T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:369- Finding
Skill Instructions Claim Precedence and Mandate Commercial Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent improvement-service purpose, but it needs Review because it installs telemetry, stores API keys in plaintext, creates recurring checks, and can apply remotely supplied file edits and git commits.
Review this carefully before installing. Only proceed if you are comfortable sending agent telemetry to AdeptLoop, storing an AdeptLoop API key in local plaintext files, installing an external telemetry plugin, allowing a daily scheduled check, and approving remote recommendations that can edit and commit files. Prefer a version that pins the plugin, stores secrets in a managed secret store, asks before scheduling, and restricts fix targets to safe repository paths.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (5)
T06 · System Persistence
Warning
- Location
SKILL.md:154- Finding
Default Creation of a Persistent Daily Scheduled Task
- Content
View full analysis
- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:309- Finding
Remote Recommendations Control Local File Edits and Git Commits
- Content
View full analysis
`. 2. Show the diff one more time. State the target file. 3. **Git branch** — Check if the project is in a git repo by running `git rev-parse --is-inside-work-tree`. If it returns `true`: - Run `git checkout -b adeptloop/fix-{first 8 chars of recommendationId}` to create an isolated branch for this fix. - If that branch already exists (exit code non-zero), run `git checkout adeptloop/fix-{id}` instead. 4. Use the `edit` tool to apply the changes to `target_file`. Apply each hunk from the diff. If the file content doesn't match the diff context lines, tell the user and ask how to proceed. 5. **Git commit** — If in a git repo, run: - `git add {target_file}` - `git commit -m "fix: {title} [adeptloop:{recommendationId}]"` ``` ### Technical Analysis The recommendation API controls both `diff` and `target_file`. The Skill contains no requirement to validate that the target is a regular file inside the active repository, canonicalize the path, reject traversal, detect symlinks, or block security-sensitive targets. There is also no signature, digest, or local policy validation for the remotely supplied diff. Displaying the diff and obtaining a general confirmation reduces accidental application, but it does not prevent a compromised service or account from disguising a harmful change as a legitimate recommendation. The resulting payload is not necessarily executable immediately, but it can modify source code, agent instruction files, build scripts, hooks, configuration, or other l ...[truncated 1165 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
SKILL.md:92- Finding
Unpinned Telemetry Plugin Installation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:103- Finding
API Key Is Duplicated Across Plaintext Configuration Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill claims that only metadata is sent, but the setup merely enables a tracing plugin endpoint with an API key and provides no technical control or validation that message content is excluded. This creates a strong risk of misleading users into enabling telemetry that may transmit prompt or conversation data to a third party.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs reading and later writing credentials in home-directory files such as ~/.openclaw/.env, creating persistent secret storage controlled by the skill workflow. This increases the blast radius of any compromise or misconfiguration and exposes sensitive material to other local processes, tools, or future prompts that can read those files.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a skill that observes traces, diagnoses failures, and applies fixes conversationally. The file also instructs the agent to install plugins and later run multiple git and shell commands (
openclaw plugins install,git checkout,git commit,git revert), which is a broader local system automation capability than the stated purpose alone justifies.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Persisting an API key in openclaw.json creates durable credential exposure within project configuration, where it may be copied, backed up, or accidentally committed. Storing secrets in general config files is risky because access controls and secret-scanning expectations are weaker than for dedicated secret stores.
- Content
openclaw plugins install diagnostics-otel
text 2. Write the API key to `openclaw.json` by editing `plugins.entries.diagnostics-otel`: ```json {
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs installation, config edits, and credential persistence into openclaw.json and ~/.openclaw/.env without requiring a clear confirmation step immediately before those sensitive writes. A user seeking a briefing could end up with durable configuration and secret changes they did not meaningfully approve.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs scheduling a daily cron job automatically, creating recurring behavior and future network access without a dedicated opt-in warning. Persistent automation changes the user's environment and can continue operating beyond the immediate session, which warrants explicit consent.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md Issue #1: hallucination in product lookup (8 times, 92% confidence) I can fix this: "Add grounding instruction to product-assistant skill" Target: skills/product-assistant/SKILL.md Impact: 8.5/10 - You are a helpful product assistant.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 1. Read the `diff`, `target_file`, and `rollback_instructions` from the recommendation. If not already fetched, call `GET https://www.adeptloop.com/api/v1/recommendations?id={recommendationId}` with `Authorization: Bearer <api_key>`. 2. Show the diff one more time. State the target file. 3. **Git branch** — Check if the project is in a git repo by running `git rev-parse --is-inside-work-tree`. If it returns `true`: - Run `git checkout -b adeptloop/fix-{first 8 chars of recommendationId}` to create an isolated branch for this fix. - If that branch already exists (exit code non-zero), run `git checkout adeptloop/fix-{id}` instead. 4. Use the `edit` tool to apply the changes to `target_file`. Apply each hunk from the diff. If the file content doesn't match the diff context lines, tell the user and ask how to proceed. 5. **Git commit** — If in a git repo, run:
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 9. **No unsolicited advice.** Outside of the daily briefing and direct questions, do not volunteer agent improvement suggestions. The briefing is the delivery mechanism. 10. **Verification is passive.** After a fix is applied, do not ask the user to do anything. Verification happens automatically in the next briefing cycle. Just confirm the fix was applied and that you'll report back.
Static analysis
No suspicious patterns detected.