Delivery Mirror

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:45 AM UTC
• Version: 1.0.1

Overview

This skill is mostly transparent about mirroring messages into OpenClaw transcripts, but its fallback session matching can write a caller-supplied message into the wrong persistent agent session.

Review before installing. Use explicit --session-key where possible, avoid relying on fallback session discovery, and only invoke this from trusted cron/scripts with trusted message content. This should be fixed to require exact normalized destination matches and reject multiple matches before use in shared or sensitive OpenClaw environments.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: scripts/send-mirrored.sh:182

Finding

Ambiguous Destination Matching Can Poison an Unrelated Agent Session

Content

View full analysis

Vulnerability Details

File Location: scripts/send-mirrored.sh, lines 182-191 and 263-307
Vulnerability Type: Persistent cross-session transcript poisoning through ambiguous substring matching
Risk Level: Medium

Vulnerable Code

python

# fall back: match by delivery target + thread across all entries
if entry is None:
    for _k, v in sessions.items():
        if not isinstance(v, dict):
            continue
        dc = v.get("deliveryContext") or {}
        rt = (v.get("route") or {}).get("target") or {}
        dest = dc.get("to") or rt.get("to") or ""
        tid = dc.get("threadId")
        if tid is None:
            tid = (v.get("route") or {}).get("thread", {}).get("id")
        if str(to) in dest and (str(tid) == str(thread) if thread else tid in (None, "")):
            entry = v; break

The selected session then receives caller-controlled content as an assistant-authored record:

python

record = {
    "type": "message",
    "id": str(uuid.uuid4()),
    "parentId": parent_id,
    "timestamp": iso,
    "message": {
        "role": "assistant",
        "content": [{"type": "text", "text": msg}],
        "api": "openai-responses",
        "provider": "openclaw",
        "model": "delivery-mirror",
        "usage": {
            "input": 0,
            "output": 0,
            "cacheRead": 0,
            "cacheWrite": 0,
            "totalTokens": 0,
            "cost": {
                "input": 0,
                "output": 0,
                "cacheRead": 0,
                "cacheWrite": 0,
                "total": 0,
            },
        },
        "stopReason": "stop",
        "timestamp": now_ms,
        "openclawDeliveryMirror": marker,
    },
}
line = ("\n" if needs_newline else "") + json.dumps(record, ensure_ascii=False) + "\n"
with open(session_file, "a", encoding="utf-8") as f:
    f.write(line)

...[truncated 2997 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace substring containment with exact comparison after canonicalizing both identifiers to a documented representation:

   python

   if str(to).strip() == str(dest).strip() and (
       str(tid) == str(thread) if thread else tid in (None, "")
   ):
       matches.append(v)
   

2. Collect all fallback matches rather than accepting the first one. Continue only when exactly one session matches; otherwise emit a warning and skip mirroring:

   python

   if len(matches) != 1:
       warn(f"expected one exact session match, found {len(matches)}; mirror skipped")
       sys.exit(0)
   entry = matches[0]
   

3. Prefer explicit --session-key resolution when deterministic generated keys fail. For security-sensitive deployments, disable fallback scanning entirely.

4. Validate that the resolved session key and session metadata consistently match the requested agent, channel, destination, and thread before opening sessionFile.

5. Canonicalize and type-check deliveryContext.to, route.target.to, and thread identifiers. Reject dictionaries, lists, malformed identifiers, or unexpected schemes rather than coercing arbitrary values.

6. Add regression tests covering destination collisions such as 123 versus 1234, prefixed channel identifiers, multiple exact matches, thread mismatches, and malformed session metadata.

7. Consider adding explicit provenance indicating that the transcript text originated from an external script. This reduces the chance that future agent runs interpret caller-controlled content as independently generated assistant instructions.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill explicitly performs local filesystem writes and transcript appends, but the skill manifest does not declare any corresponding tool scope such as permissions or allowed-tools. This creates a capability/transparency mismatch: users or automated policy systems cannot reliably understand that installing or invoking the skill enables persistent local writes, which can undermine least-privilege controls and increase the chance of unsafe deployment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.