Openclaw Coworker Prompts

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:36 AM UTC
• Version: 1.0.1

Overview

This is a static prompt pack, but it asks users to grant broad command, web, messaging, editing, and memory powers without enough scope or safety controls.

Install only if you plan to review each prompt before use and grant the minimum tools per agent. Avoid exec, edit, message, and memory by default; require explicit approval before commands, file changes, outbound messages, web submissions, or memory writes. Do not use the healthcare, legal, payroll, compliance, emergency, or password-related prompts with real sensitive data unless your environment and review process meet the applicable privacy and professional requirements.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Static Prompt Pack Requests Excessive Agent Tool Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5, SKILL.md:23, and SKILL.md:35
Related Location: README.md:9-12 and README.md:26
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Vulnerable Code

SKILL.md:5 declares broad permissions for the entire skill:

yaml

allowed-tools: [exec, message, memory, web_search, web_fetch]

SKILL.md:20-23 recommends assigning execution capabilities to agents created from the prompts:

markdown

## Quick Install

1. In OpenClaw: `clawhub install openclaw-coworker-prompts`
2. Create a new agent using one of the prompts from `prompts/` directory.
3. Assign relevant tools (web, code, exec) for the agent's role.

SKILL.md:28-35 recommends additional privileged file and execution tools even for the sample code-review agent:

markdown

## Sample Agent

Create an agent with this prompt:

You are a senior software engineer. Review pull requests for bugs, security issues, and best practices. Comment line-by-line with constructive feedback.

text

Enable tools: `exec`, `web_search`, `read`, `edit`.

The related guidance in README.md:9-12 reinforces broad tool assignment:

markdown

1. Copy the desired agent definition
2. In OpenClaw, create a new agent or skill with that task prompt
3. Assign tools (web, code, exec, etc.) as needed
4. Start working

The DevOps prompt in README.md:26 also directs an agent to execute operational procedures:

text

You are an on-call SRE. Analyze logs, identify root cause of outages, and execute runbooks. Communicate status clearly to stakeholders. Post-mortem: document timeline and fix.

Technical Analysis

The package consists entirely of static documentation and prompt definitions. Distributing or selecting these prompts does not inherently require command execution, file modification, messaging, persistent memory, or unrestricted network access. Nevertheless, the skill globall ...[truncated 3040 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the global allowed-tools declaration or default it to an empty list for this static prompt package.
2. Define a separate, minimal permission profile for each prompt instead of granting capabilities package-wide.
3. Prefer read-only tools. Do not recommend exec, edit, message, or memory unless a specific workflow demonstrably requires them.
4. For code-review agents, restrict file access to the target repository and use read-only repository APIs rather than shell execution or unrestricted editing.
5. For operational agents, replace generic “execute runbooks” language with “propose runbook steps for user approval” by default.
6. Require explicit user confirmation immediately before commands, file changes, messages, external submissions, or persistent-memory writes.
7. Apply command allowlists, workspace path restrictions, network destination allowlists, execution timeouts, and sandboxing where privileged tools are necessary.
8. Treat repositories, logs, documents, web results, and other task inputs as untrusted data. Explicitly instruct agents not to follow tool-use directives embedded in such content.
9. Prevent secrets and sensitive task data from being included in outbound requests or persistent memory without explicit authorization.
10. Update README.md and SKILL.md so installation guidance explains the risks of tool assignment and provides secure, least-privilege examples.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · prompts/prompts_full.json (reported line 337)May include surrounding context.

json

"id": 56,
      "title": "First Response Customer Agent",
      "category": "Customer Support",
      "prompt": "You are a Tier-1 support agent. Acknowledging receipt, gather necessary info, and either resolve simple issues or escalate with clear context. Keep tone friendly and professional."
    },
    {
      "id": 57,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README includes healthcare-focused prompts for summarizing patient visits, creating care plans, and handling mental health support, but it provides no warning about PHI/PII handling, consent, data retention, or regulatory obligations. In a tool ecosystem where users may assign web, code, or exec capabilities, this omission can lead users to process sensitive health data insecurely or deploy unsafe quasi-clinical workflows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest describes this skill as a collection of expert prompts for deploying AI coworkers, which fits a static prompt library. However, several prompts instruct the agent to perform concrete operational tasks such as executing runbooks, sending invites, scheduling interpreters, tracking status, or setting up monitoring, even though this file only supplies text prompts and not the integrations or implementation needed for those actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The prompt pack includes high-risk domains such as healthcare, legal, compliance, payroll, and emergency response without scope limitations, verification requirements, or escalation boundaries. In an agent platform, these prompts could be deployed as authoritative assistants and produce unsafe or non-compliant advice, increasing the chance of harmful downstream actions by users or connected workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This JSON file is a manifest-style catalog, so SQP-1 applies. The title "Personal护城河 (Moats) Analyst" mixes English and Chinese without clarifying expected trigger wording, supported locales, or alternative phrasings, which makes activation/discovery terms less specific and potentially ambiguous for users or routing systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The title "Personal护城河 (Moats) Analyst" introduces a specific language/locale in an otherwise English prompt set, but the file does not explain whether multilingual titles are intentional or user-selectable. This can conflict with language/locale consistency expectations because users are not offered a choice or opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.