Skill Auditor & Enhancer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:30 AM UTC
• Version: 1.0.0-alpha

Overview

The skill is transparent about its audit purpose, but it would repeatedly read sensitive workspace files and send results externally without per-run approval.

Install only if you are comfortable with an automated auditor reading skill instructions, personal memory/config files, and recent memory notes, then using external model services and Telegram for results. Prefer manual dry-run use, narrow the file scope, redact secrets and personal data, and require approval before any Telegram delivery or recurring cron schedule.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:17

Finding

Overbroad Collection and External Processing of Sensitive Workspace Data

Content

View full analysis

Remediation

View remediation

T06 · System Persistence

Warning

• Location: SKILL.md:83

Finding

Persistent Unattended Audit Execution Through a Scheduled Task

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a complete automated auditing skill that analyzes workspace contents and proactively delivers recommendations to Telegram. The supplied code chunk only implements a preparatory phase: it enumerates certain workspace files, hashes them, detects changes versus a prior state file, and writes a local JSON summary. While the files it watches are broadly consistent with the described audit domain (skills, learnings, config, memory), the actual behavior is materially narrower and lacks the core promised capabilities: no recommendation generation, no messaging/Telegram integration, and no scheduling or trigger logic. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a complete automated audit skill with periodic execution, workspace analysis, recommendation generation, and outbound Telegram delivery. The supplied code chunk only formats an existing list of recommendations from a JSON input into a Telegram-style digest and prints it to stdout. While formatting Telegram output could be a supporting component of the described system, this code alone materially differs from the declared primary purpose and lacks the core auditing, triggering, and sending behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an autonomous workspace auditing skill with periodic/manual triggers and outbound Telegram delivery. The supplied code does none of that. It is a standalone utility for merging two precomputed evaluation result files into a consolidated recommendation list. Its behavior is materially different in purpose and scope: it does not inspect workspace resources, does not schedule itself, does not recognize the stated trigger phrases, and does not send recommendations anywhere except writing a JSON file to a specified output path. This is a clear description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description describes a complete automated workspace-audit skill with recommendation generation, trigger behavior, and outbound Telegram delivery. The supplied code chunk does none of that directly. It is only a unit test module for underlying state-building behavior: hashing files and detecting changed versus unchanged files across runs. While this could be a supporting component of a larger audit system, the actual code shown has a materially different immediate purpose and lacks the declared capabilities, triggers, and outputs. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a full auditing skill with automatic/manual invocation, inspection of workspace resources, recommendation generation, and direct Telegram delivery. The supplied code does none of that. It is a unit test file for a formatter function used to build Telegram digest text. While formatting Telegram output could be a supporting component of the described system, this code chunk by itself only tests message formatting and truncation, and contains no evidence of auditing, file inspection, scheduling, trigger processing, or message sending. Therefore the code chunk does not accurately represent the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a complete autonomous audit skill with scheduled/manual triggers, workspace-wide analysis, and Telegram output. The supplied code does none of that directly; it only contains unit tests for helper functions merge and _classify_severity. Those tests operate on in-memory recommendation dictionaries and verify confidence aggregation, threshold filtering, severity labeling, and keeping unique recommendations. While such logic could support a larger audit system, this chunk's actual behavior is materially different from the declared end-user functionality and omits the key declared capabilities and triggers.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is designed to scan sensitive workspace materials such as memory, configuration, and user/persona files, then send recommendations directly to Telegram without prompting. That creates a clear exfiltration channel from potentially sensitive local context to an external service, and the scheduled/automatic nature makes it more dangerous because transmission may occur without contemporaneous user awareness.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares broad behavior that reads many workspace files and writes runtime artifacts, but it does not define any explicit tool scope or allowed-tools boundary. In an agent environment, missing scope makes it easier for the skill to inherit overly broad file capabilities, increasing the chance of unintended access or writes during automated execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manual trigger phrases like "audit skills," "skill review," "workspace health," and especially "improve workflow" are broad enough to match normal conversation. In a powerful agent, ambiguous triggers can cause the skill to run unexpectedly, leading to unintended broad file review and downstream message delivery without the user realizing an external-action workflow was activated.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

"id": "rec-001",
  "type": "refactor | new-skill | config-update | deprecate | merge",
  "severity": "green | yellow | red",
  "target": "skills/context-optimizer/SKILL.md",
  "title": "compress context-optimizer references section",
  "rationale": "...",
  "proposed_action": "...",

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

Primary: OpenClaw cron, every 7 days (Sunday 10:00 AM ET):

text

openclaw cron add --schedule "0 10 * * 0" --model openai-codex/gpt-5.4 --label skill-auditor-weekly --prompt "Read skills/skill-auditor/SKILL.md and execute the full audit pipeline. Deliver results to Telegram."

State tracking: memory/audits/last-run.json records last execution timestamp. Heartbeat checks if last run was >10 days ago and alerts.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

1. All 3 helper scripts exist and pass unit tests.
2. Dry-run mode completes full pipeline without sending messages.
3. At least one real audit cycle delivers a well-formatted Telegram message.
4. Recommendations are advisory-only (no auto-edits without approval).
5. Unchanged files are skipped via hash comparison.
6. Confidence thresholds are enforced.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manual trigger phrases like "audit skills," "skill review," "workspace health," and especially "improve workflow" are broad enough to match normal conversation. In a powerful agent, ambiguous triggers can cause the skill to run unexpectedly, leading to unintended broad file review and downstream message delivery without the user realizing an external-action workflow was activated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.