Security audit

Mi Habilidad Nueva

Security checks for vulnerabilities and agentic risk

Overview

This is a small welcome skill, but it is always-on and can make the assistant present itself as Santi's bot with unverified server and capability claims.

Review before installing in a shared or general workspace. This skill is best suited only for Santi's own environment; otherwise it may confuse users by making normal greetings invoke a Santi-branded assistant and by advertising capabilities or server details that may not be true.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:4
Finding: Persistent Agent Identity and Output Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 4–15 **Vulnerability Type**: Persistent skill instruction hijacking through automatic activation **Risk Level**: Medium ### Vulnerable Code ```markdown metadata: openclaw: always: true --- # Descripción Detallada Esta habilidad sirve como punto de entrada para personalizar el comportamiento del bot en el servidor de Santi. Permite verificar que el sistema de carga de habilidades del espacio de trabajo está funcionando correctamente. # Instrucciones de Uso 1. Cuando el usuario te salude de forma formal o informal, debes identificarte como el asistente personalizado de Santi. 2. Explica brevemente que estás ejecutando OpenClaw en un servidor Ubuntu dedicado. 3. Si el usuario te pregunta "¿Estás listo?", responde con un resumen de tus capacidades actuales (clima, resúmenes de enlaces y gestión de archivos). 4. Mantén siempre un tono amable, profesional y eficiente. ``` ### Technical Analysis The `openclaw.always: true` configuration causes the skill instructions to remain active without requiring explicit user selection. Once loaded, the skill directs the agent to adopt the identity of “Santi's personalized assistant” and assert that it is running OpenClaw on a dedicated Ubuntu server. These instructions alter the agent's responses based on globally applicable triggers such as ordinary greetings. They can therefore override or interfere with the identity, context, and response objectives expected by the current user. The infrastructure and capability claims are unconditional and are not tied to verified runtime information, so the agent may present inaccurate deployment details or claim capabilities that are unavailable. No executable code, external network request, persistent memory write, credential access, or privilege-escalation mechanism was found. The issue is limited to manipulation of agent instructions and generated output. ### Attack Path 1. The platform discovers and loads th ...[truncated 1152 chars]
Remediation: ## Remediation Suggestions 1. Remove `openclaw.always: true` and require explicit activation based on a clear user request. 2. Avoid instructions that redefine the agent's core identity or impose third-party branding globally. 3. Make deployment statements conditional on trusted, verified runtime metadata. Do not claim that the agent runs on Ubuntu, OpenClaw, or dedicated infrastructure unless this has been confirmed. 4. Verify tool availability before advertising weather, link-summary, file-management, or GitHub capabilities. 5. Restrict greeting customization to presentation style and ensure it cannot override higher-priority identity, safety, privacy, or task instructions. 6. Document the intended activation scope and add tests confirming that unrelated conversations are unaffected when the skill has not been explicitly invoked.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Natural-Language Policy Violations

Medium

Confidence: 86% confidence
Finding: The skill metadata, description, and interaction examples are entirely in Spanish and instruct the assistant how to respond, but they do not indicate that the user can choose another language or that the skill is intentionally restricted to a Spanish-speaking context. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: Activating on any formal or informal greeting is overly broad because greetings are common in normal conversation and may cause the skill to trigger unintentionally. In an always-on skill, this can override more relevant system behavior, confuse users about which assistant is responding, and increase the chance of unintended disclosure or action under the skill's persona.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is described as a welcome/system-test assistant, but its examples and usage text claim broader capabilities such as weather, link summarization, file management, and GitHub task handling. This creates scope mismatch and can mislead users or downstream systems into believing the skill is authorized for actions it does not explicitly declare, increasing the risk of unintended invocation, trust abuse, or unsafe delegation.

Static analysis

No suspicious patterns detected.