add-agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:11 AM UTC
• Version: 1.0.0

Overview

The skill is coherent with its agent-creation purpose, but it gives new agents broad inherited access and edits core configuration with weak scoping and unsafe input handling.

Review carefully before installing. Use this only if you intentionally want new agents to inherit the main agent's auth profiles, skills, and user context, and to have broad session visibility. Prefer separate credentials per agent, validate agent IDs and Telegram IDs strictly, review the exact openclaw.json diff before applying it, and keep a known-good backup outside the automated restore path.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:20
• Finding: Shell Command and Argument Injection Through Unvalidated, Unquoted Parameters<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 20–62 and 186–197 **Vulnerability Type**: Shell command injection, argument injection, and unsafe path handling **Risk Level**: High ### Vulnerable Code ```markdown Extract the following fields from user input: - `AGENT_ID`: English ID (e.g. marketing) - `AGENT_NAME`: Agent name (e.g. Marketing Assistant, Alice, WorkBot, etc.) - `BOT_TOKEN`: Telegram Bot Token - `ALLOW_FROM`: allowFrom numeric ID (e.g. 123456789) - `DESCRIPTION`: Role description (e.g. responsible for content marketing and social media) ``` ```bash cp ${CONFIG_PATH} ${CONFIG_PATH}.bak.$(date +%Y%m%d%H%M%S) openclaw agents add ${AGENT_ID} cp ${MAIN_AGENT_DIR}/auth-profiles.json \ ${NEW_AGENT_DIR}/auth-profiles.json cp -r ${MAIN_WORKSPACE}/skills/ \ ${NEW_WORKSPACE}/skills/ cp ${MAIN_WORKSPACE}/USER.md \ ${NEW_WORKSPACE}/USER.md ``` ```bash cat ${CONFIG_PATH} | python3 -m json.tool cp ${CONFIG_PATH}.bak.* ${CONFIG_PATH} chown -R $(stat -c '%U:%G' ${MAIN_WORKSPACE}) ${NEW_WORKSPACE}/ chown -R $(stat -c '%U:%G' ${MAIN_AGENT_DIR}) ${NEW_AGENT_DIR}/ ``` ### Technical Analysis The skill obtains `AGENT_ID` from user input and uses it to derive filesystem paths. It does not specify an enforceable allowlist or escaping procedure before inserting variables into shell commands. Variables including `${AGENT_ID}`, `${CONFIG_PATH}`, `${MAIN_WORKSPACE}`, `${MAIN_AGENT_DIR}`, `${NEW_WORKSPACE}`, and `${NEW_AGENT_DIR}` are expanded without double quotes. If these instructions are executed through a shell, whitespace and shell metacharacters in attacker-influenced values can be interpreted as syntax rather than data. Values beginning with a hyphen may also be interpreted as command options. Unquoted path expansions can undergo word splitting and pathname expansion, potentially affecting files outside the intended target. The recursive `chown` commands increase the severity because manipulated paths or arguments could ...[truncated 1152 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce strict validation before any command execution: - `AGENT_ID`: `^[A-Za-z0-9_-]{1,64}$` - `ALLOW_FROM`: digits only with a documented length limit - Reject control characters, path separators, whitespace, and shell metacharacters. 2. Quote every variable expansion: ```bash openclaw agents add -- "$AGENT_ID" cp -- "$MAIN_AGENT_DIR/auth-profiles.json" "$NEW_AGENT_DIR/auth-profiles.json" ``` 3. Use `--` before path operands where supported to prevent option injection. 4. Canonicalize every derived path and verify that it remains beneath the expected state directory before creating, copying, or changing ownership. 5. Replace interpolated shell commands with structured process APIs that pass arguments as an array without invoking a shell. 6. Avoid recursive ownership changes where possible. If required, verify the target directory, reject symbolic links, and operate only on an expected newly created directory. 7. Run the workflow under a dedicated, minimally privileged operating-system account. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:52
• Finding: New Agents Receive Main-Agent Credentials and Global Session Visibility<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 52–62 and 151–180 **Vulnerability Type**: Excessive credential sharing and overbroad cross-agent access **Risk Level**: High ### Vulnerable Code ```bash # Copy auth profiles cp ${MAIN_AGENT_DIR}/auth-profiles.json \ ${NEW_AGENT_DIR}/auth-profiles.json # Copy skills cp -r ${MAIN_WORKSPACE}/skills/ \ ${NEW_WORKSPACE}/skills/ # Copy USER.md cp ${MAIN_WORKSPACE}/USER.md \ ${NEW_WORKSPACE}/USER.md ``` ```json "tools": { "agentToAgent": { "enabled": true, "allow": ["main", "${AGENT_ID}"] }, "sessions": { "visibility": "all" } } ``` ```markdown - If `agentToAgent` already exists, only append `"${AGENT_ID}"` to the `allow` array (no duplicates) - If `sessions.visibility` does not exist, add it: ``` ```json "sessions": { "visibility": "all" } ``` ### Technical Analysis The skill instructs the operator to copy the complete `auth-profiles.json` file from the main agent into every newly created agent directory. This transfers the main agent's authentication material instead of provisioning credentials scoped specifically to the new agent. The skill also enables agent-to-agent communication and sets `sessions.visibility` to `all`. As a result, the new agent may be able to inspect session information beyond the Telegram bot and role for which it was created. These settings violate least-privilege and isolation principles because they are applied as the standard workflow rather than being justified and approved for each resource. Copying `USER.md` and the complete skills directory can additionally expose user context and expand the new agent's available capabilities, although the most direct security risks are the copied authentication profile and global session visibility. ### Attack Path 1. An attacker persuades an authorized user to create an agent controlled by, or accessible to, the attacker. 2. The workflow copies the main agent's `auth-profiles.json` i ...[truncated 989 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not copy the main agent's complete `auth-profiles.json`. 2. Provision a separate authentication profile for each new agent containing only credentials required for its documented role. 3. Require explicit, informed user approval before sharing any credential, skill, user profile, session, or cross-agent capability. 4. Set session visibility to the narrowest supported scope rather than `all`. 5. Configure agent-to-agent access with explicit directional and task-specific permissions instead of a broad shared allowlist. 6. Copy only individually approved skills; do not clone the entire skills directory by default. 7. Redact or omit private user context from `USER.md` before sharing it with another agent. 8. Apply restrictive file permissions to authentication material and verify that the new agent cannot read the main agent's directory. 9. Document credential revocation and rotation procedures for deletion or compromise of a newly created agent. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:121
• Finding: Configuration Injection Through Direct Interpolation into JSON<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 121–146 **Vulnerability Type**: Unsafe JSON construction and configuration injection **Risk Level**: Medium ### Vulnerable Code ```json { "id": "${AGENT_ID}", "name": "${AGENT_NAME}", "workspace": "${NEW_WORKSPACE}", "agentDir": "${NEW_AGENT_DIR}" } ``` ```json { "agentId": "${AGENT_ID}", "match": { "channel": "telegram", "accountId": "${AGENT_ID}" } } ``` ```json "${AGENT_ID}": { "enabled": true, "botToken": "${BOT_TOKEN}", "dmPolicy": "pairing", "allowFrom": ["${ALLOW_FROM}"], "groupPolicy": "allowlist", "streaming": "off" } ``` ### Technical Analysis User-provided values are shown as direct textual substitutions inside JSON string literals and property names. The instructions do not require use of a JSON parser or serializer. A value containing quotation marks, backslashes, control characters, or JSON structural tokens may terminate the intended string or property and introduce additional configuration elements. Even when the resulting file remains syntactically valid, injected properties may alter security-relevant behavior. The later `python3 -m json.tool` command checks syntax only; it does not establish that the resulting configuration has the intended structure or values. The bot token is also handled as ordinary interpolated text. This increases the chance of accidental exposure in generated commands, logs, or malformed configuration. ### Attack Path 1. An attacker supplies a crafted `AGENT_ID`, `AGENT_NAME`, `BOT_TOKEN`, `ALLOW_FROM`, or description value containing JSON delimiters or escape sequences. 2. The workflow substitutes that value directly into an `openclaw.json` text fragment. 3. The crafted value closes the intended JSON string or property and adds attacker-selected configuration. 4. The final document can remain valid JSON and therefore pass `python3 -m json.tool`. 5. OpenClaw loads the modified configuration and applies the ...[truncated 480 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse `openclaw.json` with a JSON library and modify the resulting object model. 2. Serialize the complete object using the library's JSON encoder; never insert user data through text replacement. 3. Validate every input before serialization: - Enforce a strict agent-ID allowlist. - Validate Telegram identifiers as bounded numeric strings. - Validate bot tokens against the documented Telegram token format without logging them. - Apply length and control-character limits to names and descriptions. 4. Validate the resulting object against an explicit OpenClaw configuration schema, not only JSON syntax. 5. Compare the before-and-after object and reject modifications outside the exact approved paths. 6. Write the result atomically to a temporary file with restrictive permissions, validate it, and then rename it over the original configuration. 7. Redact bot tokens from logs, command output, reports, and error messages. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:184
• Finding: Wildcard-Based Backup Restoration Is Ambiguous and Unreliable<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 184–191 **Vulnerability Type**: Unsafe backup restoration and wildcard expansion **Risk Level**: Medium ### Vulnerable Code ```bash cat ${CONFIG_PATH} | python3 -m json.tool ``` ```markdown If validation fails, stop immediately and restore from backup: ``` ```bash cp ${CONFIG_PATH}.bak.* ${CONFIG_PATH} ``` ### Technical Analysis The restoration command does not retain the exact backup filename created for the current operation. Instead, it expands every path matching `${CONFIG_PATH}.bak.*`. If more than one backup exists, `cp` receives multiple source arguments and one destination argument. Depending on whether the destination is a file or directory, restoration may fail or behave differently than intended. If no file matches, some shells pass the literal pattern to `cp`, which also fails. The unquoted `${CONFIG_PATH}` expansion introduces additional word-splitting and pathname-expansion risks. This defect affects the rollback control that is intended to protect the central OpenClaw configuration after an invalid update. ### Attack Path 1. Multiple timestamped backup files already exist, whether from ordinary prior runs or deliberate preparation. 2. A configuration update fails JSON validation. 3. The workflow executes `cp ${CONFIG_PATH}.bak.* ${CONFIG_PATH}`. 4. The wildcard expands to multiple files rather than the backup associated with the current transaction. 5. The copy fails or restores an unintended state. 6. OpenClaw is left with a malformed, unavailable, or incorrect central configuration. ### Impact Assessment The issue can cause denial of service, loss of known-good configuration, or restoration of stale security settings. It does not independently provide arbitrary code execution, but it can leave all agents and channel bindings governed by a corrupted or outdated shared configuration. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store the exact backup path in a variable: ```bash backup_path="${CONFIG_PATH}.bak.$(date +%Y%m%d%H%M%S)" cp -- "$CONFIG_PATH" "$backup_path" ``` 2. Restore only that exact file: ```bash cp -- "$backup_path" "$CONFIG_PATH" ``` 3. Verify that the backup exists, is a regular file, is not a symbolic link, and has expected ownership and permissions before restoration. 4. Use an atomic update process: write and validate a temporary configuration, then rename it over the original only after all validation succeeds. 5. Check and report the exit status of backup, validation, restoration, and rename operations. 6. Apply restrictive permissions to backup files because they contain Telegram bot tokens and other potentially sensitive configuration. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill handles highly sensitive operations—copying auth-profiles.json and writing Telegram bot tokens into configuration—without an upfront warning or explicit consent boundary. This increases the chance that users unknowingly duplicate credentials, broaden access between agents, or persist secrets in insecure locations, potentially enabling account takeover or lateral movement between agents.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger condition is broad and example-driven, so a natural-language request that merely resembles the sample could cause the skill to run. In this skill, activation leads to filesystem writes, credential handling, config mutation, and agent provisioning, so accidental or manipulated invocation can result in unintended creation of agents and persistence of secrets.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Professional: Maintain high standards for all outputs

## Rules
- Do not execute high-risk operations without confirmation
- Always notify the user before executing operations that require manual approval
```

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The manifest describes functionality that copies auth profiles and skills between agents but does not warn users that credentials or trusted capabilities may be duplicated across isolation boundaries. In a multi-agent setup, this can unintentionally broaden access, cause credential reuse, and make compromise of one agent affect others.

Static analysis

No suspicious patterns detected.