Agent Builder

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:26 AM UTC
• Version: 1.1.0

Overview

The skill appears purpose-aligned, but its setup script can overwrite existing agent workspace files without confirmation or backup.

Review this before installing if you may run the scaffold script in an existing workspace. Use it only in a new empty directory or after backing up your workspace, and edit generated USER.md, AGENTS.md, and memory files so they match your privacy, timezone, and safety preferences.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scaffold-workspace.sh:9

Finding

Unconditional Overwrite of Existing Workspace Files

Content

View full analysis

Vulnerability Details

File Location: scripts/scaffold-workspace.sh, lines 9–58
Vulnerability Type: Unsafe file overwrite
Risk Level: Medium

Vulnerable Code

bash

TARGET="${1:-.}"

mkdir -p "$TARGET/references" "$TARGET/memory" "$TARGET/scripts"

# Minimal placeholders (you can overwrite with your customized versions)
cat > "$TARGET/IDENTITY.md" <<'EOF'
# IDENTITY.md
- Name: Omni
- Vibe: sharp, calm, practical
- Emoji: 🦞
EOF

cat > "$TARGET/USER.md" <<'EOF'
# USER.md
- Preferred name:
- How to address you:
- Timezone: Europe/Oslo
EOF

cat > "$TARGET/SOUL.md" <<'EOF'
# SOUL.md
You are Omni 🦞. Be direct and practical. Prefer tool-first verification when correctness matters.
EOF

cat > "$TARGET/TOOLS.md" <<'EOF'
# TOOLS.md
# Environment-specific notes (paths, aliases, services). Do not store secrets here.
EOF

cat > "$TARGET/AGENTS.md" <<'EOF'
# AGENTS.md
Every session: read SOUL.md, USER.md, memory/YYYY-MM-DD.md (today+yesterday). In main private session also read MEMORY.md if present.

Safety:
- Ask before destructive actions; prefer trash over rm.
- Ask before outbound messages.
- Stop on CLI errors; run --help and recover.
- Never store credentials in this repo.
EOF

cat > "$TARGET/HEARTBEAT.md" <<'EOF'
# HEARTBEAT.md
# Keep empty to skip heartbeat.
EOF

cat > "$TARGET/BOOTSTRAP.md" <<'EOF'
# BOOTSTRAP.md
First-run ritual:
1) Ask user for mission + autonomy + boundaries + memory preference.
2) Update IDENTITY/USER/SOUL/AGENTS.
3) Seed memory/YYYY-MM-DD.md
Delete this file after completion.
EOF

Technical Analysis

The target directory defaults to the current working directory. The script creates destination directories but does not verify that the target is a new or empty workspace.

Each cat > redirection opens its destination with truncation. Consequently, existing workspace files are replaced without a warning, confirmation prompt, backup, dry run, or explicit force option. This behavior affects identity, user preferences ...[truncated 1709 chars]

Remediation

View remediation

Remediation Suggestions

1. Refuse to modify an existing or non-empty workspace by default.
2. Check every destination before writing, for example with [[ -e "$path" ]].
3. Add an explicit --force option rather than treating replacement as the default.
4. Before forced replacement, list all affected files and request confirmation when running interactively.
5. Create timestamped backups of every existing destination before overwriting it.
6. Provide a --dry-run mode that reports planned directories and file changes.
7. Generate files in a temporary staging directory and move them into place only after all checks succeed.
8. Where appropriate, use no-clobber semantics such as set -o noclobber or guarded creation rather than unconditional > redirection.
9. If updating an existing workspace is supported, show diffs and modify only explicitly selected files instead of replacing the complete configuration.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a workspace-generation and agent-building capability, including creation of multiple OpenClaw files and broader orchestration/memory/setup functionality. The actual code only validates an existing workspace by checking for presence of required files and guardrail phrases in AGENTS.md. This is a materially different primary purpose: validation rather than construction/deployment. While validation could be a supporting utility within such a skill, the supplied code chunk by itself does not match the declared end-to-end builder behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest description says the skill will 'Build high-performing, secure OpenClaw agents and multi-agent teams end-to-end,' which is a broad natural-language capability statement without clear trigger constraints or exclusion conditions. In a manifest/markdown context, this can make invocation boundaries unclear for general requests about building agents or teams.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 68% confidence

Finding

The skill explicitly promotes persistent memory workflows and bootstrapping actions such as creating folders and installing dependencies. In an agent context, session persistence can become risky if sensitive data is stored without strict boundaries or if retained context is later exposed across channels, especially since the skill also discusses multi-agent orchestration and memory retention.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

- Privacy: what must never be stored?

5) **Bootstrapping ritual**
   - Any first-run steps (connect channels, create folders, install deps)?

6) **Evaluation**
   - What metrics define success?

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The scaffolded USER.md hard-codes "Timezone: Europe/Oslo", which imposes a specific locale preference in generated natural-language configuration. This matches the policy concern for language/locale constraints because the user is not offered a choice or asked to confirm the setting.

Content

No source excerpt is available for this finding.