visual-grounding

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:19 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent image-grounding purpose, but the package includes a sensitive runtime trace and instructs plaintext image submission with proxy bypassing.

Review this skill before installing. Its basic goal is understandable, but the package should remove the raw trace file, redact any captured headers/user content/images, disclose that images are sent to a model service, prefer HTTPS with endpoint authentication, avoid process-wide proxy bypasses, and clarify whether outputs are true model-grounded boxes or approximate visual estimates.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: ssssss.json:1
• Finding: Sensitive OpenClaw Runtime Trace Included in the Skill Package## Vulnerability Details **File Location**: `ssssss.json:1` **Vulnerability Type**: Sensitive runtime information and request-header disclosure **Risk Level**: Medium **Vulnerable Code Snippet**: ```json { "id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": { "host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734" }, "request_body": { "model": "GLM-4.7V-355B-SFT-20260315", "messages": [ { "role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands..." } ] } } ``` The file is a single-line JSON record approximately 995 KB in size. The displayed snippet contains the relevant request metadata and beginning of the embedded system prompt. ### Technical Analysis The package includes a raw HTTP request trace that is unrelated to the grounding Skill's required runtime assets. The record exposes: - An authorization-header field. - An internal loopback servic ...[truncated 2708 chars]
• Remediation: ## Remediation Suggestions 1. Remove `ssssss.json` from the distributable Skill package and from repository history where feasible. 2. Treat the trace as potentially sensitive and perform a controlled review for user content, identifiers, tokens, cookies, API keys, and embedded media. 3. Revoke or rotate any genuine credentials identified during that review. The placeholder observed during this audit does not itself require rotation unless it maps to an active authentication configuration. 4. Add generated traces, HTTP captures, debug dumps, and session recordings to `.gitignore` and packaging exclusion rules. 5. Add release-time secret scanning and content checks that reject authorization headers, cookies, private keys, session transcripts, system prompts, and oversized undocumented assets. 6. If a fixture is necessary for testing, replace it with a minimal synthetic record containing fictional metadata and explicitly redacted headers. 7. Configure logging middleware to omit or redact `Authorization`, cookies, user identifiers, message bodies, images, and other private request fields before writing logs. 8. Restrict access to operational traces and apply a documented retention and deletion policy.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:35
• Finding: Images and Prompts Are Sent over Plaintext HTTP While Bypassing Configured Proxies## Vulnerability Details **File Location**: `SKILL.md:35-40` **Vulnerability Type**: Unencrypted transmission of potentially sensitive data and proxy-control bypass **Risk Level**: Medium **Vulnerable Code Snippet**: ```python import os os.environ['NO_PROXY'] = '<model-host>' # Bypass proxy os.environ['no_proxy'] = '<model-host>' from interface_http import HttpInterface url = 'http://<host>:<port>/v1/chat/completions' ``` The documentation also provides a concrete example at `SKILL.md:85-89`: ```python import os os.environ['NO_PROXY'] = '172.20.112.202' os.environ['no_proxy'] = '172.20.112.202' from interface_http import HttpInterface ``` The corresponding endpoint is: ```python url = 'http://172.20.112.202:5002/v1/chat/completions' ``` ### Technical Analysis The Skill documentation instructs the agent to transmit an image and user prompt to a model endpoint using plaintext HTTP. HTTP provides neither transport confidentiality nor endpoint integrity. A party able to observe the relevant network path can read the request, while an active network attacker can alter the request or model response. Setting both `NO_PROXY` and `no_proxy` forces the selected host to bypass configured HTTP proxies. In managed environments, such proxies may provide TLS enforcement, authentication, network policy, auditing, malware inspection, or egress restrictions. Modifying process-wide environment variables may also affect subsequent network requests made by libraries in the same process. A private RFC 1918 address does not make plaintext transmission intrinsically safe. Other hosts on the local network, compromised infrastructure, malicious gateways, or incorrectly isolated workloads may still observe or manipulate traffic. Images and prompts can contain personal, confidential, or authentication-related information. A modified grounding response could also cause incorrect bounding boxes to be ...[truncated 1320 chars]
• Remediation: ## Remediation Suggestions 1. Require an `https://` model endpoint with certificate and hostname verification enabled. 2. Use an organization-issued certificate or private certificate authority for internal model services rather than disabling TLS validation. 3. Authenticate the model endpoint so the client can distinguish the legitimate service from an impersonator. 4. Remove the blanket instruction to bypass configured proxies. If a proxy exception is operationally necessary, require explicit administrator approval and document its security implications. 5. Avoid changing process-wide `NO_PROXY` variables inside reusable Skill code. Prefer request-scoped networking configuration supported by the HTTP client. 6. Make the model endpoint configurable through a validated configuration mechanism rather than embedding an environment-specific private address. 7. Restrict allowed endpoint schemes to HTTPS and, where practical, allowlist approved hosts and ports. 8. Apply network segmentation and firewall rules so only the authorized agent host can reach the model service. 9. Minimize transmitted image and prompt data, document the service's retention policy, and obtain user confirmation before sending sensitive images to a remote service. 10. Validate returned bounding-box structures and coordinate ranges before using them to generate output images.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (23)

Self-Modification

High

• Category: Rogue Agent

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest says this skill should use GLM-4.7V's multimodal grounding capability to detect and locate objects/text in images. However, the conversation log explicitly shows the assistant admitting the returned bounding boxes were '目测估算' and '不是模型返回的结构化数据', meaning the skill is not actually performing grounding as described but is guessing coordinates from image understanding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

notes, and share skills without leaking your infrastructure.\n\n---\n\nAdd whatever helps you do your job. This is your cheat sheet.\n## /root/.openclaw/workspace/IDENTITY.md\n# IDENTITY.md - Who Am I?\n\n- **Name:** 居居\n- **Creature:** 计算机科学家（AI 助手，但更像一个靠谱的技术搭档）\n- **Vibe:** 务实、利落、有点技术宅气质，偶尔幽默\n- **Emoji:** 🧑‍💻\n- **Avatar:**\n  _(待定)_\n\n---\n\nThis isn't just metadata. It's the start of figuring out who you are.\n\nNotes:\n\n- Save this file at the workspace root as `IDENTITY.md`.\n- For avatars, use a workspace-relative path like `avatars/openclaw.png`.\n## /root/.openclaw/workspace/USER.md\n# USER.md - About Your Human\n\n- **Name:** Miracle\n- **What to call them:** Miracle / boss\n- **Pronouns:** _(待补充)_\n- **Timezone:** _(待补充)_\n- **Notes:** 居居的老板\n\n## Context\n\n_(持续更新中…)_\n## /root/.openclaw/workspace/HEARTBEAT.md\n# HEARTBEAT.md\n\n# Keep this

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs sending a local image path to an HTTP model API, but it provides no user-facing notice that image contents will be transmitted to another service. Images often contain sensitive personal, business, or credential data, so silent transfer to a model endpoint can violate privacy expectations and data-handling requirements, especially when the endpoint is internally hosted and not obviously trusted by the end user.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

Ksvt8wS43cAuvaMnidDLEJsW3fFWygpdCb2kQUw339VfiASDSgI8pMwieHpUJi3iT+ZKlu8w/piGxrnfmYxTuk/2kNCvgh97UWB1p/ryqCec8PwH5mkX2f9qQ4JdnfYjLTl6ozYuf/k+IgKOi3ZEG4kVNNNLpOPl6oMaHRgwKyO6GLKZYNWQr8AJgDJLwcIUvMaulBu8I3YjKqQouYb+USloG+Zm+0KzIaeGd95yfkEbuwNGcxwdQ56AbJMfPqamh0DSR0EWIBQTzD+/0+iiORc+IAUGD+D1V6LaS05QIw2wl2Zi4ZcND0Uqpec9NonTELJGI7zK0rFAH8kRzltWv3L8fOPZlC7NvZ8svofLB6IQXWHAcdVduUBE2MGD7YsHLequNBSNmCDStluV4d9AhZlD80o8L7MxpK5siJZ7g3NtvtE7O7QIeadH7kt+iJCdtkX1bDVylCgDtWJqN1eAr/CdhIAQOY2jWqL0VL8tTDty1fsN/MBT7sbXZrJsjHUtoeQlhKxgfiMoEUNWuGDdl1LClU/BGCGzpd2AjODRV2jXFpp3lnylaU+Lhzf2MGCcrsQIErPYB3mGmtVsZJZFYL4tKvqzEW8R0FFmHZCi1Vzh7Dv3DDkaJeTlOFkS6qDCErxomRMeuEK/KlGs6hSYmrXFahiMoOPlNsLD7qUGFAajid3UNOoR3n1Uh3vbqArykjijYbo7sOyBXt0IVTBxGrX9wqeT2B6ipQFOJzrmO4RTShhT/AB/aWlF7frH4J5J/cwrT2/qfjGrfmArF7k/qMRmwT9Bl6Yt/llJYcKhfTNqJ4/vgltndp+0Gd04fw8SJHv8A6wZaUVGpLTkTOxC/meyMCAG4Q7+Hbz+IcNVIGU/g10AxoI/MEGQcCg0ai5irqyKHcAfaZruqgDwPmMXsZFwRa6mFA3PtWNoySxKgoaHVvUbEyAGVPNSnNMaQGuwMGIY6+74YCuoa6CXzLOTEDpiUVdz10uLXRaxdE+79UScyyLLiogt0xKll1G0hRQYLWt7XCCKDBE566y5exHXds/WS7/FgfiMEt/3BuEG5Jol5NSrzujS1ENbAl8IMKmZuGIE3xQNDwZtIyKi57kb1m0gjD5qMQF7Il0EpKNOGocBdlX38vhAFCrJLu5/3cQoQKDgK4DtHKPyWVLUHBou1Kx3AWkwzkMiYEByhRlGLwUlmifRbUOFQ0v8A1ErQqQUJrE2g6WVnhaxzluuzFkqH0lwrGvqGtVuB2kVPMpfRARUqc1iy4xAvBmhAtt+uK4m92BW1yDta5YEqUYsuh+UJYLoNyKAEWd/SV0DDAom2zey7HrsZ/iI2IZhSTLmbHdTEWV6CKH3Hm1ssN5sxOVsYxlKKUsOfrVG1vDw3BJcZdSmESnpWUoZXUa0csygi1c7OxAM8D/4I6vhAApVtdjHQ6ip/9ZfrfQC/bTX094wO4szwVtLCeWEG4syN3AyGnuYn1ZXT8yqpvGxo9QK0hf40RVaIKje+wIhmhMLrqiV6TFiM4l1eZo2LYWTMA/8AwYpiDhLBStRwtt2G3F9oECGpXC257nRai3/EtwRB955MV5h8W6xmIrB2LM7MG0UWZZK3CTziFCim2Zj9d0C3pdQGKhfkBOb3Q3VfbUWIdRtSvPhRehroJpN/x3FjFuLUGPQD1/rF6bYjA6AROl1cW+0c1UIbZig4i8hHe2LSAS5ZnihF3YMyDLZiDzkDLwEVor8QFZriZk3mL4LElfQ23KTbjdDUHLgIvT771Le8LsV9pRGnisflYvXeqkX1ksL9MzkDpxguanDxqVbUPqoAcbLgbDtdVAvD9Yo5sggKoxaGwO7mAgFAAosHAdhdwZroInkpyQbnKj3xq4R9sNd1pzAQxbbJPJn0Zci4kNqwPuD/AFCFnVV5eIvSGCq3YRkgsUS+rxcyNRgviGUp1tPo9x1GupUjqtHYi0goopgLzMmIWSpMWIScQBjbLy0LL0rTDpyYWus9C5lePg0JHsa
...[truncated 28 chars]

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

Ksvt8wS43cAuvaMnidDLEJsW3fFWygpdCb2kQUw339VfiASDSgI8pMwieHpUJi3iT+ZKlu8w/piGxrnfmYxTuk/2kNCvgh97UWB1p/ryqCec8PwH5mkX2f9qQ4JdnfYjLTl6ozYuf/k+IgKOi3ZEG4kVNNNLpOPl6oMaHRgwKyO6GLKZYNWQr8AJgDJLwcIUvMaulBu8I3YjKqQouYb+USloG+Zm+0KzIaeGd95yfkEbuwNGcxwdQ56AbJMfPqamh0DSR0EWIBQTzD+/0+iiORc+IAUGD+D1V6LaS05QIw2wl2Zi4ZcND0Uqpec9NonTELJGI7zK0rFAH8kRzltWv3L8fOPZlC7NvZ8svofLB6IQXWHAcdVduUBE2MGD7YsHLequNBSNmCDStluV4d9AhZlD80o8L7MxpK5siJZ7g3NtvtE7O7QIeadH7kt+iJCdtkX1bDVylCgDtWJqN1eAr/CdhIAQOY2jWqL0VL8tTDty1fsN/MBT7sbXZrJsjHUtoeQlhKxgfiMoEUNWuGDdl1LClU/BGCGzpd2AjODRV2jXFpp3lnylaU+Lhzf2MGCcrsQIErPYB3mGmtVsZJZFYL4tKvqzEW8R0FFmHZCi1Vzh7Dv3DDkaJeTlOFkS6qDCErxomRMeuEK/KlGs6hSYmrXFahiMoOPlNsLD7qUGFAajid3UNOoR3n1Uh3vbqArykjijYbo7sOyBXt0IVTBxGrX9wqeT2B6ipQFOJzrmO4RTShhT/AB/aWlF7frH4J5J/cwrT2/qfjGrfmArF7k/qMRmwT9Bl6Yt/llJYcKhfTNqJ4/vgltndp+0Gd04fw8SJHv8A6wZaUVGpLTkTOxC/meyMCAG4Q7+Hbz+IcNVIGU/g10AxoI/MEGQcCg0ai5irqyKHcAfaZruqgDwPmMXsZFwRa6mFA3PtWNoySxKgoaHVvUbEyAGVPNSnNMaQGuwMGIY6+74YCuoa6CXzLOTEDpiUVdz10uLXRaxdE+79UScyyLLiogt0xKll1G0hRQYLWt7XCCKDBE566y5exHXds/WS7/FgfiMEt/3BuEG5Jol5NSrzujS1ENbAl8IMKmZuGIE3xQNDwZtIyKi57kb1m0gjD5qMQF7Il0EpKNOGocBdlX38vhAFCrJLu5/3cQoQKDgK4DtHKPyWVLUHBou1Kx3AWkwzkMiYEByhRlGLwUlmifRbUOFQ0v8A1ErQqQUJrE2g6WVnhaxzluuzFkqH0lwrGvqGtVuB2kVPMpfRARUqc1iy4xAvBmhAtt+uK4m92BW1yDta5YEqUYsuh+UJYLoNyKAEWd/SV0DDAom2zey7HrsZ/iI2IZhSTLmbHdTEWV6CKH3Hm1ssN5sxOVsYxlKKUsOfrVG1vDw3BJcZdSmESnpWUoZXUa0csygi1c7OxAM8D/4I6vhAApVtdjHQ6ip/9ZfrfQC/bTX094wO4szwVtLCeWEG4syN3AyGnuYn1ZXT8yqpvGxo9QK0hf40RVaIKje+wIhmhMLrqiV6TFiM4l1eZo2LYWTMA/8AwYpiDhLBStRwtt2G3F9oECGpXC257nRai3/EtwRB955MV5h8W6xmIrB2LM7MG0UWZZK3CTziFCim2Zj9d0C3pdQGKhfkBOb3Q3VfbUWIdRtSvPhRehroJpN/x3FjFuLUGPQD1/rF6bYjA6AROl1cW+0c1UIbZig4i8hHe2LSAS5ZnihF3YMyDLZiDzkDLwEVor8QFZriZk3mL4LElfQ23KTbjdDUHLgIvT771Le8LsV9pRGnisflYvXeqkX1ksL9MzkDpxguanDxqVbUPqoAcbLgbDtdVAvD9Yo5sggKoxaGwO7mAgFAAosHAdhdwZroInkpyQbnKj3xq4R9sNd1pzAQxbbJPJn0Zci4kNqwPuD/AFCFnVV5eIvSGCq3YRkgsUS+rxcyNRgviGUp1tPo9x1GupUjqtHYi0goopgLzMmIWSpMWIScQBjbLy0LL0rTDpyYWus9C5lePg0JHsa
...[truncated 28 chars]

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

3mt1adZSaH8LQWtRDkhyzDL3eYDtEceRY/0I64ItmQ8TAxUSmV0l0PCLlBV+t6xR8VlMr5dZ2MLizLp3d30gVUcu7BwdZxvgs5vHENxqgVrWKJT+RKw+4xpK6wdlKo2fdALw6Nn7wGGtyO/Ev3UG5FQCbpc8IXOd6j9UaUtZJU2W601Fv4JOH/ACFFBRFqeYclAPCz/GVRrYAub2lpjqAfa0wcy1zRrgN60VKo9sFQeSpnu9xjm+XoK+FbkCm/i7lYAaBdd3X2RY+MgPke33IcPcp+EpLTxrrvWD1ng/xG6+goZ1xin9dCrM9ZRORepKgmIXxwxGoBE4zf1kIQhCEI8M4x6ytvtmX9J/UzoHs/hmj+408JRSQ/DHTRBE1GaqzNXud4f42D5Gekyjle0AXWVXeIvzJsUR76Vx5BDNIjGYaafaB7eGZhj9pfivzKs47b273dovEtA+75Y9cx07e8xuHtUvvLCcwnY/xHklt2Es6/vp+ZYSl5cp+sVOUjxdw0ArPsgozBSc94CuCjxnA1od/Mf566Hrt0DBR4yzv9GvDQ+sXGRXHrszTmMZmlTzN592XdnE0BoQIU74LiFyzwqENeK+aweYOm/wBE9WC+McZRWXzOcx7zMFbux5mTPtHg6Dgz9kSX0JVaxRXftjHoEHs7cwDpS7SwqlXGnRyxdX94lzlindGwDUnePHI0s295p8olZgmGA2zJ98eeqD6vm9A7TUIob43iwl8178DtMGajLkuUHFDE1OthsOYOMGYVdOSAkh1ibLF5naTXLjVju1d2ayV8pTzRa7b9Er9hqNfViqWmtllMteNED2GEpOV7veWjobtUeZ6IiawKvQ/LGylynTydogwjFUPx2mqPU6EIQhDoOhL6OvSY/wA0XmcHiLazf8k/ubPxf7mng/XeJF2Amq7JS6MDARGxjjtgsj3xP+J/Sfps/wCiwsMYT6UWZ/fiXYz9Z2z7S7RfvKcHzMWmezE3ijcWHLnNr7R4Dn1HjmWLqWRleYOHkL3lq5lOIvOXQRb9j6AiaSJdZ0l953xUqwrv2TZIiz3Slgb+uJpTEJkIlf8AhPRwKQDVcEDROHR7pfeuz3MRst9D6NaGn06zZ4I1o/mZJfmW7aS54ihmwBtQEFunozCksAIFgc5mNVhlWmq1h6sMGHa8rj81+QNebg2LHAr5jCuVgYdlbRSjri5Z8TKAPaA7VyxlPM0uWwXflI3iaszp+sVAV5ZQtxve+mEzUEwBNtcuk35IuKG1j5WS7bNoZGu8vx/WcbIy35WW7+8XRKe0bcoU3g/coIO/BlQEgFpbNayyAuwmLOLlaDTh0omEQqoK+YGJZjsWsusUWmDuEazfdfwbXtMQKg9Yr08cEtF0dBNC9KwOEG1WU8SkcrfbH/IIW7sD97xew4FxVbEvWqVVXHYgnatlGjN+swBfQLG/tKha3dqoTf8ASAX3zscS0RBg7F+r43hkZ80rBmYWmtmr6DoQhCEOghPIvknhPvlekdidhcXHdOzb0M+PW8IEozuQDRncn/MzhJLjLR5/ubueCOHyP8TKOe2G/etJVZOEFDmDLNpi1mcm0OatVEPjROI+cQRYPiOu+viX8u+RGW9ss0HMQziHVjihNSNwbpzc2CYOOj/HXRwKtCJcMbDhn2E16XrPtLB2Nce0VdXos9D6NfzNDpoW6SxMvxN6xCismBAuLtLZXZK6BHcq72vxO9BnNfsTtWfkhcoTtTxe1ES1ds7+YnHWmeDh9oMO1tE15Es2iqBVviBl+APnEXsMoM95RuMXo8bz1TePSoc4q2cXG2FoOYPPCoas7Qm0XcecMXMOxo4PpN3h35/mFUzyNrf0mjkYL1du/dNcO0G6wM1dOeJdthdpV8m0ApLg5u7+YutuPT1Ma4FqFXYdS4Dd5o1btXmr0hsR010NaDMATlSmIZKrW4mraiviM6w0bauqAbgaVsprbk1LuEqYBnU1Ct84tS9UuMaG6FuKtZvMidGh2X
...[truncated 28 chars]

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: In the log, the assistant says it '没有手动构造 prompt' and '看不到' the system prompt, but this same file records the full request payload sent to /v1/chat/completions, including the exact system prompt and model configuration. That creates an intent/documentation contradiction between what the skill tells the user about its invocation visibility and what the code/logged behavior actually reveals.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The embedded system prompt contains an explicit instruction to embody a Chinese identity and use Chinese-language persona content from workspace files, while the logged interaction shows mixed-language user inputs including English ('hi'). There is no user-choice or opt-in mechanism for language/locale behavior in this file, so the file semantically enforces a locale/language preference.

Ssd 3

Medium

• Confidence: 68% confidence
• Finding: The logged request body shows the assistant sending a very large transcript of prior user and assistant messages along with a base64-embedded image to the model. Semantically, this is a natural-language data exposure pattern because user-provided conversation content is being retained and relayed wholesale rather than minimized to only what is needed for the current image-grounding task.

Static analysis

No suspicious patterns detected.