Conversational Ai Assistant

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:51 PM UTC
• Version: 0.1.0

Overview

This is a disclosed, instruction-only conversational layer for a Greek accounting system, with sensitive data access and workflow routing that fit its stated purpose and include confirmation gates for write actions.

Install only in an OpenClaw accounting environment where users are authorized to view the client and financial data this assistant can surface. Prefer preinstalling jq without sudo in managed deployments, and review downstream OpenClaw skill permissions because this skill can make broad read-only queries and prepare workflow actions across clients.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
export OPENCLAW_DATA_DIR="/data"
which jq || sudo apt install jq
```

No external credentials required. Provides a natural language query interface that routes questions to other installed skills. Requires the OpenClaw LLM runtime.

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The eval prompts are broad and underspecified, which can cause the assistant to over-generalize routing and action selection from ambiguous natural-language requests. In this skill, several prompts touch cross-client queries and operational/write flows, so weak trigger constraints increase the chance of unintended tool invocation, overbroad data access, or unsafe action planning being treated as acceptable behavior.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
export OPENCLAW_DATA_DIR="/data"
which jq || sudo apt install jq
```

No external credentials required. Provides a natural language query interface that routes questions to other installed skills. Requires the OpenClaw LLM runtime.

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The policy states "Every interaction is in English," which forces a specific language behavior. Because the file does not offer a language/locale choice or document this as a justified regional compliance constraint, this is a natural-language policy violation under the language/locale rule.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The intent-matching rules use very broad everyday verbs such as 'show me', 'when is', 'do', 'run', and 'start' to route into sensitive query and action flows. In a conversational meta-skill that can trigger downstream workflows across installed skills, overly permissive routing increases the chance of accidental invocation, wrong-skill execution, or unsafe escalation from ambiguous natural language.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This requirement hard-codes English output for all responses and does not provide any user choice or opt-in for other languages. That creates a language policy issue because the skill enforces a specific locale behavior globally rather than accommodating user preference.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The phrase "Responds in professional English with Greek terms included" imposes a specific output language. Because the file does not indicate user opt-in, language selection, or a justified region-specific requirement, this is a natural-language locale policy concern.