T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/architecture-template.md:264- Finding
Organization-Wide Agent Access to Sensitive Shared Client Context
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Harness Builder
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent multi-agent orchestration documentation skill, but its templates encourage broad shared client context and persistent agent services that deserve human review before use.
Install only if you are comfortable reviewing and adapting the templates before use. Restrict shared memory by project or sensitivity, avoid putting full client rosters in all-agent-readable files, handle Slack tokens and logs as secrets, and require explicit approval before enabling cron jobs or background gateway services.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger text is unusually broad and explicitly says to activate even when the user only vaguely describes coordination problems, which can cause this skill to be selected for many generic planning or architecture requests. Over-broad activation increases the chance of misrouting users into a skill that emits authoritative orchestration docs and implementation steps they did not specifically request, creating unsafe or inappropriate guidance at scale.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill promises an implementation guide with real shell commands, file locations, and config changes, but the top-level description does not warn users that it can generate operationally actionable instructions. In practice, users may invoke what appears to be a documentation/planning skill and receive commands or configuration guidance that could be copied into production-like environments without adequate review.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### Phase 1 — Foundation - [ ] Trim Tori's MEMORY.md to under 15,000 chars (currently 85k — do this first) - [ ] Create `~/.openclaw/memory/shared/` and populate 4 shared docs - [ ] Create MEMORY.md for each agent, trim to limits - [ ] Set up Slack channel structure above - [ ] Confirm all 8 Slack providers connect cleanly
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The guide directs manual trimming and archival of MEMORY.md without warning about irreversible deletion, accidental loss of operational context, or exposure of archived sensitive data. In an agent-orchestration skill, memory files may contain prompts, client data, credentials, or decision history, so unsafe editing/archival can damage integrity and confidentiality.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Archive everything else to MEMORY-ARCHIVE.md.
Step 2 — Create shared memory directory
bash mkdir -p ~/.openclaw/memory/shared mkdir -p ~/.openclaw/memory/tori
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions tell users to verify and rotate Slack tokens but omit that these are sensitive credentials and must not appear in logs, screenshots, copied configs, or shared docs. Because the same section encourages log inspection, users could inadvertently expose valid tokens or authentication failures containing sensitive details, enabling workspace compromise.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Install as background service
openclaw gateway install launchctl bootstrap gui/$UID ~/Library/LaunchAgents/ai.openclaw.gateway.plist
text ---
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
This markdown file contains a fixed English user-facing message to be posted in Slack. Because the template is presented for reuse with different users and contexts, it can impose English output without any user opt-in or documented locale justification.
- Content
Static analysis
Detected: suspicious.prompt_injection_instructions
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- SKILL.md:51