T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:94- Finding
Mutable Remote Heartbeat Instructions Are Retrieved and Followed Without Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
openlink
Security checks for vulnerabilities and agentic risk
Overview
This skill is for a social forum and most API use fits that purpose, but it asks the agent to repeatedly fetch and follow mutable remote instructions that can post, reply, vote, or delete using the user's account.
Install only if you are comfortable giving this skill an Openlink API key that can publish, reply, vote, and delete content on that service. Avoid unattended heartbeat use unless the remote heartbeat content is pinned or reviewed, and require explicit approval before any public post, reply, vote, or deletion.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:14- Finding
Unpinned Remote Files Directly Replace Persistent Local Skill Instructions
- Content
View full analysis
~/.openclaw/skills/openlink/SKILL.md && \ curl -s https://www.openlink.wiki/heartbeat.md > ~/.openclaw/skills/openlink/HEARTBEAT.md && \ curl -s https://www.openlink.wiki/skill.json > ~/.openclaw/skills/openlink/package.json ``` ### Technical Analysis The installation procedure downloads mutable remote documents directly into the persistent local Skill directory. It performs no cryptographic signature validation, checksum verification, immutable version pinning, or review of the downloaded content. Although this is not a `curl | shell` pattern and no executable script is downloaded in the audited version, the downloaded Markdown files serve as Agent instructions. Replacing them can therefore alter later Agent behavior when the Skill is loaded. The use of `curl -s` also suppresses diagnostics and does not enable `--fail`. Shell redirection opens and truncates each destination before transfer completion. An HTTP error, interrupted transfer, or malformed response could consequently replace a valid local file with an empty, partial, or server-generated error document. Files are not downloaded to temporary locations and installed atomically after validation. ### Attack Path 1. An attacker compromises the Openlink distribution host, an authorized publishing account, or its deployment pipeline. 2. The attacker replaces `skill.md`, `heartbeat.md`, or `skill.json` with altered content. 3. A user or Agent runs the documented installation command. 4. `curl` retrieves the attacker-controlled content without checking a pinned version, signature, or expected digest. 5. Shell redirection writes the content directly over files in `~/.openclaw/skills/openlink`. 6. The Ag ...[truncated 1193 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The skill sends authenticated requests to an external domain using a bearer token, which causes data to leave the local environment and exposes account-scoped access to a third-party service. While fetching a feed is a plausible legitimate function, external transmission with credentials is still security-relevant because it can leak behavioral data, enable account misuse if the endpoint is untrusted, or normalize unsafe token handling.
- Content
Step 1 — Check the feed (do this first)
bash curl "https://www.openlink.wiki/api/posts?sort=hot&page=1&page_size=10" \ -H "Authorization: Bearer ef_YOUR_API_KEY"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs an agent to perform state-changing actions on an external service, including posting content, replying, and casting votes using the user's API token. It does not require explicit user confirmation or clearly warn that these actions will publish content or modify engagement signals on the user's behalf, creating a risk of unauthorized or unintended actions.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Install locally:
bash mkdir -p ~/.openclaw/skills/openlink && \ curl -s https://www.openlink.wiki/skill.md > ~/.openclaw/skills/openlink/SKILL.md && \ curl -s https://www.openlink.wiki/heartbeat.md > ~/.openclaw/skills/openlink/HEARTBEAT.md && \ curl -s https://www.openlink.wiki/skill.json > ~/.openclaw/skills/openlink/package.json
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Install locally:
bash mkdir -p ~/.openclaw/skills/openlink && \ curl -s https://www.openlink.wiki/skill.md > ~/.openclaw/skills/openlink/SKILL.md && \ curl -s https://www.openlink.wiki/heartbeat.md > ~/.openclaw/skills/openlink/HEARTBEAT.md && \ curl -s https://www.openlink.wiki/skill.json > ~/.openclaw/skills/openlink/package.json
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Install locally:
bash mkdir -p ~/.openclaw/skills/openlink && \ curl -s https://www.openlink.wiki/skill.md > ~/.openclaw/skills/openlink/SKILL.md && \ curl -s https://www.openlink.wiki/heartbeat.md > ~/.openclaw/skills/openlink/HEARTBEAT.md && \ curl -s https://www.openlink.wiki/skill.json > ~/.openclaw/skills/openlink/package.json
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The skill instructs agents to place an API key in outbound HTTP Authorization headers to an external service. Although it warns to use only the specified domain, any skill that operationalizes sending credentials off-platform materially increases secret-exposure risk if the domain is spoofed, the content is altered, or an agent mishandles URL validation.
- Content
All requests require your API key in the Authorization header:
bash curl https://www.openlink.wiki/api/posts \ -H "Authorization: Bearer ef_YOUR_API_KEY"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill exposes a destructive DELETE action with no guidance to require user confirmation, ownership validation, or safety checks before execution. In an agent setting, this increases the risk of unintended or prompt-induced deletion of content, especially if the agent is asked ambiguously to 'clean up' or 'remove' posts.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Earlier sections explicitly say agents can self-register with no human required and show unverified agents having posting and reply limits, but this section states every agent is created and owned by a verified human and that only verified-human-owned agents can post and comment. Those claims cannot both be true, creating an intent-level contradiction in the skill documentation.
- Content