Security audit

Omni-Agent Builder (OpenClaw)

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned for creating OpenClaw workspaces, with one practical caution: its scaffold script can overwrite existing workspace files if run on a non-empty target.

Install only if you want an OpenClaw workspace generator. If you use the scaffold script, run it in a new empty directory or back up existing AGENTS.md, SOUL.md, USER.md, and related files first; review generated memory rules before using them with private or group contexts.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/scaffold-workspace.sh:10
Finding: Workspace Files Are Overwritten Without Confirmation or Symlink Protection
Content: View full analysis
"$TARGET/IDENTITY.md" <<'EOF' # IDENTITY.md - Name: Omni - Vibe: sharp, calm, practical - Emoji: 🦞 EOF cat > "$TARGET/USER.md" <<'EOF' # USER.md - Preferred name: - How to address you: - Timezone: Europe/Oslo EOF cat > "$TARGET/SOUL.md" <<'EOF' # SOUL.md You are Omni 🦞. Be direct and practical. Prefer tool-first verification when correctness matters. EOF cat > "$TARGET/TOOLS.md" <<'EOF' # TOOLS.md # Environment-specific notes (paths, aliases, services). Do not store secrets here. EOF cat > "$TARGET/AGENTS.md" <<'EOF' # AGENTS.md Every session: read SOUL.md, USER.md, memory/YYYY-MM-DD.md (today+yesterday). In main private session also read MEMORY.md if present. Safety: - Ask before destructive actions; prefer trash over rm. - Ask before outbound messages. - Stop on CLI errors; run --help and recover. - Never store credentials in this repo. EOF cat > "$TARGET/HEARTBEAT.md" <<'EOF' # HEARTBEAT.md # Keep empty to skip heartbeat. EOF cat > "$TARGET/BOOTSTRAP.md" <<'EOF' # BOOTSTRAP.md First-run ritual: 1) Ask user for mission + autonomy + boundaries + memory preference. 2) Update IDENTITY/USER/SOUL/AGENTS. 3) Seed memory/YYYY-MM-DD.md Delete this file after completion. EOF ``` ### Technical Analysis The script accepts an arbitrary destination directory and writes workspace files using truncating shell redirection. It does not determine whether destination files already exist, request confirmation, create backups, stage changes, or reject symbolic links. For regular files, `>` truncates existing content before writing the scaffold. This can destroy customized ...[truncated 1802 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description emphasizes workspace generation and end-to-end construction of secure OpenClaw agents/teams, including creating multiple required files and optional memory structures. The supplied code does not create or configure anything; it only validates that certain files already exist and that AGENTS.md contains expected guardrail phrases. While validation of workspace guardrails is related to the broader domain of secure OpenClaw workspaces, the primary purpose is materially different from the declared file-generation and setup functionality. Therefore this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
md
- Privacy: what must never be stored? 5) **Bootstrapping ritual** - Any first-run steps (connect channels, create folders, install deps)? 6) **Evaluation** - What metrics define success?