Ae1
High
- Category
- analysis-evasion
- Content
find ~/workspace/agent/skills -name "SKILL.md" | while read f; do
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
技能编辑器
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent AgentSkills editing guide with no bundled code, persistence, credential access, or hidden execution behavior.
Install this if you want Chinese-language guidance for editing OpenClaw/AgentSkills files. Review the bilingual description convention if it does not fit your project, and run any example directory-wide metadata checks only on skill folders you intend to inspect.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Vague Triggers
Medium
- Confidence
- 89% confidence
- Finding
- The trigger description includes broad terms such as editing, auditing, and metadata checks that can match many ordinary user requests and cause unintended activation. In an agent skill system, over-broad routing increases the chance that this skill intercepts tasks outside its intended scope, which can lead to incorrect behavior, unwanted file modification guidance, or bypass of more appropriate specialized skills.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The description text is in Chinese and later guidance mandates that descriptions retain Chinese and English keywords, which imposes a language expectation. The file does not offer user opt-in, language selection, or a documented region-specific justification for this locale constraint.
Natural-Language Policy Violations
Medium
- Confidence
- 93% confidence
- Finding
- The requirement says the `description` must contain Chinese and English keywords, which is a natural-language policy constraint applied to all edited skills. Because no user choice or justified compliance reason is provided, this appears to force a specific locale practice.
Natural-Language Policy Violations
Medium
- Confidence
- 91% confidence
- Finding
- The manifest uses Chinese for both the display name and description, with no indication that language is configurable or intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when a skill imposes a specific language without user opt-in or documented regional justification.
Natural-Language Policy Violations
Low
- Confidence
- 90% confidence
- Finding
- This checklist item instructs editors to retain Chinese and English keywords, which operationalizes a fixed bilingual policy during maintenance. The document does not indicate that this is optional, user-selected, or justified by a narrow regional/compliance context.
Vague Triggers
Low
- Confidence
- 78% confidence
- Finding
- This manifest describes the skill's purpose in broad terms ('edit, improve, and review AgentSkills guidance') but does not specify when the skill should activate or what concrete trigger phrases should invoke it. In a manifest file, that ambiguity can make invocation scope unclear and increase the chance of unintended activation.
Static analysis
No suspicious patterns detected.