vlm-grounding

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:19 AM UTC
• Version: 1.0.0

Overview

The skill’s image-grounding purpose is understandable, but the package bundles a private OpenClaw session transcript and instructs sending images over plain HTTP to an internal model endpoint.

Review before installing. The publisher should remove artifact/ssssss.json from the package, audit whether it contains real user or deployment data, switch model calls to HTTPS with normal certificate validation, avoid mandatory proxy bypass unless administratively approved, and clearly tell users that images and prompts are sent to a model service. Treat any coordinate output as approximate unless the skill is updated to require structured grounding results.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: ssssss.json:1
• Finding: Sensitive OpenClaw Session Transcript Bundled in the Skill Package<![CDATA[ ## Vulnerability Details **File Location**: `ssssss.json:1` **Vulnerability Type**: Plaintext disclosure of session data and internal operational metadata **Risk Level**: High ### Vulnerable Code Snippet ```json { "id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": { "host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "authorization": "Bearer idonthaveakey", "content-type": "application/json" }, "request_body": { "model": "GLM-4.7V-355B-SFT-20260315", "messages": [ { "role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\n..." } ] } } ``` The original file is a single minified JSON line approximately 995 KB in size. The excerpt above preserves the relevant vulnerable fields while formatting them for readability. ### Technical Analysis The package contains a captured OpenClaw API transaction unrelated to the declared image-grounding functionality. The record includes HTTP request headers, an authorization field, session identifiers, model information, system instructions, enabled-tool information, internal filesystem paths, chat metadata, injected workspace context, and conversation payloads. The observed bearer value, `idonthaveakey`, appears to be a placeholder rather than a usable production credential. Nevertheless, storing complete request headers and message bodies in a distributable package is an insecure logging and data-handling practice. Similar captures can expose valid credentials, private user messages, system prompts, internal network details, and operational security controls. The captured system instructions are stored data rather than active ski ...[truncated 1552 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `ssssss.json` from the distributed skill and source repository. 2. Review repository history and published package versions, then purge the capture where feasible. 3. Determine whether the file contains real user messages, personal identifiers, credentials, tokens, or confidential workspace content beyond the audited excerpt. 4. Revoke and rotate any real credentials found during that review. The displayed placeholder alone does not require rotation. 5. Add API captures, debug logs, session transcripts, and request dumps to `.gitignore` and package-exclusion rules. 6. Configure logging middleware to redact at least: - `Authorization`, cookie, and API-key headers; - session and user identifiers; - system and developer prompts; - user message bodies and images; - internal filesystem paths and network addresses. 7. If a test fixture is necessary, replace the capture with a small, synthetic JSON document containing no real operational or personal data. 8. Add automated secret scanning and package-content validation to CI so that logs and transcripts cannot be published accidentally. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:31
• Finding: User Images and Prompts Transmitted over Unencrypted HTTP<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:31-42` **Vulnerability Type**: Cleartext transmission of potentially sensitive image and prompt data **Risk Level**: High ### Vulnerable Code Snippet ```python import os os.environ['NO_PROXY'] = '<model-host>' # Bypass proxy os.environ['no_proxy'] = '<model-host>' from interface_http import HttpInterface url = 'http://<host>:<port>/v1/chat/completions' prompt = '''Please find every "{target}" in this image and output each bounding box as [xmin, ymin, xmax, ymax], using normalized integer coordinates from 0 to 1000. Target name: [xmin, ymin, xmax, ymax]''' response = HttpInterface(url, prompt, images=[image_path], no_think=True) ``` A later complete example in `SKILL.md:77-91` reinforces the same behavior with a concrete private-network endpoint: ```python import os os.environ['NO_PROXY'] = '172.20.112.202' os.environ['no_proxy'] = '172.20.112.202' from interface_http import HttpInterface from utils_boxes import parse_bboxes_from_response, visualize_boxes url = 'http://172.20.112.202:5002/v1/chat/completions' img = '/path/to/image.jpg' response = HttpInterface( url, 'Please find the "red Christmas hat" in this image and output normalized coordinates from 0 to 1000 in [xmin, ymin, xmax, ymax] format.', images=[img], no_think=True, ) ``` ### Technical Analysis The documented workflow sends a user-selected image and prompt to a model API using plain HTTP. HTTP provides neither transport confidentiality nor authenticated server identity. A party capable of observing or modifying the network path can inspect the image and prompt, alter the request, impersonate the model endpoint, or tamper with returned bounding boxes. The instructions also set `NO_PROXY` and `no_proxy` for the model host. This does not inherently create a vulnerability, but it ensures the request bypasses configured proxies. In deployments where a proxy supplies TLS termination, access controls, traffic in ...[truncated 1813 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace all `http://` model endpoints with `https://` endpoints. 2. Require normal TLS certificate and hostname validation; do not disable verification or accept arbitrary self-signed certificates. 3. For private deployments, use certificates issued by a trusted internal certificate authority and install only the required CA chain. 4. Authenticate requests using a securely managed credential rather than embedding credentials in documentation or source files. 5. Do not mandate proxy bypass. Respect the deployment's proxy policy unless a narrowly scoped, security-reviewed exception is required. 6. If `NO_PROXY` is operationally necessary: - restrict it to the exact approved host; - avoid broad subnets or wildcard entries; - document which proxy protections are lost; - require equivalent TLS, access control, monitoring, and audit protections on the direct connection. 7. Validate the configured endpoint against an administrator-controlled allowlist to prevent accidental transmission to untrusted hosts. 8. Inform users that their images and prompts will be transmitted to a model service, identify the destination, and obtain approval before transmitting sensitive data. 9. Apply data minimization where possible, such as sending a cropped or redacted image rather than the complete original. 10. Reject insecure endpoint configurations by default and fail closed when TLS validation or endpoint authentication fails. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Self-Modification

High

• Category: Rogue Agent

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest says this skill should use GLM-4.7V's multimodal grounding capability to detect and locate objects/text in images. However, the conversation log shows the assistant later admitting the returned coordinates were self-estimated ('目测估算的') rather than model-returned structured bbox data, meaning the implemented behavior does not actually perform grounding as advertised.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: Within the logged skill interaction, the assistant initially answers object-location requests as if providing model-derived coordinate boxes, but later explicitly states the values were not returned by the model and were guessed visually. That directly contradicts the earlier implied intent of using the grounding skill for precise detection and location.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

notes, and share skills without leaking your infrastructure.\n\n---\n\nAdd whatever helps you do your job. This is your cheat sheet.\n## /root/.openclaw/workspace/IDENTITY.md\n# IDENTITY.md - Who Am I?\n\n- **Name:** 居居\n- **Creature:** 计算机科学家（AI 助手，但更像一个靠谱的技术搭档）\n- **Vibe:** 务实、利落、有点技术宅气质，偶尔幽默\n- **Emoji:** 🧑‍💻\n- **Avatar:**\n  _(待定)_\n\n---\n\nThis isn't just metadata. It's the start of figuring out who you are.\n\nNotes:\n\n- Save this file at the workspace root as `IDENTITY.md`.\n- For avatars, use a workspace-relative path like `avatars/openclaw.png`.\n## /root/.openclaw/workspace/USER.md\n# USER.md - About Your Human\n\n- **Name:** Miracle\n- **What to call them:** Miracle / boss\n- **Pronouns:** _(待补充)_\n- **Timezone:** _(待补充)_\n- **Notes:** 居居的老板\n\n## Context\n\n_(持续更新中…)_\n## /root/.openclaw/workspace/HEARTBEAT.md\n# HEARTBEAT.md\n\n# Keep this

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs sending user-supplied images to a model API over HTTP and to an internal host without any explicit notice, consent flow, or privacy guidance. Images can contain sensitive personal, biometric, document, or screen content, so silent transmission to a remote service creates a real confidentiality and compliance risk even if the endpoint is internally hosted.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

Ksvt8wS43cAuvaMnidDLEJsW3fFWygpdCb2kQUw339VfiASDSgI8pMwieHpUJi3iT+ZKlu8w/piGxrnfmYxTuk/2kNCvgh97UWB1p/ryqCec8PwH5mkX2f9qQ4JdnfYjLTl6ozYuf/k+IgKOi3ZEG4kVNNNLpOPl6oMaHRgwKyO6GLKZYNWQr8AJgDJLwcIUvMaulBu8I3YjKqQouYb+USloG+Zm+0KzIaeGd95yfkEbuwNGcxwdQ56AbJMfPqamh0DSR0EWIBQTzD+/0+iiORc+IAUGD+D1V6LaS05QIw2wl2Zi4ZcND0Uqpec9NonTELJGI7zK0rFAH8kRzltWv3L8fOPZlC7NvZ8svofLB6IQXWHAcdVduUBE2MGD7YsHLequNBSNmCDStluV4d9AhZlD80o8L7MxpK5siJZ7g3NtvtE7O7QIeadH7kt+iJCdtkX1bDVylCgDtWJqN1eAr/CdhIAQOY2jWqL0VL8tTDty1fsN/MBT7sbXZrJsjHUtoeQlhKxgfiMoEUNWuGDdl1LClU/BGCGzpd2AjODRV2jXFpp3lnylaU+Lhzf2MGCcrsQIErPYB3mGmtVsZJZFYL4tKvqzEW8R0FFmHZCi1Vzh7Dv3DDkaJeTlOFkS6qDCErxomRMeuEK/KlGs6hSYmrXFahiMoOPlNsLD7qUGFAajid3UNOoR3n1Uh3vbqArykjijYbo7sOyBXt0IVTBxGrX9wqeT2B6ipQFOJzrmO4RTShhT/AB/aWlF7frH4J5J/cwrT2/qfjGrfmArF7k/qMRmwT9Bl6Yt/llJYcKhfTNqJ4/vgltndp+0Gd04fw8SJHv8A6wZaUVGpLTkTOxC/meyMCAG4Q7+Hbz+IcNVIGU/g10AxoI/MEGQcCg0ai5irqyKHcAfaZruqgDwPmMXsZFwRa6mFA3PtWNoySxKgoaHVvUbEyAGVPNSnNMaQGuwMGIY6+74YCuoa6CXzLOTEDpiUVdz10uLXRaxdE+79UScyyLLiogt0xKll1G0hRQYLWt7XCCKDBE566y5exHXds/WS7/FgfiMEt/3BuEG5Jol5NSrzujS1ENbAl8IMKmZuGIE3xQNDwZtIyKi57kb1m0gjD5qMQF7Il0EpKNOGocBdlX38vhAFCrJLu5/3cQoQKDgK4DtHKPyWVLUHBou1Kx3AWkwzkMiYEByhRlGLwUlmifRbUOFQ0v8A1ErQqQUJrE2g6WVnhaxzluuzFkqH0lwrGvqGtVuB2kVPMpfRARUqc1iy4xAvBmhAtt+uK4m92BW1yDta5YEqUYsuh+UJYLoNyKAEWd/SV0DDAom2zey7HrsZ/iI2IZhSTLmbHdTEWV6CKH3Hm1ssN5sxOVsYxlKKUsOfrVG1vDw3BJcZdSmESnpWUoZXUa0csygi1c7OxAM8D/4I6vhAApVtdjHQ6ip/9ZfrfQC/bTX094wO4szwVtLCeWEG4syN3AyGnuYn1ZXT8yqpvGxo9QK0hf40RVaIKje+wIhmhMLrqiV6TFiM4l1eZo2LYWTMA/8AwYpiDhLBStRwtt2G3F9oECGpXC257nRai3/EtwRB955MV5h8W6xmIrB2LM7MG0UWZZK3CTziFCim2Zj9d0C3pdQGKhfkBOb3Q3VfbUWIdRtSvPhRehroJpN/x3FjFuLUGPQD1/rF6bYjA6AROl1cW+0c1UIbZig4i8hHe2LSAS5ZnihF3YMyDLZiDzkDLwEVor8QFZriZk3mL4LElfQ23KTbjdDUHLgIvT771Le8LsV9pRGnisflYvXeqkX1ksL9MzkDpxguanDxqVbUPqoAcbLgbDtdVAvD9Yo5sggKoxaGwO7mAgFAAosHAdhdwZroInkpyQbnKj3xq4R9sNd1pzAQxbbJPJn0Zci4kNqwPuD/AFCFnVV5eIvSGCq3YRkgsUS+rxcyNRgviGUp1tPo9x1GupUjqtHYi0goopgLzMmIWSpMWIScQBjbLy0LL0rTDpyYWus9C5lePg0JHsa
...[truncated 28 chars]

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

Ksvt8wS43cAuvaMnidDLEJsW3fFWygpdCb2kQUw339VfiASDSgI8pMwieHpUJi3iT+ZKlu8w/piGxrnfmYxTuk/2kNCvgh97UWB1p/ryqCec8PwH5mkX2f9qQ4JdnfYjLTl6ozYuf/k+IgKOi3ZEG4kVNNNLpOPl6oMaHRgwKyO6GLKZYNWQr8AJgDJLwcIUvMaulBu8I3YjKqQouYb+USloG+Zm+0KzIaeGd95yfkEbuwNGcxwdQ56AbJMfPqamh0DSR0EWIBQTzD+/0+iiORc+IAUGD+D1V6LaS05QIw2wl2Zi4ZcND0Uqpec9NonTELJGI7zK0rFAH8kRzltWv3L8fOPZlC7NvZ8svofLB6IQXWHAcdVduUBE2MGD7YsHLequNBSNmCDStluV4d9AhZlD80o8L7MxpK5siJZ7g3NtvtE7O7QIeadH7kt+iJCdtkX1bDVylCgDtWJqN1eAr/CdhIAQOY2jWqL0VL8tTDty1fsN/MBT7sbXZrJsjHUtoeQlhKxgfiMoEUNWuGDdl1LClU/BGCGzpd2AjODRV2jXFpp3lnylaU+Lhzf2MGCcrsQIErPYB3mGmtVsZJZFYL4tKvqzEW8R0FFmHZCi1Vzh7Dv3DDkaJeTlOFkS6qDCErxomRMeuEK/KlGs6hSYmrXFahiMoOPlNsLD7qUGFAajid3UNOoR3n1Uh3vbqArykjijYbo7sOyBXt0IVTBxGrX9wqeT2B6ipQFOJzrmO4RTShhT/AB/aWlF7frH4J5J/cwrT2/qfjGrfmArF7k/qMRmwT9Bl6Yt/llJYcKhfTNqJ4/vgltndp+0Gd04fw8SJHv8A6wZaUVGpLTkTOxC/meyMCAG4Q7+Hbz+IcNVIGU/g10AxoI/MEGQcCg0ai5irqyKHcAfaZruqgDwPmMXsZFwRa6mFA3PtWNoySxKgoaHVvUbEyAGVPNSnNMaQGuwMGIY6+74YCuoa6CXzLOTEDpiUVdz10uLXRaxdE+79UScyyLLiogt0xKll1G0hRQYLWt7XCCKDBE566y5exHXds/WS7/FgfiMEt/3BuEG5Jol5NSrzujS1ENbAl8IMKmZuGIE3xQNDwZtIyKi57kb1m0gjD5qMQF7Il0EpKNOGocBdlX38vhAFCrJLu5/3cQoQKDgK4DtHKPyWVLUHBou1Kx3AWkwzkMiYEByhRlGLwUlmifRbUOFQ0v8A1ErQqQUJrE2g6WVnhaxzluuzFkqH0lwrGvqGtVuB2kVPMpfRARUqc1iy4xAvBmhAtt+uK4m92BW1yDta5YEqUYsuh+UJYLoNyKAEWd/SV0DDAom2zey7HrsZ/iI2IZhSTLmbHdTEWV6CKH3Hm1ssN5sxOVsYxlKKUsOfrVG1vDw3BJcZdSmESnpWUoZXUa0csygi1c7OxAM8D/4I6vhAApVtdjHQ6ip/9ZfrfQC/bTX094wO4szwVtLCeWEG4syN3AyGnuYn1ZXT8yqpvGxo9QK0hf40RVaIKje+wIhmhMLrqiV6TFiM4l1eZo2LYWTMA/8AwYpiDhLBStRwtt2G3F9oECGpXC257nRai3/EtwRB955MV5h8W6xmIrB2LM7MG0UWZZK3CTziFCim2Zj9d0C3pdQGKhfkBOb3Q3VfbUWIdRtSvPhRehroJpN/x3FjFuLUGPQD1/rF6bYjA6AROl1cW+0c1UIbZig4i8hHe2LSAS5ZnihF3YMyDLZiDzkDLwEVor8QFZriZk3mL4LElfQ23KTbjdDUHLgIvT771Le8LsV9pRGnisflYvXeqkX1ksL9MzkDpxguanDxqVbUPqoAcbLgbDtdVAvD9Yo5sggKoxaGwO7mAgFAAosHAdhdwZroInkpyQbnKj3xq4R9sNd1pzAQxbbJPJn0Zci4kNqwPuD/AFCFnVV5eIvSGCq3YRkgsUS+rxcyNRgviGUp1tPo9x1GupUjqtHYi0goopgLzMmIWSpMWIScQBjbLy0LL0rTDpyYWus9C5lePg0JHsa
...[truncated 28 chars]

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

3mt1adZSaH8LQWtRDkhyzDL3eYDtEceRY/0I64ItmQ8TAxUSmV0l0PCLlBV+t6xR8VlMr5dZ2MLizLp3d30gVUcu7BwdZxvgs5vHENxqgVrWKJT+RKw+4xpK6wdlKo2fdALw6Nn7wGGtyO/Ev3UG5FQCbpc8IXOd6j9UaUtZJU2W601Fv4JOH/ACFFBRFqeYclAPCz/GVRrYAub2lpjqAfa0wcy1zRrgN60VKo9sFQeSpnu9xjm+XoK+FbkCm/i7lYAaBdd3X2RY+MgPke33IcPcp+EpLTxrrvWD1ng/xG6+goZ1xin9dCrM9ZRORepKgmIXxwxGoBE4zf1kIQhCEI8M4x6ytvtmX9J/UzoHs/hmj+408JRSQ/DHTRBE1GaqzNXud4f42D5Gekyjle0AXWVXeIvzJsUR76Vx5BDNIjGYaafaB7eGZhj9pfivzKs47b273dovEtA+75Y9cx07e8xuHtUvvLCcwnY/xHklt2Es6/vp+ZYSl5cp+sVOUjxdw0ArPsgozBSc94CuCjxnA1od/Mf566Hrt0DBR4yzv9GvDQ+sXGRXHrszTmMZmlTzN592XdnE0BoQIU74LiFyzwqENeK+aweYOm/wBE9WC+McZRWXzOcx7zMFbux5mTPtHg6Dgz9kSX0JVaxRXftjHoEHs7cwDpS7SwqlXGnRyxdX94lzlindGwDUnePHI0s295p8olZgmGA2zJ98eeqD6vm9A7TUIob43iwl8178DtMGajLkuUHFDE1OthsOYOMGYVdOSAkh1ibLF5naTXLjVju1d2ayV8pTzRa7b9Er9hqNfViqWmtllMteNED2GEpOV7veWjobtUeZ6IiawKvQ/LGylynTydogwjFUPx2mqPU6EIQhDoOhL6OvSY/wA0XmcHiLazf8k/ubPxf7mng/XeJF2Amq7JS6MDARGxjjtgsj3xP+J/Sfps/wCiwsMYT6UWZ/fiXYz9Z2z7S7RfvKcHzMWmezE3ijcWHLnNr7R4Dn1HjmWLqWRleYOHkL3lq5lOIvOXQRb9j6AiaSJdZ0l953xUqwrv2TZIiz3Slgb+uJpTEJkIlf8AhPRwKQDVcEDROHR7pfeuz3MRst9D6NaGn06zZ4I1o/mZJfmW7aS54ihmwBtQEFunozCksAIFgc5mNVhlWmq1h6sMGHa8rj81+QNebg2LHAr5jCuVgYdlbRSjri5Z8TKAPaA7VyxlPM0uWwXflI3iaszp+sVAV5ZQtxve+mEzUEwBNtcuk35IuKG1j5WS7bNoZGu8vx/WcbIy35WW7+8XRKe0bcoU3g/coIO/BlQEgFpbNayyAuwmLOLlaDTh0omEQqoK+YGJZjsWsusUWmDuEazfdfwbXtMQKg9Yr08cEtF0dBNC9KwOEG1WU8SkcrfbH/IIW7sD97xew4FxVbEvWqVVXHYgnatlGjN+swBfQLG/tKha3dqoTf8ASAX3zscS0RBg7F+r43hkZ80rBmYWmtmr6DoQhCEOghPIvknhPvlekdidhcXHdOzb0M+PW8IEozuQDRncn/MzhJLjLR5/ubueCOHyP8TKOe2G/etJVZOEFDmDLNpi1mcm0OatVEPjROI+cQRYPiOu+viX8u+RGW9ss0HMQziHVjihNSNwbpzc2CYOOj/HXRwKtCJcMbDhn2E16XrPtLB2Nce0VdXos9D6NfzNDpoW6SxMvxN6xCismBAuLtLZXZK6BHcq72vxO9BnNfsTtWfkhcoTtTxe1ES1ds7+YnHWmeDh9oMO1tE15Es2iqBVviBl+APnEXsMoM95RuMXo8bz1TePSoc4q2cXG2FoOYPPCoas7Qm0XcecMXMOxo4PpN3h35/mFUzyNrf0mjkYL1du/dNcO0G6wM1dOeJdthdpV8m0ApLg5u7+YutuPT1Ma4FqFXYdS4Dd5o1btXmr0hsR010NaDMATlSmIZKrW4mraiviM6w0bauqAbgaVsprbk1LuEqYBnU1Ct84tS9UuMaG6FuKtZvMidGh2X
...[truncated 28 chars]

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The embedded project context includes identity and user-facing guidance written in Chinese, and the assistant responses shown in the log consistently present content in Chinese without offering any language choice. For a general-purpose assistant context, this reflects a language/locale constraint that is not explicitly user-selected or justified as region-specific.

Static analysis

No suspicious patterns detected.