Security audit

Openclaw Skill Os

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only orchestration skill with some broad routing language, but no hidden execution, credential access, exfiltration, or autonomous persistence mechanism was found.

Install this only if you want a broad skill-orchestration layer. Treat the daily, weekly, monthly, preference, and history language as checklists for explicit user-requested reviews rather than permission for background monitoring or automatic changes.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The manifest scopes this skill to explicit user-requested orchestration, but the later 'ecosystem health' monitoring and scheduled review sections imply ongoing autonomous behavior outside the user's request. In a skill-orchestration context, that scope expansion is dangerous because it can normalize unsolicited task execution, broaden access to context or other skills, and cause the orchestrator to act beyond least-privilege expectations.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The manifest says this skill should not be used for ordinary single-skill tasks, yet the routing tree allows 'Brain Core alone may suffice' for simple requests. That contradiction can cause the orchestrator to intercept and handle routine requests it was not intended to manage, undermining routing boundaries and increasing the chance of privilege or policy bypass through overbroad activation.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The file begins with a narrow activation scope, but the body repeatedly frames the skill as responsible for ensuring every user request is handled optimally and for maintaining ecosystem-wide awareness. In an orchestrator skill, this kind of internal contradiction is risky because the stronger always-on language can override the manifest intent in practice, leading to unrequested orchestration and broader access to user requests than intended.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The README uses a very generic activation condition, 'when you need coding assistant assistance,' which is too broad to constrain when the skill should be invoked. In an orchestration ecosystem, ambiguous triggers can cause inappropriate routing or over-selection of this skill, increasing the chance of unintended execution paths or misuse of higher-privilege capabilities.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The description claims the skill 'transforms any agent into a senior software engineer' and broadly covers debugging, code review, system design, optimization, and documentation. This wide scope can cause the orchestrator or routing logic to select the skill for many ordinary coding-adjacent requests, creating overbroad activation and increasing the chance of misrouting, instruction interference, or the skill taking precedence over more specialized skills.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The activation guidance is overly broad because 'Activate this skill when you need research analyst assistance' does not meaningfully constrain when the skill should be invoked. In an orchestrated skill ecosystem, vague triggers can cause over-selection, misrouting, or unnecessary delegation to this skill, which increases the chance of inappropriate data exposure or unintended actions through the wrong skill path.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The template description is overly generic and does not define concrete activation boundaries or scope. In a skill-orchestrated system, ambiguous scope can cause accidental or overly broad invocation, increasing the chance that the wrong skill is selected or that a derived skill created from this template is used in unintended contexts.

Static analysis

No suspicious patterns detected.