vlm-grounding

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:19 AM UTC
• Version: 1.0.0

Overview

The skill’s image-grounding purpose is understandable, but the package bundles a private OpenClaw session transcript and instructs sending images over plain HTTP to an internal model endpoint.

Review before installing. The publisher should remove artifact/ssssss.json from the package, audit whether it contains real user or deployment data, switch model calls to HTTPS with normal certificate validation, avoid mandatory proxy bypass unless administratively approved, and clearly tell users that images and prompts are sent to a model service. Treat any coordinate output as approximate unless the skill is updated to require structured grounding results.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: ssssss.json:1

Finding

Sensitive OpenClaw Session Transcript Bundled in the Skill Package

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:31

Finding

User Images and Prompts Transmitted over Unencrypted HTTP

Content

View full analysis

' # Bypass proxy os.environ['no_proxy'] = '' from interface_http import HttpInterface url = 'http://:/v1/chat/completions' prompt = '''Please find every "{target}" in this image and output each bounding box as [xmin, ymin, xmax, ymax], using normalized integer coordinates from 0 to 1000. Target name: [xmin, ymin, xmax, ymax]''' response = HttpInterface(url, prompt, images=[image_path], no_think=True) ``` A later complete example in `SKILL.md:77-91` reinforces the same behavior with a concrete private-network endpoint: ```python import os os.environ['NO_PROXY'] = '172.20.112.202' os.environ['no_proxy'] = '172.20.112.202' from interface_http import HttpInterface from utils_boxes import parse_bboxes_from_response, visualize_boxes url = 'http://172.20.112.202:5002/v1/chat/completions' img = '/path/to/image.jpg' response = HttpInterface( url, 'Please find the "red Christmas hat" in this image and output normalized coordinates from 0 to 1000 in [xmin, ymin, xmax, ymax] format.', images=[img], no_think=True, ) ``` ### Technical Analysis The documented workflow sends a user-selected image and prompt to a model API using plain HTTP. HTTP provides neither transport confidentiality nor authenticated server identity. A party capable of observing or modifying the network path can inspect the image and prompt, alter the request, impersonate the model endpoint, or tamper with returned bounding boxes. The instructions also set `NO_PROXY` and `no_proxy` for the model host. This does not inherently create a vulnerability, but it ensures the request bypasses configured proxies. In deployments where a proxy supplies TLS termination, access controls, traffic in ...[truncated 1813 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest says this skill should use GLM-4.7V's multimodal grounding capability to detect and locate objects/text in images. However, the conversation log shows the assistant later admitting the returned coordinates were self-estimated ('目测估算的') rather than model-returned structured bbox data, meaning the implemented behavior does not actually perform grounding as advertised.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Within the logged skill interaction, the assistant initially answers object-location requests as if providing model-derived coordinate boxes, but later explicitly states the values were not returned by the model and were guessed visually. That directly contradicts the earlier implied intent of using the grounding skill for precise detection and location.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

notes, and share skills without leaking your infrastructure.\n\n---\n\nAdd whatever helps you do your job. This is your cheat sheet.\n## /root/.openclaw/workspace/IDENTITY.md\n# IDENTITY.md - Who Am I?\n\n- **Name:** 居居\n- **Creature:** 计算机科学家（AI 助手，但更像一个靠谱的技术搭档）\n- **Vibe:** 务实、利落、有点技术宅气质，偶尔幽默\n- **Emoji:** 🧑‍💻\n- **Avatar:**\n  _(待定)_\n\n---\n\nThis isn't just metadata. It's the start of figuring out who you are.\n\nNotes:\n\n- Save this file at the workspace root as `IDENTITY.md`.\n- For avatars, use a workspace-relative path like `avatars/openclaw.png`.\n## /root/.openclaw/workspace/USER.md\n# USER.md - About Your Human\n\n- **Name:** Miracle\n- **What to call them:** Miracle / boss\n- **Pronouns:** _(待补充)_\n- **Timezone:** _(待补充)_\n- **Notes:** 居居的老板\n\n## Context\n\n_(持续更新中…)_\n## /root/.openclaw/workspace/HEARTBEAT.md\n# HEARTBEAT.md\n\n# Keep this

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs sending user-supplied images to a model API over HTTP and to an internal host without any explicit notice, consent flow, or privacy guidance. Images can contain sensitive personal, biometric, document, or screen content, so silent transmission to a remote service creates a real confidentiality and compliance risk even if the endpoint is internally hosted.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

{"id": 1, "timestamp": 1773679810.3415484, "time_str": "2026-03-16 16:50:10", "session": "72766bada31e_20260316_165010", "method": "POST", "path": "/v1/chat/completions", "streaming": true, "request_headers": {"host": "127.0.0.1:5213", "connection": "keep-alive", "Accept": "application/json", "User-Agent": "OpenAI/JS 6.26.0", "X-Stainless-Retry-Count": "0", "X-Stainless-Lang": "js", "X-Stainless-Package-Version": "6.26.0", "X-Stainless-OS": "Linux", "X-Stainless-Arch": "x64", "X-Stainless-Runtime": "node", "X-Stainless-Runtime-Version": "v22.22.1", "authorization": "Bearer idonthaveakey", "content-type": "application/json", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "gzip, deflate", "content-length": "296734"}, "request_body": {"model": "GLM-4.7V-355B-SFT-20260315", "messages": [{"role": "system", "content": "You are a personal assistant running inside OpenClaw.\n## Tooling\nTool availability (filtered by policy):\nTool names are case-sensitive. Call tools exactly as listed.\n- read: Read file contents\n- write: Create or overwrite files\n- edit: Make precise edits to files\n- exec: Run shell commands (pty available for TTY-required CLIs)\n- process: Manage background exec sessions\n- web_search: Search the web (Brave API)\n- web_fetch: Fetch and extract readable content from a URL\n- sessions_list: List other sessions (incl. sub-agents) with filters/last\n- sessions_history: Fetch history for another session/sub-agent\n- sessions_send: Send a message to another session/sub-agent\n- subagents: List, steer, or kill sub-agent runs for this requester session\n- session_status: Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override\n- memory_get: Safe snippet read from MEMORY.md or memory/*.md with optional from/lines; use after memory_search to pull only the needed lines and keep context small.\n- memory_search: Mandatory recall ste
...[truncated 28 chars]

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

Ksvt8wS43cAuvaMnidDLEJsW3fFWygpdCb2kQUw339VfiASDSgI8pMwieHpUJi3iT+ZKlu8w/piGxrnfmYxTuk/2kNCvgh97UWB1p/ryqCec8PwH5mkX2f9qQ4JdnfYjLTl6ozYuf/k+IgKOi3ZEG4kVNNNLpOPl6oMaHRgwKyO6GLKZYNWQr8AJgDJLwcIUvMaulBu8I3YjKqQouYb+USloG+Zm+0KzIaeGd95yfkEbuwNGcxwdQ56AbJMfPqamh0DSR0EWIBQTzD+/0+iiORc+IAUGD+D1V6LaS05QIw2wl2Zi4ZcND0Uqpec9NonTELJGI7zK0rFAH8kRzltWv3L8fOPZlC7NvZ8svofLB6IQXWHAcdVduUBE2MGD7YsHLequNBSNmCDStluV4d9AhZlD80o8L7MxpK5siJZ7g3NtvtE7O7QIeadH7kt+iJCdtkX1bDVylCgDtWJqN1eAr/CdhIAQOY2jWqL0VL8tTDty1fsN/MBT7sbXZrJsjHUtoeQlhKxgfiMoEUNWuGDdl1LClU/BGCGzpd2AjODRV2jXFpp3lnylaU+Lhzf2MGCcrsQIErPYB3mGmtVsZJZFYL4tKvqzEW8R0FFmHZCi1Vzh7Dv3DDkaJeTlOFkS6qDCErxomRMeuEK/KlGs6hSYmrXFahiMoOPlNsLD7qUGFAajid3UNOoR3n1Uh3vbqArykjijYbo7sOyBXt0IVTBxGrX9wqeT2B6ipQFOJzrmO4RTShhT/AB/aWlF7frH4J5J/cwrT2/qfjGrfmArF7k/qMRmwT9Bl6Yt/llJYcKhfTNqJ4/vgltndp+0Gd04fw8SJHv8A6wZaUVGpLTkTOxC/meyMCAG4Q7+Hbz+IcNVIGU/g10AxoI/MEGQcCg0ai5irqyKHcAfaZruqgDwPmMXsZFwRa6mFA3PtWNoySxKgoaHVvUbEyAGVPNSnNMaQGuwMGIY6+74YCuoa6CXzLOTEDpiUVdz10uLXRaxdE+79UScyyLLiogt0xKll1G0hRQYLWt7XCCKDBE566y5exHXds/WS7/FgfiMEt/3BuEG5Jol5NSrzujS1ENbAl8IMKmZuGIE3xQNDwZtIyKi57kb1m0gjD5qMQF7Il0EpKNOGocBdlX38vhAFCrJLu5/3cQoQKDgK4DtHKPyWVLUHBou1Kx3AWkwzkMiYEByhRlGLwUlmifRbUOFQ0v8A1ErQqQUJrE2g6WVnhaxzluuzFkqH0lwrGvqGtVuB2kVPMpfRARUqc1iy4xAvBmhAtt+uK4m92BW1yDta5YEqUYsuh+UJYLoNyKAEWd/SV0DDAom2zey7HrsZ/iI2IZhSTLmbHdTEWV6CKH3Hm1ssN5sxOVsYxlKKUsOfrVG1vDw3BJcZdSmESnpWUoZXUa0csygi1c7OxAM8D/4I6vhAApVtdjHQ6ip/9ZfrfQC/bTX094wO4szwVtLCeWEG4syN3AyGnuYn1ZXT8yqpvGxo9QK0hf40RVaIKje+wIhmhMLrqiV6TFiM4l1eZo2LYWTMA/8AwYpiDhLBStRwtt2G3F9oECGpXC257nRai3/EtwRB955MV5h8W6xmIrB2LM7MG0UWZZK3CTziFCim2Zj9d0C3pdQGKhfkBOb3Q3VfbUWIdRtSvPhRehroJpN/x3FjFuLUGPQD1/rF6bYjA6AROl1cW+0c1UIbZig4i8hHe2LSAS5ZnihF3YMyDLZiDzkDLwEVor8QFZriZk3mL4LElfQ23KTbjdDUHLgIvT771Le8LsV9pRGnisflYvXeqkX1ksL9MzkDpxguanDxqVbUPqoAcbLgbDtdVAvD9Yo5sggKoxaGwO7mAgFAAosHAdhdwZroInkpyQbnKj3xq4R9sNd1pzAQxbbJPJn0Zci4kNqwPuD/AFCFnVV5eIvSGCq3YRkgsUS+rxcyNRgviGUp1tPo9x1GupUjqtHYi0goopgLzMmIWSpMWIScQBjbLy0LL0rTDpyYWus9C5lePg0JHsa
...[truncated 28 chars]

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

Ksvt8wS43cAuvaMnidDLEJsW3fFWygpdCb2kQUw339VfiASDSgI8pMwieHpUJi3iT+ZKlu8w/piGxrnfmYxTuk/2kNCvgh97UWB1p/ryqCec8PwH5mkX2f9qQ4JdnfYjLTl6ozYuf/k+IgKOi3ZEG4kVNNNLpOPl6oMaHRgwKyO6GLKZYNWQr8AJgDJLwcIUvMaulBu8I3YjKqQouYb+USloG+Zm+0KzIaeGd95yfkEbuwNGcxwdQ56AbJMfPqamh0DSR0EWIBQTzD+/0+iiORc+IAUGD+D1V6LaS05QIw2wl2Zi4ZcND0Uqpec9NonTELJGI7zK0rFAH8kRzltWv3L8fOPZlC7NvZ8svofLB6IQXWHAcdVduUBE2MGD7YsHLequNBSNmCDStluV4d9AhZlD80o8L7MxpK5siJZ7g3NtvtE7O7QIeadH7kt+iJCdtkX1bDVylCgDtWJqN1eAr/CdhIAQOY2jWqL0VL8tTDty1fsN/MBT7sbXZrJsjHUtoeQlhKxgfiMoEUNWuGDdl1LClU/BGCGzpd2AjODRV2jXFpp3lnylaU+Lhzf2MGCcrsQIErPYB3mGmtVsZJZFYL4tKvqzEW8R0FFmHZCi1Vzh7Dv3DDkaJeTlOFkS6qDCErxomRMeuEK/KlGs6hSYmrXFahiMoOPlNsLD7qUGFAajid3UNOoR3n1Uh3vbqArykjijYbo7sOyBXt0IVTBxGrX9wqeT2B6ipQFOJzrmO4RTShhT/AB/aWlF7frH4J5J/cwrT2/qfjGrfmArF7k/qMRmwT9Bl6Yt/llJYcKhfTNqJ4/vgltndp+0Gd04fw8SJHv8A6wZaUVGpLTkTOxC/meyMCAG4Q7+Hbz+IcNVIGU/g10AxoI/MEGQcCg0ai5irqyKHcAfaZruqgDwPmMXsZFwRa6mFA3PtWNoySxKgoaHVvUbEyAGVPNSnNMaQGuwMGIY6+74YCuoa6CXzLOTEDpiUVdz10uLXRaxdE+79UScyyLLiogt0xKll1G0hRQYLWt7XCCKDBE566y5exHXds/WS7/FgfiMEt/3BuEG5Jol5NSrzujS1ENbAl8IMKmZuGIE3xQNDwZtIyKi57kb1m0gjD5qMQF7Il0EpKNOGocBdlX38vhAFCrJLu5/3cQoQKDgK4DtHKPyWVLUHBou1Kx3AWkwzkMiYEByhRlGLwUlmifRbUOFQ0v8A1ErQqQUJrE2g6WVnhaxzluuzFkqH0lwrGvqGtVuB2kVPMpfRARUqc1iy4xAvBmhAtt+uK4m92BW1yDta5YEqUYsuh+UJYLoNyKAEWd/SV0DDAom2zey7HrsZ/iI2IZhSTLmbHdTEWV6CKH3Hm1ssN5sxOVsYxlKKUsOfrVG1vDw3BJcZdSmESnpWUoZXUa0csygi1c7OxAM8D/4I6vhAApVtdjHQ6ip/9ZfrfQC/bTX094wO4szwVtLCeWEG4syN3AyGnuYn1ZXT8yqpvGxo9QK0hf40RVaIKje+wIhmhMLrqiV6TFiM4l1eZo2LYWTMA/8AwYpiDhLBStRwtt2G3F9oECGpXC257nRai3/EtwRB955MV5h8W6xmIrB2LM7MG0UWZZK3CTziFCim2Zj9d0C3pdQGKhfkBOb3Q3VfbUWIdRtSvPhRehroJpN/x3FjFuLUGPQD1/rF6bYjA6AROl1cW+0c1UIbZig4i8hHe2LSAS5ZnihF3YMyDLZiDzkDLwEVor8QFZriZk3mL4LElfQ23KTbjdDUHLgIvT771Le8LsV9pRGnisflYvXeqkX1ksL9MzkDpxguanDxqVbUPqoAcbLgbDtdVAvD9Yo5sggKoxaGwO7mAgFAAosHAdhdwZroInkpyQbnKj3xq4R9sNd1pzAQxbbJPJn0Zci4kNqwPuD/AFCFnVV5eIvSGCq3YRkgsUS+rxcyNRgviGUp1tPo9x1GupUjqtHYi0goopgLzMmIWSpMWIScQBjbLy0LL0rTDpyYWus9C5lePg0JHsa
...[truncated 28 chars]

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · ssssss.json (reported line 1)May include surrounding context.

json

3mt1adZSaH8LQWtRDkhyzDL3eYDtEceRY/0I64ItmQ8TAxUSmV0l0PCLlBV+t6xR8VlMr5dZ2MLizLp3d30gVUcu7BwdZxvgs5vHENxqgVrWKJT+RKw+4xpK6wdlKo2fdALw6Nn7wGGtyO/Ev3UG5FQCbpc8IXOd6j9UaUtZJU2W601Fv4JOH/ACFFBRFqeYclAPCz/GVRrYAub2lpjqAfa0wcy1zRrgN60VKo9sFQeSpnu9xjm+XoK+FbkCm/i7lYAaBdd3X2RY+MgPke33IcPcp+EpLTxrrvWD1ng/xG6+goZ1xin9dCrM9ZRORepKgmIXxwxGoBE4zf1kIQhCEI8M4x6ytvtmX9J/UzoHs/hmj+408JRSQ/DHTRBE1GaqzNXud4f42D5Gekyjle0AXWVXeIvzJsUR76Vx5BDNIjGYaafaB7eGZhj9pfivzKs47b273dovEtA+75Y9cx07e8xuHtUvvLCcwnY/xHklt2Es6/vp+ZYSl5cp+sVOUjxdw0ArPsgozBSc94CuCjxnA1od/Mf566Hrt0DBR4yzv9GvDQ+sXGRXHrszTmMZmlTzN592XdnE0BoQIU74LiFyzwqENeK+aweYOm/wBE9WC+McZRWXzOcx7zMFbux5mTPtHg6Dgz9kSX0JVaxRXftjHoEHs7cwDpS7SwqlXGnRyxdX94lzlindGwDUnePHI0s295p8olZgmGA2zJ98eeqD6vm9A7TUIob43iwl8178DtMGajLkuUHFDE1OthsOYOMGYVdOSAkh1ibLF5naTXLjVju1d2ayV8pTzRa7b9Er9hqNfViqWmtllMteNED2GEpOV7veWjobtUeZ6IiawKvQ/LGylynTydogwjFUPx2mqPU6EIQhDoOhL6OvSY/wA0XmcHiLazf8k/ubPxf7mng/XeJF2Amq7JS6MDARGxjjtgsj3xP+J/Sfps/wCiwsMYT6UWZ/fiXYz9Z2z7S7RfvKcHzMWmezE3ijcWHLnNr7R4Dn1HjmWLqWRleYOHkL3lq5lOIvOXQRb9j6AiaSJdZ0l953xUqwrv2TZIiz3Slgb+uJpTEJkIlf8AhPRwKQDVcEDROHR7pfeuz3MRst9D6NaGn06zZ4I1o/mZJfmW7aS54ihmwBtQEFunozCksAIFgc5mNVhlWmq1h6sMGHa8rj81+QNebg2LHAr5jCuVgYdlbRSjri5Z8TKAPaA7VyxlPM0uWwXflI3iaszp+sVAV5ZQtxve+mEzUEwBNtcuk35IuKG1j5WS7bNoZGu8vx/WcbIy35WW7+8XRKe0bcoU3g/coIO/BlQEgFpbNayyAuwmLOLlaDTh0omEQqoK+YGJZjsWsusUWmDuEazfdfwbXtMQKg9Yr08cEtF0dBNC9KwOEG1WU8SkcrfbH/IIW7sD97xew4FxVbEvWqVVXHYgnatlGjN+swBfQLG/tKha3dqoTf8ASAX3zscS0RBg7F+r43hkZ80rBmYWmtmr6DoQhCEOghPIvknhPvlekdidhcXHdOzb0M+PW8IEozuQDRncn/MzhJLjLR5/ubueCOHyP8TKOe2G/etJVZOEFDmDLNpi1mcm0OatVEPjROI+cQRYPiOu+viX8u+RGW9ss0HMQziHVjihNSNwbpzc2CYOOj/HXRwKtCJcMbDhn2E16XrPtLB2Nce0VdXos9D6NfzNDpoW6SxMvxN6xCismBAuLtLZXZK6BHcq72vxO9BnNfsTtWfkhcoTtTxe1ES1ds7+YnHWmeDh9oMO1tE15Es2iqBVviBl+APnEXsMoM95RuMXo8bz1TePSoc4q2cXG2FoOYPPCoas7Qm0XcecMXMOxo4PpN3h35/mFUzyNrf0mjkYL1du/dNcO0G6wM1dOeJdthdpV8m0ApLg5u7+YutuPT1Ma4FqFXYdS4Dd5o1btXmr0hsR010NaDMATlSmIZKrW4mraiviM6w0bauqAbgaVsprbk1LuEqYBnU1Ct84tS9UuMaG6FuKtZvMidGh2X
...[truncated 28 chars]

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The embedded project context includes identity and user-facing guidance written in Chinese, and the assistant responses shown in the log consistently present content in Chinese without offering any language choice. For a general-purpose assistant context, this reflects a language/locale constraint that is not explicitly user-selected or justified as region-specific.

Content

No source excerpt is available for this finding.