T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:3- Finding
Self-Triggering Instructions Hijack Unrelated Document Workflows and Bias Review Results
- Content
View full analysis
- Remediation
View remediation
Security audit
Adversarial Review
Security checks for vulnerabilities and agentic risk
Overview
This review skill is mostly aligned with document review, but it has unsafe shell handling and broad self-triggering that deserve manual review before installation.
Install only if you are comfortable with the skill storing reviewed documents under ~/.openclaw/workspace/reviews and sending full document text to spawned reviewer models. Before use, remove eval from scripts/cp-output.sh, validate session names and slugs, add explicit confirmation before external reviewer spawning, and add prompt-injection boundaries around reviewed document content.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/cp-output.sh:57- Finding
Arbitrary Shell Command Execution Through Eval-Based Destination Expansion
- Content
View full analysis
/tmp/cp-output-eval-proof)' ``` 5. The injected command executes before `mkdir` and `cp` process the resulting destination. 6. A malicious command can read or modify any resource available to the operating-system user running the agent. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the account invoking the script. The attacker can read accessible files, modify project or user data, steal environment-based credentials, execute local programs, establish persistence where permissions allow, or pivot to other resources available to that account. The scope is ...[truncated 41 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/synthesize.sh:28- Finding
Unvalidated Session Identifiers Permit Filesystem Path Traversal
- Content
View full analysis
"$SESSION_DIR/positions.md" << EOF ``` From `scripts/cp-output.sh`: ```bash SESSION_NAME="$1" DESTINATION="$2" SESSION_DIR="${REVIEWS_DIR}/${SESSION_NAME}" OUTPUT_DIR="${SESSION_DIR}/output" ``` ### Technical Analysis Session names and slugs are inserted into filesystem paths without validating their character set or rejecting directory separators and traversal components. Shell quoting prevents word splitting but does not prevent the filesystem from resolving `..` components. The `synthesize.sh` and `cp-output.sh` scripts accept the session name directly, making traversal straightforward. `new-review.sh` prepends a date to the slug, but a crafted slug can still contain slash-separated traversal components after the date-prefixed segment. In `synthesize.sh`, the generated Node.js code resolves the same untrusted session name with `path.join` and writes to the resulting `combined.md`. Therefore, the vulnerability ...[truncated 1572 chars]- Remediation
View remediation
&2 exit 1 fi ``` - Apply equivalent validation to `SLUG` in `new-review.sh`. - Canonicalize both the review root and candidate path, then verify that the candidate remains a descendant of the root before any read, write, directory creation, or copy. - In the Node.js portion of `synthesize.sh`, repeat the containment check rather than relying exclusively on shell-side validation. - Reject absolute paths, slash and backslash characters, `.` or `..` path components, control characters, and empty identifiers. - Use `--` with filesystem commands where supported to prevent leading-hyphen values from being interpreted as options. - Add tests for absolute paths, repeated traversal, mixed separators, symbolic links, and identifiers beginning with hyphens. ]]>
T01 · Skill Instruction Hijacking
Error
- Location
references/reviewer-personas.md:3- Finding
Untrusted Document Instructions Are Inserted Directly Into Reviewer Agent Prompts
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about orchestrating an adversarial review process for documents. The supplied code chunk does not implement review orchestration at all; it is a post-processing file-management script for copying an already-generated Markdown output file from a review session directory to another location. Its primary purpose is materially different from the declared skill behavior. It also introduces an undeclared capability: filesystem export/copy of output documents. While the script operates within a reviews workspace, that relationship is only incidental and does not match the described core functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
There is a material description-to-behavior mismatch. The declared purpose describes an active multi-agent review workflow with reviewer orchestration, redline collection, adjudication support, and self-trigger logic. The actual code chunk is only a setup utility for that workflow: it creates a dated session directory under ~/.openclaw/workspace/reviews, copies the input document, creates redlines/output folders, and generates a positions.md template. These are supporting implementation details, but the chunk by itself does not perform the core capabilities promised in the description. Therefore the supplied code does not accurately represent the declared functionality.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
There is a material description-to-behavior mismatch. The script is narrowly focused on post-processing reviewer output files already present in ~/.openclaw/workspace/reviews//redlines. Its primary function is synthesis and formatting of redlines into combined.md. While this supports part of a review workflow ('collects structured redlines'), it does not implement most of the declared core behavior: no agent spawning, no review execution, no adversarial loop orchestration, no complexity scoring, no automatic triggering, and no v2 drafting guidance. The filesystem access is consistent with a review workflow and not independently suspicious, but the declared purpose substantially overstates what this code chunk actually does.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The listed trigger phrases include very generic expressions like 'validate this', 'sanity check this', and 'get a second opinion', which can appear in many ordinary conversations. That makes accidental invocation likely and increases the chance that unrelated user content is swept into the review workflow or filesystem session storage unexpectedly.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The listed trigger phrases include very generic expressions like 'validate this', 'sanity check this', and 'get a second opinion', which can appear in many ordinary conversations. That makes accidental invocation likely and increases the chance that unrelated user content is swept into the review workflow or filesystem session storage unexpectedly.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 5. Synthesize | `scripts/synthesize.sh <session-dir>` → writes `redlines/combined.md` |
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script uses
eval echo "$DESTINATION"on a user-controlled argument, which causes the shell to interpret the destination as code rather than as data. An attacker can supply command substitution or other shell syntax and achieve arbitrary command execution under the privileges of whoever runs the script.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Because the destination path is shell-evaluated before file operations, a crafted destination can execute unintended commands with no warning to the user. In a review automation skill, inputs like destination paths may be copied from untrusted sources or generated by other tools, which makes this more dangerous than a purely local convenience script.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This markdown file includes activation-style guidance for when to use custom reviewers, but the condition 'If none of the above bundles fit exactly' is open-ended and does not define clear limits or exclusions. That ambiguity could lead to overly broad or inconsistent use of the custom path instead of the predefined bundles.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This shell script creates a temporary file under /tmp, writes executable JavaScript into it, runs it with Node, and only removes it afterward. Although subprocess execution is central to the script's purpose, there is no disclosure that it writes and executes a temp script, and cleanup is skipped if the script exits early under set -e before reaching the rm command.
- Content
Static analysis
No suspicious patterns detected.