Workspace Review

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:39 AM UTC
• Version: 1.0.2

Overview

This skill is a local OpenClaw workspace audit helper that inspects private workspace and memory files but does not show hidden exfiltration, destructive behavior, or persistence installation.

Install this only if you want an agent to inspect your OpenClaw workspace, including personal memory and profile files. Keep API keys, passwords, OAuth tokens, and raw sensitive chat content out of memory files, and be cautious with memorySearch.extraPaths or experimental session transcript indexing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation

Content

echo "⚠️  Possible API key found in .md files"
fi

if [ -f ".env" ]; then
    echo "⚠️  .env file in workspace (should be gitignored)"
fi

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

fi

if [ -f ".env" ]; then
    echo "⚠️  .env file in workspace (should be gitignored)"
fi

echo ""

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

fi

if [ -f ".env" ]; then
    echo "⚠️  .env file in workspace (should be gitignored)"
fi

echo ""

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description uses trigger phrases like 'review workspace', 'audit files', and 'check structure', which are broad enough to match common user requests and may cause unintended invocation. Over-broad activation increases the chance that the skill runs in contexts where filesystem inspection or memory-file review was not explicitly intended.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The 'When to Run' section includes ambiguous conditions such as 'periodically', 'when asked to review', and 'during heartbeat maintenance cycles', which do not sufficiently constrain execution. This can cause the skill to activate without precise user intent, expanding access to workspace metadata and file contents beyond what is necessary.

Session Persistence

Medium

• Category: Rogue Agent

Content

- [ ] Old daily files reviewed and distilled to MEMORY.md periodically
- [ ] No sensitive data (API keys, passwords) in memory files

**Automatic Memory Flush:** OpenClaw triggers a silent agent turn before session compaction to write durable memories. The agent receives a prompt to flush important context to `memory/YYYY-MM-DD.md`. This is automatic — no action needed, but be aware your context WILL be compacted after ~180k tokens.

### 4. Vector Search Alignment

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

Look for files that don't fit the standard layout:

```bash
ls -la ~/.openclaw/workspace/
```

Flag anything that:

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Memory Workflow

1. **During sessions:** Write notable things to `memory/YYYY-MM-DD.md`
2. **Periodically:** Review daily files, distill insights to `MEMORY.md`
3. **On session start:** Read today + yesterday's daily files
4. **In main session:** Also read MEMORY.md

• Confidence: 88% confidence
• Finding: The file instructs the agent to persist session content into daily memory files and later curate it into long-term memory. This creates a real privacy and data-retention risk because sensitive conversation details, personal data, or secrets disclosed during sessions may be stored beyond the original interaction and then automatically reloaded in future sessions.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/openclaw-conventions.md:168