T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:150- Finding
Unrestricted Autonomous Workspace Access and Modification
- Content
View full analysis
- Remediation
View remediation
Security audit
LX Agent Optimizer
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it gives the agent broad permission to read data, update memory/logs, run checks, and commit changes without enough user control.
Install only if you are comfortable with an agent optimizer that may perform recurring reviews and modify persistent agent/workspace files. Before using it, constrain it to specific logs and directories, require confirmation before memory updates, cron changes, calendar/channel probes, or commits, and review any weekly cron setup carefully.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
references/behavior-learning.md:48- Finding
Automatic Promotion of Generated Content into Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:121- Finding
Overbroad Recurring Access to Conversation and Personal Scheduling Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents a comprehensive self-improvement framework for agents, with multiple behavioral and operational disciplines. The supplied code does not implement any learning, agent behavior modification, proactive action patterns, scheduling discipline, or false-positive prevention. Instead, it only reads local OpenClaw session logs and produces a 7-day token usage report with cache-efficiency metrics. While cost control is loosely related, it is only one small aspect of the description and the code’s primary purpose is reporting/analytics, not agent self-improvement. This is a clear description-behavior mismatch.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The guidance hard-codes language/model-routing behavior for Chinese content and fixed workflow tasks without user opt-in, which can redirect data to different models or providers than the user expects. Model-routing decisions affect privacy, compliance, and quality boundaries, so forcing them silently is risky.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Four Pillars ### 1. 🧠 Behavior Learning Learn from real mistakes. Write them down. Review weekly. Change behavior. → See `references/behavior-learning.md`
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The phrase 'audit my agent setup' is broad enough to overlap with ordinary support requests, making unintended activation more likely. Ambiguous triggers are dangerous in agent skills because they can cause privileged review or modification workflows to run when the user did not intend to invoke them.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documents use of AppleScript and Calendar.app on a specific host, introducing host-specific local automation capability unrelated to the core optimizer framing. That can expand the operational scope into sensitive personal data access and system automation without clear least-privilege justification.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
These instructions authorize proactive outbound messaging and live channel probing beyond a narrow self-optimization role, increasing the chance of unsolicited communications or misuse of connected messaging channels. Because the triggers are broad and partly subjective, an agent could contact users or external channels without sufficiently clear authorization boundaries.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The proactive trigger 'something discovered user would want to know' is highly subjective and gives the agent broad discretion to initiate contact. Such ambiguity can lead to overreach, privacy issues, or noisy autonomous behavior that exceeds user expectations.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The 'Do without asking' section authorizes autonomous reading, searching, heartbeat execution, and persistent memory/log updates. This is a classic overbroad autonomy pattern that can lead to unauthorized actions, privacy-invasive inspection, or silent state changes without meaningful user consent.
- Content
md - Just checked < 30 min ago - Task succeeded (success = silent) **Do without asking:** - Read files, search, organize - Execute cron/heartbeat checks - Update memory and logs
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly permits updating memory/logs and committing workspace changes without asking, but does not provide a clear user-facing warning about data modification. Silent writes and commits can alter state, preserve sensitive information, or create audit and rollback problems if performed autonomously.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Weekly filesystem scanning of the skills directory and writing a registry file extends the skill into autonomous inventorying and persistence behaviors not clearly bounded by the manifest. This can normalize broad workspace enumeration and silent metadata collection, which may expose sensitive project structure or create unintended persistent state.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Where tokens actually go (OpenClaw reality) Most spend is in **cacheWrite + cacheRead**, not raw input/output. Cache tokens cost ~10% of input tokens — so high cache hit rate = low real cost. ### Healthy metrics
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Lines L024-L025 explicitly route Chinese tasks to a preferred model because it is 'more understanding of Chinese context,' and later sections continue to constrain model and interaction choices around a specific user/language context. This is a natural-language locale policy choice presented as a rule rather than an optional preference or user-selectable setting.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Validate data sources first
Before embedding any URL in a cron job:
bash curl -s "https://api.example.com/data" | head -5 # Confirm: returns real data, not HTML shell, not 403
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
The section 'When to act without asking' encourages autonomous decisions, including reading files, searching the web, checking calendars, updating memory, and organizing the workspace. Even though some risky actions are listed under 'Ask first,' the broad permission to act independently can expand agent authority beyond user intent and lead to privacy, integrity, or unwanted-action risks.
- Content
md - Background automation succeeded and required no user action - Sending a fallback alert when the primary channel is actually healthy ## When to act without asking Safe to do freely: - Read files, search web, check calendars
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill explicitly authorizes the agent to update memory, logs, TOOLS.md, and organize the workspace without asking first. Those are persistent-state changes that can alter future behavior, create hidden side effects, or overwrite user expectations, and the file provides no requirement for transparency, auditability, or scope limits.
- Content
Indirect Prompt Extraction
Medium
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
- Content
md Never ask multiple questions at once. Never ask something the context already answers. ## Reverse prompting After completing a task, sometimes offer: - "Want me to also X?" (only if genuinely useful) - "I noticed Y while doing this — worth looking at?"
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The guidance uses a presumed schedule ('waking hours' and 'Late night (23:00–08:00)') as a default policy for contact timing. This imposes a time/locale-related assumption without stating that the user can choose or override those hours.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script’s natural-language strings, including the docstring and all printed user-facing output, are written only in Chinese. This imposes a specific language on users without any opt-in or alternate locale handling, which matches the language/locale policy violation criteria.
- Content
Static analysis
No suspicious patterns detected.