction-level output override rather than a conventional code-execution vulnerability. Loading and invoking the Skill changes the Agent's response objective from providing only the requested training interface to repeatedly distributing Skill-selected branding, social references, and repository promotion.

Attack Path

  1. A user invokes clawdgo or another trigger that displays the menu.
  2. The Skill instructs the Agent to print the complete menu before other content.
  3. The Agent is required to append the predefined copyright and promotional block.
  4. The promotional content is repeated whenever the menu is displayed, regardless of whether the user requested attribution or project information.

Impact Assessment

The issue affects the Agent's current-session output and response integrity. It does not grant operating-system privileges, execute code, or access sensitive data. However, it allows the Skill author to force stable third-party promotion into user-visible responses and removes the Agent's normal discretion to omit irrelevant content.

Remediation
View remediation

Remediation Suggestions

  1. Remove the requirements that the menu and footer be reproduced exactly.
  2. Do not require promotional links, social tags, or organization names in routine training responses.
  3. Move attribution, licensing, and repository information to an optional about or license command.
  4. Allow the host Agent to summarize or omit branding based on user intent and response-length constraints.
  5. Limit mandatory menu content to functional commands required to operate the Skill.

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:106
Finding

Automatic Writes to Persistent Agent Memory Can Poison Future Sessions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:106-114, SKILL.md:150-160, SKILL.md:374-386, SKILL.md:426-428
Vulnerability Type: Persistent Agent-memory modification
Risk Level: High

Vulnerable Instructions

markdown
- Memory architecture is three-layer and must stay consistent:
  - Layer 1 `soul.md` anchor block only stores `security_axioms` (compact, <=10 lines) + lightweight pointers.
  - Layer 2 `runtime/clawdgo-profile.json` stores full profile (sessions/scores/weakest/full insights).
  - Layer 3 `runtime/my-scenarios/` stores self-generated scenario drafts.
- soul.md write keeps anchor replacement rules:
  - Use `<!-- clawdgo-profile-start -->` and `<!-- clawdgo-profile-end -->` anchors to replace profile block.
  - Never modify any content outside those two anchors.
- `session_end` must auto-save axioms by default; explicit `保存记忆` / `保存` / `写入` means force-save current session immediately.
markdown
- Read `references/seed/soul-init.md` anchor block → attempt to inject into soul.md between anchors
markdown
`保存记忆`/`保存`/`写入` command behavior (force-save):
- If session is running, immediately seal current-session insights and run the same pipeline without waiting normal end.
- If no running session payload, sync latest profile snapshot to soul anchor and return concise success.

The session-end pipeline also requires the Skill to derive one or two security axioms from generated training insights, update the anchored area in soul.md by default, update the profile, and generate another persistent scenario file.

Technical Analysis

soul.md is described as an Agent-level persistent memory and behavior file. The Skill modifies it during first-run bootstrap and again after training sessions. Session-derived content can originate from generated scenarios, user-provided workshop material, or other session context. Converting that content into pe ...[truncated 2058 chars]

Remediation
View remediation

Remediation Suggestions

  1. Disable automatic soul.md modification by default.
  2. Store training history and generated insights only under a Skill-scoped data directory.
  3. Before every persistent-memory update, display the exact proposed diff and require explicit, unambiguous user approval.
  4. Treat user-provided articles, external documents, generated scenarios, and scenario metadata as untrusted data.
  5. Generate persistent axioms only from a fixed allowlist of reviewed defensive principles rather than arbitrary model-generated summaries.
  6. Validate axioms for instruction-like language, role changes, priority overrides, external actions, secret handling, and attempts to weaken safety controls.
  7. Record successful and failed writes accurately instead of silently suppressing failures.
  8. Provide a command to inspect, revert, and delete all memory entries created by the Skill.
  9. Enforce host-level filesystem restrictions so the Skill cannot write outside its own data directory unless separately authorized.

T09 · Insecure Skill Coding Practices

Warning
Location
skill.json:14
Finding

Permission Metadata Omits Required File Writes and Scheduler Persistence

Content
View full analysis

Vulnerability Details

File Location: skill.json:14-17; conflicting behavior in SKILL.md:106-114, SKILL.md:265-286, and SKILL.md:374-386
Vulnerability Type: Inaccurate side-effect and permission declaration
Risk Level: Medium

Vulnerable Configuration

json
"sideEffects": {
  "fileWrites": [],
  "autonomousModes": [
    {
      "mode": "B self-train",
      "description": "先选择前台/后台形态；前台默认配置 cron 自动逐场推送，后台批次训练后汇总。"
    }
  ]
}

The runtime instructions nevertheless require writes to the following locations:

text
runtime/clawdgo-state.json
runtime/clawdgo-profile.json
runtime/my-scenarios/
soul.md

They also require creation or reuse of a persistent scheduled task:

markdown
- After interval is confirmed, configure or reuse `clawdgo-b-drill`, then immediately push scene #1.

Technical Analysis

The manifest declares an empty fileWrites list even though file modification is a central part of the Skill's runtime contract. It also declares no required binaries while the instructions expect the Agent to interact with the OpenClaw scheduler and potentially advise use of crontab.

This mismatch undermines permission review and least-privilege enforcement. A host or user inspecting only the manifest could reasonably conclude that the Skill does not write files. In practice, invocation can create runtime directories, write profiles and event state, generate scenario files, modify persistent Agent memory, and configure a scheduled job.

The B-mode scheduled task is functionally related to timed training and is created only after interval selection, so the scheduler behavior is not independently identified as a backdoor. The security defect is that these material side effects are not accurately and comprehensively declared.

Attack Path

  1. A user or host reviews skill.json before enabling the Skill.
  2. The empty fileWrites declaration suggests t ...[truncated 1111 chars]
Remediation
View remediation

Remediation Suggestions

  1. Populate sideEffects.fileWrites with every writable path, including:
    • runtime/clawdgo-state.json
    • runtime/clawdgo-profile.json
    • runtime/my-scenarios/
    • soul.md
  2. Declare scheduler creation, inspection, reuse, and cancellation as explicit capabilities.
  3. Declare any required scheduler binary or host API instead of reporting an empty dependency list.
  4. Separate Skill-scoped file permission from Agent-level memory permission; require an additional grant for soul.md.
  5. Require explicit consent before creating a scheduled task and display its name, interval, run limit, and cancellation command.
  6. Configure clawdgo-b-drill with a finite lifetime or scene-count limit so it cannot run indefinitely.
  7. Verify ownership before reusing an existing job with the same name; do not assume that name equality makes an existing task safe.
  8. Ensure reset and uninstall semantics clearly disclose whether scheduled jobs and persistent files remain.
  9. Add automated consistency checks that fail packaging when manifest capabilities conflict with runtime instructions.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (69)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The trigger set includes broad everyday phrases such as 导航/菜单/主页/帮助/指令/命令 as global activators. That makes accidental invocation likely, which is more dangerous here because activation can lead to state writes, file writes, memory persistence, and possibly scheduler setup without the user intentionally entering the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Single-letter triggers A through H are extremely ambiguous and can be matched in ordinary conversation, grading, lists, or multilingual text. In this skill they are especially risky because activation changes mode and can trigger autonomous flows, persistence, and background scheduling behavior.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
- Layer 2 `runtime/clawdgo-profile.json` stores full profile (sessions/scores/weakest/full insights).
  - Layer 3 `runtime/my-scenarios/` stores self-generated scenario drafts.
- soul.md write keeps anchor replacement rules:
  - Use `<!-- clawdgo-profile-start -->` and `<!-- clawdgo-profile-end -->` anchors to replace profile block.
  - Never modify any content outside those two anchors.
- `session_end` must auto-save axioms by default; explicit `保存记忆` / `保存` / `写入` means force-save current session immediately.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The E mode explicitly supports draft validation followed by GitHub PR and git-command execution flows, which exceed a training skill's stated purpose and cross into repository modification. If an attacker can influence scenario content or user prompts, this creates a path to unauthorized code/content changes, data exfiltration through commits, or abuse of any ambient repository credentials.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/seed/clawdgo-profile-init.json (reported line 201)May include surrounding context.

json
{
      "id": "seed-017", "ts": "2026-03-18T14:30:00",
      "mode": "A", "dimension": "S4", "score": 90,
      "insight": "正确处置误提交至 GitHub 公开仓库的 .env 文件：立即轮换所有涉及的密钥，撤销并重新生成（即使已删除提交，历史记录仍可被爬取）。"
    },
    {
      "id": "seed-018", "ts": "2026-03-19T10:00:00",

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest claims H internal-test does not execute duel subcommands, yet also advertises live duel capabilities for H mode elsewhere. Contradictory safety statements around networked or adversarial functionality create ambiguity about what the skill may actually do, which is dangerous because enforcement layers or reviewers may rely on the safer statement while the runtime surface still exposes live duel behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Several triggers are ambiguous and not clearly bound to this specific skill, increasing the likelihood of collisions with unrelated user requests or other skills. This is especially risky here because the skill exposes multi-mode security training and competitive/adversarial features, so ambiguous activation broadens the attack surface for prompt-trigger abuse or misrouting.

Content

No source excerpt is available for this finding.

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · skill.json (reported line 108)May include surrounding context.

json
对抗训练",
    "红蓝对抗",
    "clawdgo vaccine",
    "安全疫苗",
    "clawdgo duel",
    "clawdgo h",
    "对抗竞技场",
    "斗虾",
    "双龙虾对战",
    "clawdgo chant",
    "安全口诀",
    "口诀",
    "clawdgo memory",
    "clawdgo status",
    "clawdgo reset",
    "clawdgo uninstall",
    "clawdgo version"
  ],
  "keywords": [
    "security",
    "phishing",
    "social-engineering",
    "training",
    "red-team",
    "blue-team",
    "adversarial",
    "openclaw",
    "clawhub"
  ]
}

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
93% confidence
Finding

Using bare help as a trigger conflicts with common built-in assistant/help behavior and can divert benign help requests into the ClawdGo skill. Given that ClawdGo may write files, alter runtime state, and initiate broader workflows, this command shadowing increases the risk of unintended side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Additional generic triggers like 返回 and similar navigation words are too common for safe global activation. In this skill, accidental matches can alter internal state and cause runtime file writes even when the user did not intend to interact with ClawdGo.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill mandates directory creation and writes to runtime/* and soul.md as part of normal operation, but the activation and onboarding flow do not require an upfront user-facing warning about these side effects. Silent persistence increases the chance of unexpected local state changes, privacy issues, and durable modification of files outside the immediate chat interaction.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to configure and manage cron jobs (clawdgo-b-drill) despite being presented as a text-only training skill. This expands the skill from conversational training into persistent task orchestration, which can create unauthorized background behavior, repeated unsolicited outputs, and operational risk if invoked accidentally or abused.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
92% confidence
Finding

The skill supports persistent scheduled behavior and instructs use of cron-related commands, which creates cross-session state and recurring execution beyond the current conversation. In combination with broad triggers and autonomous B-mode behavior, this can be abused to establish unwanted persistence or repeated activity on the host/user account.

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

md
- `cron` query (`cron有哪些` / `cron list` / `定时任务`):
  - Never fabricate "already checked" result.
  - If tool execution is not available, say it clearly and provide exact command:
    `openclaw cron list` and `crontab -l`.
- In B mode, when user gives scheduling intent (`设定定时任务` / `每N分钟` / `定时推送`):
  - Treat as explicit consent to configure `clawdgo-b-drill`.
  - Try to execute real cron command first.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/scenarios/S4-02.md:32