T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:175- Finding
Overbroad Access to Persistent Agent State and Personal Knowledge Stores
- Content
View full analysis
- Remediation
View remediation
Security audit
K Deep Research
Security checks for vulnerabilities and agentic risk
Overview
This is a research-methodology skill, but it asks agents to use broad local notes, persistent memory, recurring automation, sub-agents, and a hard-coded private search endpoint without enough user control.
Review before installing. Use this only in a tightly sandboxed workspace, disable or narrow alwaysActive activation, approve any filesystem locations explicitly, avoid broad personal vault or home-directory reads, configure search endpoints yourself instead of using the hard-coded private address, and require confirmation before cron, heartbeat, sub-agent, notification, MEMORY.md, or TASKS.md changes.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/sourcing-strategies.md:19- Finding
Hard-Coded Private-Network Search Endpoint May Disclose Research Queries
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Rogue AgentSelf-Modification, Session Persistence
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description presents the skill as an active deep-research methodology that performs substantive research tasks and produces exhaustive cited reports. The supplied code chunk does not implement any research functionality. Instead, it is a repository/skill validation utility focused on file existence, metadata checks, reference-file presence, and a basic secret scan. This is a materially different primary purpose from the declared behavior, so it should be flagged as a mismatch.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is configured as alwaysActive while also describing a very broad 'ANY domain' research capability. That combination can cause the skill to activate in many contexts beyond clear user intent, increasing the chance of unsolicited tool usage, instruction hijacking of normal conversations into research workflows, or unnecessary exposure of user prompts to search tools.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md - [ ] Weekly: Review token costs, check for anomalies - [ ] Weekly: Audit task completion rates - [ ] Monthly: Archive old memory logs, consolidate MEMORY.md - [ ] Monthly: Update skills, check for security advisories - [ ] Quarterly: Review HEARTBEAT.md relevance - [ ] Quarterly: Evaluate model stack (new models available?)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 2. Least privilege: Allowlist mode, unlisted binaries trigger `ask:always` 3. Write scoping: Operations constrained to `$WORKSPACE_ROOT` 4. HITL for side-effects: Manual approval for state changes/network calls 5. Path traversal prevention: Strict workspace root prevents .ssh/.env access **Prompt injection remains an unsolved problem across all agent frameworks.**
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - No citations or self-referential - Anonymous without demonstrated expertise - Methodology absent or vague - Absolutist claims without caveats - Hidden funding/affiliations - Contradicted by primary evidence
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger phrase 'When research is requested' is ambiguous and can match a wide range of ordinary user requests. In an agent setting, ambiguous activation conditions can cause the skill to overtake normal assistant behavior, initiate unnecessary file loads or searches, and broaden collection of external data without sufficiently explicit consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The instruction to output as an "Obsidian-ready .md file" with mandatory YAML frontmatter forces a specific format regardless of user preference. This is a natural-language policy concern because it imposes a workflow/output constraint without offering the user a choice or opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly instructs writes to persistent memory and task files in autonomous contexts without requiring a user-facing warning or confirmation. Persistent writes can alter future agent behavior, store sensitive user data, create unintended long-lived state, and be abused for covert persistence or workflow manipulation if the skill is triggered unexpectedly.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation criteria for adversarial analysis are broad and subjective, such as 'contested topics,' 'institutional behavior,' or 'suspicious patterns.' In an autonomous or semi-autonomous research workflow, this can cause the agent to over-apply adversarial lenses, increasing false suppression narratives, distrust amplification, and biased evidence interpretation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The 'counter-intelligence for researchers' section introduces adversarial framing and defensive tactics that exceed the declared purpose of systematic research. Even without explicit malicious commands, this normalizes covert-thinking patterns and operational caution that can be repurposed for evasion or for escalating suspicious interpretations in ambiguous situations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The guidance to vary search patterns, use low-telemetry tools, and archive evidence moves beyond neutral research methodology into operational tradecraft for reducing observability. In a general-purpose agent skill, this can help users or downstream agents conduct sensitive investigations while intentionally avoiding monitoring, which is not necessary for ordinary report generation and broadens misuse potential.
- Content
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
md - Session key: `agent + channel + scope + peer` **Compaction (Context Window Management):** When sessions exceed context window, OpenClaw compacts (summarizes/truncates) older messages. **What Compaction Destroys:** - File paths and exact commands
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The example for the
descriptionfield says to write the trigger phrase like "describing to a coworker in chat," which encourages natural conversational phrasing rather than narrow activation language. In a markdown reference about skill authoring, this can lead authors to create broad triggers that overlap with everyday speech and increase accidental invocation risk.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The guidance says to use "words users actually type" for trigger matching, but it does not define boundaries for how specific those words must be or what kinds of common phrases to avoid. Without explicit exclusion rules or negative examples, authors may choose vague phrases that collide with ordinary requests.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 2. Classify: permission, dependency, config, or logic failure 3. Isolate: disable optional steps, test smallest failing unit 4. Confirm: one fix at a time, re-run same test 5. Document: write cause/fix into SKILL.md guardrails **Session Snapshot Gotcha:** OpenClaw snapshots skills when session starts. Config changes may need new session.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The template instructs authors to use a generic 'description field' for how users ask for the task and even suggests '[trigger phrase matching user language]' without requiring narrow phrases, scope limits, or negative examples. This can lead to skill manifests that match broad everyday language and cause unintended invocation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The rubric hard-codes politically loaded categories like 'state propaganda' and 'institutional narrative enforcement' into a universal credibility scoring system, which biases evaluation before evidence is assessed. In a research skill, this can systematically steer an agent toward distrusting authoritative or institutional sources and overvaluing contrarian narratives, degrading neutrality and increasing susceptibility to misinformation or conspiratorial framing.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
text 1. CONTEXT CHECK → Existing knowledge base / prior research 2. QUERY ELABORATION → Expand scope, plan search strategy 3. MULTI-SOURCE → Gather from diverse sources (40-80+ for deep) 4. PATTERN ANALYSIS → Cross-domain recognition, temporal/actor/info flow 5. CREDIBILITY SCORE → 0-10 scale on ALL sources, merit-based
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The instruction 'Load when researching proactive agents, workflow orchestration, or autonomous system design' is broad and lacks clear boundaries or exclusion conditions. Phrases like 'workflow orchestration' and 'autonomous system design' can apply to many ordinary tasks, increasing the chance of unintended invocation of this reference skill.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The standard report template hard-codes 'methodology: k-deep-research-v2', and the same pattern appears in other sections and references. This imposes a specific organizational convention in the output format without documenting opt-in, alternatives, or why the constraint is required for all uses.
- Content
Static analysis
No suspicious patterns detected.