T09 · Insecure Skill Coding Practices
Error
- Location
scripts/delete_personality.py:43- Finding
Directory Traversal Enables Recursive Deletion Outside the Personality Store
- Content
View full analysis
- Remediation
View remediation
Security audit
Personality Switcher
Security checks for vulnerabilities and agentic risk
Overview
The skill's personality-switching purpose is mostly disclosed, but its scripts contain clear path-validation flaws that can load or delete files outside the intended personality folder.
Review this skill carefully before installing. Its core idea is understandable, but the current implementation should be fixed to strictly validate personality names, reject traversal and absolute paths, constrain all resolved paths to direct children of the personality directory, and protect heartbeat restoration from malformed state before it is trusted with persistent assistant identity files.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/rename_personality.py:38- Finding
Unvalidated Rename Source Can Move External Directories into the Personality Store
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/switch_personality.py:27- Finding
Traversal-Based Personality Activation Can Persist External Instructions Through Heartbeat Restoration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a full personality management skill focused on creating personas, listing them, switching between them, persistence across sessions, heartbeat restoration, and atomic backup/rollback safeguards. The actual code chunk does not implement those user-facing capabilities. Instead, it performs backup maintenance only: it inspects backup metadata, deletes old backups according to --keep and --days parameters, and outputs a JSON cleanup summary. While backup handling is tangentially related to the declared system, this code's primary purpose is materially different and narrower than the declared functionality, so this is a clear description/behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents a broad personality management and switching feature set, with strong guarantees around persistence, restoration, and safe switching. The actual code chunk is narrowly scoped to creating a personality folder and validating naming constraints. While folder creation is consistent with part of '/create-personality', the major advertised behaviors—switching, listing, auto-generating persona files, persistence, heartbeat restoration, and backup/rollback—are absent from this code. Therefore the declared description does not accurately represent what this supplied code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This code chunk's primary purpose is deleting a personality, not creating or switching among personalities as described. While it does perform a limited switch to 'default' when deleting the active personality, that switch is incidental to deletion. The declared description emphasizes creation, activation, persistence, heartbeat restoration, and backup/rollback safeguards, none of which are implemented here. The undeclared destructive capability—removing personality folders from disk—is materially different and should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises substantive personality lifecycle functionality: listing/activating personalities, creating personas with auto-filled attributes, persistence across sessions, heartbeat restoration, and atomic switching with backup/rollback. The supplied code does none of that. Its only behavior is to open a local gateway config file and add Telegram custom command metadata entries. While registering commands could support a larger personality system, this code chunk by itself is only configuration plumbing and has a materially different primary purpose. It also performs a Telegram-specific config modification that is not disclosed in the description, and registers rename/delete commands that are absent from the declared purpose. Therefore this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a broad personality lifecycle feature centered on creating, listing, activating, persisting, and safely switching personalities. The actual code chunk has a materially different and much narrower purpose: renaming a personality directory. While updating state and attempting rollback are loosely related to personality management, they do not implement the declared core behaviors. The code also exposes an undeclared capability—renaming personalities—which is not mentioned in the description. Therefore, this is a clear description/behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The code is broadly consistent with the switching portion of the description: it does atomic switching, creates a backup before switching, persists current changes, updates state, verifies integrity, and rolls back on failure. However, the declared purpose describes a larger skill that can also create personalities, list/activate them via commands, and restore across session boundaries and conversation compacting with heartbeat restoration. None of those additional capabilities are present in this code chunk. Also, the code includes an undeclared operational capability to delete old backups during cleanup. Because the provided code materially implements only a subset of the advertised functionality and includes some undeclared behavior, this is a description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a personality-switching system with persona creation, persistence across sessions, heartbeat restoration, and safe atomic switching with backup/rollback. The actual code does none of that. Its primary and only behavior is to open a local config file under ~/.openclaw/openclaw.json and remove several Telegram custom command entries. This is a materially different purpose and resource access pattern from the declared functionality. Therefore this is a clear description-behavior mismatch.
- Content
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 94% confidence
- Finding
This skill’s core purpose is to replace SOUL.md and IDENTITY.md, which are effectively prompt/persona control files for the assistant, and to make those changes immediately active and persistent. That is a memory/prompt-manipulation capability with significant security implications because a crafted personality can alter the assistant’s behavior, safety boundaries, or trust model across sessions.
- Content
Ready: Use /personality sage to activate
text **After Creation:** The new personality is ready to use immediately. Edit SOUL.md and IDENTITY.md in the personality folder to refine further if desired. **Technical:** Agent chooses name to keep personality references concise (1-2 words). Name is validated for uniqueness and format automatically.
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
python "code": "personality_not_found" } # Validate new name is_valid, error_msg = validate_personality_name(new_name) if not is_valid: return {
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
python "code": "personality_not_found" } # Validate new name is_valid, error_msg = validate_personality_name(new_name) if not is_valid: return {
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
sh fi fi # Delete state file completely (it's part of this skill's state) STATE_FILE="${PERSONALITIES_DIR}/_personality_state.json" if [ -f "$STATE_FILE" ]; then rm "$STATE_FILE"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill describes file read/write behavior across the workspace, modifies root personality files, and maintains state/backups, but does not declare any explicit tool scope or permissions boundary. This increases risk because a host may grant broader filesystem access than users expect, and the skill’s behavior includes persistent modification of sensitive prompt/configuration files.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
The skill explicitly persists personality state across session boundaries and restores it automatically on heartbeat, extending the lifetime of any malicious or unsafe persona modification. Persistence makes prompt-level compromise more dangerous because unwanted behavior can survive restarts, compaction, and operator attempts to reset conversational state.
- Content
md --- name: personality-switcher description: Create and switch between AI assistant personalities. Use /personality to list and activate saved personalities. Use /create-personality to design new personas with auto-filled SOUL and IDENTITY. Personalities persist across session boundaries and conversation compacting with automatic heartbeat restoration. Atomic switching with backup and rollback safeguards. Always backs up current state before switching. --- # Personality Switcher Skill
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill advertises automatic deletion of old backups but does not prominently warn that this is irreversible or could remove the only recoverable copies of prior personality states. Because the skill manages persistent agent state files, silent retention cleanup can cause unintended loss of auditability and rollback capability.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
Automatic deletion decisions are made by the system without an explicit per-run user confirmation, and the action affects persistent stored state. In a skill that modifies identity/personality files and backups, autonomous cleanup can unexpectedly remove recovery points and amplify damage from mistakes or malicious state changes.
- Content
Backups are stored in a dedicated folder (not scattered at workspace root). When you switch personalities:
- A timestamped backup of the previous personality is created
- Automatic cleanup runs — keeps the 10 most recent backups by default
- Old backups are automatically deleted to prevent clutter
Manual Cleanup:
bash
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
bash # List available backups ls -la ~/.openclaw/workspace/personalities/backups/ # Copy backup files back to workspace root if needed cp ~/.openclaw/workspace/personalities/backups/current_<timestamp>/SOUL.md ~/.openclaw/workspace/SOUL.md
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
This skill is explicitly designed to persist personalities across sessions, and the installer creates persistent directories and state to support that behavior. While persistence is aligned with the feature, it still creates long-lived state that can retain prompts, identities, or behavioral configuration beyond a single session, increasing the risk of unauthorized reuse, tampering, or privacy issues.
- Content
sh BACKUPS_DIR="${PERSONALITIES_DIR}/backups" HEARTBEAT_FILE="${WORKSPACE}/HEARTBEAT.md" # Create personalities and backups directories mkdir -p "$PERSONALITIES_DIR" mkdir -p "$BACKUPS_DIR"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script creates directories, copies SOUL.md and IDENTITY.md into persistent storage, and overwrites state-related files without any confirmation or preview. Silent modification of user workspace state is risky because it can unexpectedly alter behavior, duplicate sensitive content into new locations, and make rollback difficult if the install was unintended or the copied files contain private data.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The installer modifies HEARTBEAT.md to inject an executable command that will later run a Python restoration script. Persistently inserting executable behavior into a recurring workflow creates an implicit autorun mechanism, which increases the blast radius of the skill and can be abused if the referenced script is modified or compromised.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The installer invokes a Telegram command registration script even though the stated skill purpose is local personality switching and persistence. Adding an external integration during install expands the trust boundary, may create bot-facing capabilities or networked side effects, and is not transparently disclosed or necessary for the core feature shown in this file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code performs a recursive folder deletion with shutil.rmtree, which is a destructive and irreversible operation. While the module docstring says it deletes a personality, there is no confirmation prompt or user-facing warning immediately before the deletion itself.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script edits global skill-management state by deleting its metadata file, removing its directory, and mutating the shared clawhub lock.json. These actions affect the broader installation registry and can cause inconsistent or unauthorized state changes if paths or assumptions are wrong, especially because the skill's stated purpose is personality switching rather than package-manager maintenance.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The uninstall script invokes an external command-unregistration helper for Telegram, which reaches beyond simple local cleanup of personality files. In the context of a personality-switching skill, modifying external bot command state is a broader side effect that could remove commands unexpectedly, and the action is performed without visible validation that the commands belong exclusively to this skill.
- Content
Static analysis
No suspicious patterns detected.