Find Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:14 AM UTC
• Version: 1.3.5

Overview

The skill mostly matches its directory-search purpose, but it asks the agent to profile local user data and to contact unknown remote agents in ways that need closer review before install.

Install only if you are comfortable with an agent directory tool that contacts OceanBus and may publish searchable profile metadata. Before using it, avoid letting it scan installed skills or derive personal attributes, review every name/tag/description before publishing, and require confirmation of the exact recipient and message before it contacts third-party agents.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:97
• Finding: Excessive Local Environment Profiling Beyond Core Skill Requirements<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:97-99` **Vulnerability Type**: Excessive local reconnaissance and sensitive attribute inference **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown | **其他已安装 skill** | 检查 `~/.openclaw/workspace/skills/` 目录 | ocean-agent → 保险；health-checkup → 体检/医疗；china-top-doctor → 医疗/专家；ocean-chat → 社交活跃 | | **系统用户名** | Windows: `echo %USERNAME%`；Mac/Linux: `whoami` | 黄页显示名的参考 | | **对话历史** | 本轮对话中用户提过的身份、职业、需求 | 最直接的身份信号 | ``` ### Technical Analysis The Skill instructs the host agent to enumerate other installed Skills, retrieve the operating-system username, and combine those values with information from the conversation to infer the user's identity, occupation, interests, health-related needs, insurance-related activity, and social behavior. Although the surrounding workflow requests general permission before performing the analysis, the requested access is broader than necessary for the Skill's principal Yellow Pages search and publication functions. The permission request also does not clearly separate: - Reading the installed-Skill directory. - Retrieving the operating-system account name. - Inferring potentially sensitive personal attributes. - Using those inferred attributes in later publication or remote communication. This violates least-privilege and data-minimization principles. In particular, the presence of health, insurance, or communication Skills does not reliably establish the user's personal characteristics, yet the instructions encourage the agent to create such inferences. ### Attack Path 1. A user activates the Skill and accepts the broadly worded analysis request. 2. The host agent inspects `~/.openclaw/workspace/skills/`. 3. The host agent executes an account-identification command such as `whoami` or reads `%USERNAME%`. 4. Installed Skills are mapped to inferred interests or sensitive characteristics. 5. Those inferences are combined with identity, occupation, and requi ...[truncated 985 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove operating-system username collection from the automatic analysis workflow. 2. Ask the user directly for any desired display name rather than deriving it through `whoami` or `%USERNAME%`. 3. Do not enumerate the entire installed-Skill directory by default. 4. If installed-Skill analysis is retained, provide a separate, explicit consent prompt that identifies: - The exact directory to be inspected. - The exact metadata to be read. - The purpose of reading it. - Whether any derived information will leave the local environment. 5. Avoid inferring sensitive characteristics from installed software. Treat installed Skills only as optional capability indicators, not evidence of personal health, insurance status, occupation, or social activity. 6. Display all inferred values to the user and require affirmative confirmation before using them in a profile, publication, or outbound message. 7. Minimize retention of discovered local metadata and do not write it to persistent memory unless separately requested. 8. Ensure refusal does not reduce core search and publication functionality. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:178
• Finding: Untrusted Remote Agent Responses Are Interpreted as Actionable Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:178-194` **Vulnerability Type**: Indirect prompt injection through third-party agent responses **Risk Level**: High ### Vulnerable Code Snippet ```markdown 用户确认 → 给每家发 --help: oceanbus send <OpenID1> "--help" oceanbus send <OpenID2> "--help" oceanbus send <OpenID3> "--help" 各家回复 --help，主控 LLM 理解后提取对比: 🏥 美年大健康 — 基础/深度/心脑血管/肿瘤/VIP 共 8 种套餐 团检: 50人以上 8 折, 可上门, 含报告解读 🩺 爱康国宾 — 基础/深度/女性/男性/高端 共 6 种套餐 团检: 30人以上 85 折, 需到店 🏥 慈铭体检 — 基础/深度/肿瘤/VIP 共 5 种套餐 团检: 20人以上 9 折, 可上门, 含早餐 主控 LLM 根据 --help 中的命令描述，自动发送询价: oceanbus send <OpenID1> "recommend-checkup --count=50 --type=团检 --budget=1000-2000" oceanbus send <OpenID2> "recommend-checkup --count=50 --type=团检 --budget=1000-2000" ``` ### Technical Analysis The workflow retrieves free-form `--help` responses from previously unknown agents and directs the controlling language model to interpret those responses before automatically constructing and sending follow-up commands. A Yellow Pages entry and its associated remote agent are outside the local trust boundary. Their responses may contain adversarial instructions rather than legitimate command documentation. The Skill does not define: - A machine-readable response schema. - Separation between remote data and trusted instructions. - An allowlist of commands and parameters. - Validation of recipients, argument types, or sensitive values. - Prompt-injection detection or instruction-neutral parsing. - Mandatory confirmation of the exact follow-up payload. - A prohibition against following embedded URLs or requests for local information. Consequently, a malicious remote agent could make its `--help` response resemble authoritative operational guidance and attempt to alter the host agent's goals or induce unintended actions. The vulnerability arises from as ...[truncated 1995 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat every Yellow Pages profile and remote message as untrusted data, never as trusted instructions. 2. Replace free-form `--help` responses with a versioned, machine-readable JSON schema containing only declarative fields such as: - Service name and version. - Supported command identifiers. - Parameter names, types, limits, and required status. - Explicit side-effect classifications. 3. Validate responses against a strict schema and reject unknown properties, executable content, embedded instructions, URLs, and malformed values. 4. Maintain a local allowlist of permitted command names and parameter types. A remote agent must not be able to define arbitrary host actions. 5. Parse remote responses using deterministic code rather than asking the controlling model to interpret unrestricted prose. 6. Clearly delimit remote content in the model context and state that it must not modify system instructions, safety constraints, tool policies, or workflow goals. 7. Require explicit user confirmation before every follow-up message. Display: - The complete destination OpenID. - The exact outbound payload. - Any personal or business data included. - The expected side effects. 8. Do not automatically follow links, execute commands, read local files, reveal secrets, or contact additional recipients based on remote content. 9. Apply data minimization to follow-up messages and avoid forwarding unrelated conversation history. 10. Add adversarial tests covering responses that attempt to override instructions, request credentials, redirect recipients, embed shell commands, or conceal additional directives. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

const { createOceanBus } = require('oceanbus');

// ── Constants ────────────────────────────────────────────────

const VERSION = '1.3.1';

const TEMPLATES = [
  { id: 'restaurant',    name: '餐饮',     emoji: '🍲', description: '餐厅、火锅店、外卖',                       capabilities: ['show-menu','check-availability','make-reservation'], questionCount: 6 },
  { id: 'insurance',     name: '保险',     emoji: '🔶', description: '保险咨询、需求分析、计划书',               capabilities: ['about','ask-insurance','needs-analysis','generate-proposal','schedule-consultation'], questionCount: 7 },
  { id: 'checkup',       name: '体检',     emoji: '🩺', description: '体检套餐、预约、报告解读',                 capabilities: ['list-packages','package-detail','recommend-che

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly encourages users to publish their agent so others can find them in a global directory, but it does not clearly warn that the submitted name, tags, description, and associated identifier will be transmitted to and discoverable on the OceanBus network. This creates a privacy and consent risk: users may expose personal, business, or identifying information more broadly than intended because the documentation frames publishing as simple onboarding rather than public disclosure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The quick-start section gives a one-command publish example without any adjacent warning that the profile will be broadcast to a searchable global directory. Because quick-start commands are often copied verbatim, this omission materially increases the chance that users will unintentionally disclose identifying or business-sensitive information.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs the agent to perform networked operations such as OceanBus discovery, publishing, and messaging, but it does not declare an explicit tool scope or allowed-tools boundary. This creates a permission-transparency gap: users and hosts may not realize the skill can contact remote services or third-party agents, increasing the risk of unintended outbound communication.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill description and activation guidance are broad enough to match generic help-seeking requests such as finding someone, searching for help, or reaching out to an expert. Overbroad triggering can cause the skill to activate in situations where the user did not intend third-party discovery or publication, leading to confusion and potentially unnecessary data sharing.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The operational instructions, prompts, examples, and user interaction flows are written to conduct the experience in Chinese, with no indication that the user may choose another language. This is a language policy issue because it imposes a specific locale without opt-in or a documented region-specific justification.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The consent prompt asks generally to 'analyze installed tools' but omits a precise privacy warning that this includes inspecting the local skills directory and reading the system username. Users cannot give meaningful informed consent if the prompt does not clearly identify the local data sources and the profiling purpose.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill directs inspection of the local skills directory, system username, and conversation history to infer a user profile, which exceeds straightforward agent discovery/publishing. Even though it asks once for permission, the scope of collection is broad and behavioral profiling of local environment data can reveal sensitive personal or professional information unrelated to the requested task.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs collecting installed skills, local username, and conversation history to infer profession, interests, and likely publishable services. This natural-language profiling creates a meaningful privacy risk because it aggregates local and behavioral signals into user inferences that may be sensitive and unnecessary for basic directory search/publishing.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The rule 'if the user expresses intent to find an agent/service/information, search the Yellow Pages' is overly broad and can route many ambiguous requests into external discovery. This increases the chance of unsolicited network activity and disclosure of user interests without a sufficiently clear boundary between local assistance and external lookup.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The flow proposes contacting discovered third-party agents with `--help` and later structured requests, but does not prominently warn the user that their interest, tags, and possibly business needs will be sent externally. This is dangerous because merely querying or messaging can leak sensitive intent and can trigger remote side effects on systems the user has not vetted.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation claims find-agent 'only handles finding,' but later instructs it to send `--help` and other messages to discovered agents. This mismatch is dangerous because users may believe the skill is passive discovery-only when it actually initiates third-party communications, which can disclose interest, metadata, or trigger remote actions.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The help text and examples include Chinese-only user-facing strings, and the script also emits Chinese messages in normal operation. This imposes a specific language on users without any opt-in or documented locale constraint, which matches the language/locale policy violation category.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The unpublish command performs a removal operation immediately via ob.l1.yellowPages.unpublish() and only prints a success message afterward. There is no confirmation prompt, pre-action warning, or other visible disclosure before this irreversible registry change occurs.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The publish path gathers the agent address and metadata and transmits them through ob.l1.yellowPages.publish(publishOpts). Although publishing is part of the command's purpose, the code itself does not provide any explicit pre-send disclosure about what data will be transmitted.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

],
  "license": "MIT-0",
  "dependencies": {
    "oceanbus": "^0.9.0"
  }
}

• Confidence: 91% confidence
• Finding: The dependency uses a caret range (^0.9.0), which allows npm to install newer compatible versions within the 0.x series. That creates supply-chain risk because a compromised or breaking upstream release could be pulled in without explicit review, especially for a discovery/publishing skill that relies on an external package for core functionality.

Static analysis

No suspicious patterns detected.