Wip File Guard

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:55 PM UTC
• Version: 1.9.72

Overview

This is a disclosed file-protection hook, but its broad path exceptions and fail-open behavior mean it needs review before installing.

Before installing, treat this as a useful but imperfect guardrail. It will persist as a file-edit hook and can block agent writes, but it should be fixed to canonicalize paths, fail closed for malformed protected-file events, and align tests and documentation with the intended policy.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: guard.mjs:45

Finding

Protected-file overwrite through non-canonical shared-state paths

Content

View full analysis

p.test(filePath)); } ``` ```js if (toolName === 'Write') { // Path-based shared state gets Write access (workspace files, harness memory). // Checked before exact-match so workspace TOOLS.md/MEMORY.md are writable. // Name-based shared state (SHARED_STATE_FILES) still goes through exact-match // to prevent accidental overwrites of SHARED-CONTEXT.md outside known paths. if (SHARED_STATE_PATHS.some(p => p.test(filePath))) { process.exit(0); } ``` ### Technical Analysis The hook applies regular-expression allowlists directly to the untrusted path string supplied in `tool_input.file_path`. It does not first normalize the path with `path.resolve()`, canonicalize existing paths with `realpathSync()`, or verify that the resulting target remains inside an authorized shared-state directory. The shared-state check occurs before exact protected-filename enforcement. Consequently, any raw path containing a permitted substring such as `.openclaw/workspace/` is allowed, even when `..` components cause the filesystem operation to resolve outside that directory. Similar discrepancies can arise from symbolic links placed inside an allowed directory. A path ...[truncated 1395 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: guard.mjs:99

Finding

File-protection hook fails open on malformed input and runtime errors

Content

View full analysis

process.exit(0)); ``` ### Technical Analysis The hook treats malformed JSON and every unhandled exception as authorization to continue. It exits successfully without returning a structured denial response or diagnostic information. For a security enforcement hook, an inability to parse or evaluate a file-modification event should not silently produce the same result as an approved operation. The broad terminal `catch` is especially problematic because programming errors, unexpected data types, resource failures, and integration defects all disable enforcement. The code also lacks explicit schema validation. Parsed values such as `tool_input`, `file_path`, and operation-specific fields are assumed to have suitable types, so unexpected input can potentially cause an exception that reaches the fail-open handler. ### Attack Path 1. The hook receives malformed or truncated JSON due to an integration error, input corruption, or a caller capable of controlling the hook payload. 2. Alternatively, a valid JSON payload supplies unexpected value types that trigger an unhandled runtime error. 3. `JSON.parse()` failure or the terminal `main().catch()` handler calls `process.exit(0)`. 4. No deny decision is emitted. 5. If the host interprets this successful, empty response as permission to continue, the requested `Write` or `Edit` operation proceeds without protection. ### Impact Assessment During a parsing or runtime failure, destructive writes or edits to protected files may proceed unchecked. This can compromise the integrity of identity files, behavioral instructions, context, and persistent memory. The is ...[truncated 214 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · REFERENCE.md (reported line 19)May include surrounding context.

Claude Code

Add to ~/.claude/settings.json:

json

{

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

Claude Code

Add to ~/.claude/settings.json:

json

{

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 7)May include surrounding context.

md

# File Guard

PreToolUse hook that blocks destructive edits to protected files. When an AI agent tries to overwrite or strip content from files like CLAUDE.md, SHARED-CONTEXT.md, or SOUL.md... it gets blocked with a clear explanation of what went wrong.

## The Problem

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 83)May include surrounding context.

md

wip-file-guard tests
===================

PASS: Block Write to CLAUDE.md
PASS: Block Write to SHARED-CONTEXT.md
PASS: Allow Write to random file
PASS: Block Edit removing 5 lines from CLAUDE.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · REFERENCE.md (reported line 11)May include surrounding context.

Install to your LDM OS home:

bash

mkdir -p ~/.ldm/extensions/wip-file-guard
cp guard.mjs openclaw.plugin.json package.json ~/.ldm/extensions/wip-file-guard/

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

Two rules:

1. **Write is blocked** on protected files. Always. Use Edit instead.
2. **Edit is blocked** when it removes more than 2 net lines from a protected file.

### Protected Files

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The test case documentation says an existing pattern-matched file write should be blocked, but the assertion expects allow instead. This can mask regressions in the guard logic by causing CI or manual testing to approve behavior that contradicts the stated security policy, weakening protection for pattern-matched files.

Content

No source excerpt is available for this finding.