Lucky Build Execution Protocol

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:37 AM UTC
• Version: 1.0.1

Overview

This skill is a project workflow helper, but it also mandates automatic commits, persistent logs, remote SSH, external delegation, and execution of an unaudited local script without enough user control.

Install only if this is a private, trusted workflow for the named environment and you are comfortable with automatic commits, persistent logs, SSH to the specified host, and Jinx delegation. Before use, remove or gate the hard-coded SSH and curl steps, require approval before commits or outbound requests, stage only reviewed files, and verify any external enforcement script separately.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:8

Finding

Automatic Workflow Activation Can Override the Agent's Intended Session Behavior

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:26

Finding

Unnecessary Access to Persistent Agent Memory and Prior Session Records

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:61

Finding

Hard-Coded Remote SSH Access Uses a Local Private Key Without Authorization Checks

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:99

Finding

Mandatory External Jinx Delegation Can Disclose Project and Session Data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:55

Finding

Indiscriminate Git Staging Can Commit Secrets and Unrelated User Changes

Content

View full analysis

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:157

Finding

Mandatory Execution of a Mutable Script Outside the Audited Project

Content

View full analysis

" "" "" ``` - **If it exits non-zero: you are NOT DONE. Fix every failure before proceeding.** - **Do NOT mark the task done, do NOT move to the next task, do NOT pass Go.** - **This gate checks:** memory log exists with spec quote + verification + Jinx follow-up, tests pass, git clean, NEXT_TASKS.md updated ``` ### Technical Analysis The Skill mandates execution of `~/.openclaw/workspace/scripts/enforce.sh`, which is outside both the audited Skill package and the target project. The script's content, owner, permissions, integrity, and provenance are not checked before execution. A mutable file at this path can be replaced or modified independently after the Skill is reviewed. When invoked, it runs with the Agent process's operating-system privileges and receives project, task, and memory-related arguments. The Skill also supplies placeholders without defining safe argument construction or validating whether values can contain control characters or other problematic content. This is a local tool-hijacking risk: a command that appears to be a legitimate enforcement gate can execute attacker-controlled logic if the referenced script is compromised. ### Attack Path 1. An attacker obtains write access to `~/.openclaw/workspace/scripts/enforce.sh` or to a parent directory that permits replacement. 2. The attacker modifies the script to perform arbitrary actions, such as reading credentials, altering files, or creating persistence. 3. The Skill completes a task and reaches its mandatory enforcement gate. 4. The Agent executes the compromised script without checking its hash, ownership, permissions, ...[truncated 723 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Hard-coded SSH access to a specific host with a specific key path is a powerful external capability that is not justified for a build-execution protocol. This can cause unintended outbound connections, leak environment or operational details, and normalize use of sensitive credentials in a routine workflow, increasing the blast radius if the skill is triggered in the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The auto-trigger conditions are broad enough that normal phrases like 'keep going' or 'work on [project]' can invoke a highly stateful protocol with testing, commits, file edits, and remote checks. Over-broad triggering is dangerous here because the skill performs consequential actions automatically, making accidental activation more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill mandates automatic git commits and backup/state-changing file operations without clearly warning that it will modify project history and working state. Because the protocol can auto-trigger, this can create unauthorized commits, overwrite intended workflows, and persist potentially sensitive intermediate states without the user's explicit consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

- If the project uses git: `git add -A && git commit -m "checkpoint: session start — N tests passing"`
- If no git: copy critical files to a backup location
- **Why:** If task 3 breaks something silently, you can diff back to this known-good state
- Create a new checkpoint after each completed task

□ **6. Check Jinx Status**
- `ssh -i ~/.ssh/lucky_to_mac luckyai@100.90.7.148 "curl -s http://localhost:3001/status"`

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is presented as a local build-queue workflow, but it silently expands scope to include remote SSH access to a hard-coded host and HTTP status checks. That creates an unjustified trust boundary crossing: invoking the skill for ordinary project work can trigger access to external infrastructure, expose credentials or metadata, and couple local execution to a remote service the user may not expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs remote SSH and HTTP operations without upfront warnings about network access, credential usage, privacy exposure, or impact on external systems. In context, this is especially risky because the skill auto-triggers and presents these actions as mandatory, which can lead users or agents to contact remote infrastructure without informed consent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

md

- [ ] No regressions (test count ≥ baseline)

**Red Lines (Never Cross):**
- Never mark a task done without verification
- Never decrease test count
- Never start a new task with failing tests
- Never continue past 70% context without wrapping up

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The stated purpose is to work through an ordered build queue with verification and session handoff. Requiring users to evaluate whether work should be generalized into a reusable skill and to create one if substantial expands the behavior beyond build-task execution into skill-authoring and capability expansion, which is not reflected in the manifest.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.