Multi User Workspace

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:41 PM UTC
• Version: 1.0.0

Overview

The skill is not deceptive, but its suggested multi-user access rules are loose enough to risk giving the wrong user admin access or exposing other users' profile data.

Install only after tightening the access model: use authenticated identities rather than session suffixes, match complete session keys or exact bindings, validate user IDs with a strict allowlist, replace substring relationship globs with exact membership checks, define privacy and consent rules for stored profile and relationship data, and keep unmatched sessions in a restricted sandbox.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:107

Finding

Suffix-Based Session Routing Can Assign an Unrestricted Administrator Profile to the Wrong User

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:107

Finding

Unvalidated User IDs and Substring Relationship Globs Can Expose Other Users' Records

Content

View full analysis

:` where `mainKey` typically contains the userId. - **Sandbox**: Optional Docker isolation per session, configured in `openclaw.json`. - **FRIENDS/**: User profile directory (one file per user, named `{userId}.md`). - **RELATIONS/**: Relationship directory (files named `{userId1}-{userId2}.md`, alphabetically sorted, can be mutiple users). ``` Lowercase uniqueness is described but no validation procedure is required: ```markdown **Note:** `userId` is unique and in lower case. Use `Role` to determine sandbox configuration in `openclaw.json`. ``` The extracted value is then interpolated into a path and a substring glob: ```markdown ## User Identification When a session starts (after `/new`): 1. Get current session via `session_status` 2. Extract userId from the session key (e.g., `agent:main:alice` → `alice`) 3. Read `FRIENDS/{userId}.md` for user profile 4. Read `RELATIONS/*{userId}*.md` for all relationships involving this user 5. Greet the user by name ## Cross-User Boundaries - Default: Information does not flow between users - Exception: Only when explicitly defined in RELATIONS/ ``` ### Technical Analysis The documented lookup procedure inserts a session-derived `userId` directly into `FRIENDS/{userId}.md` and `RELATIONS/*{userId}*.md`. Although the document states that IDs are lowercase and unique, it does not require enforcement of a safe character set, canonicalization, path containment, or exact relationship membership. Two weaknesses result: 1. I ...[truncated 2652 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill encourages storing personal data such as names, roles, email addresses, preferences, and free-form notes without any retention, minimization, consent, or access-control guidance. In a multi-user workspace, such profile data can become sensitive and may be exposed, over-collected, or reused in ways users did not expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Relationship files explicitly govern information sharing between users, but the skill does not define robust consent validation, data classification, or safeguards against oversharing. This creates a real privacy risk because cross-user disclosures may be inferred from loosely written relationship notes rather than verified, current user consent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

Information Sharing

• Can mention each other's public projects
• Do not share private details without asking

text

## AGENTS.md

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation contains a privilege-model contradiction: AGENTS.md instructs the assistant to read FRIENDS/{userId}.md and RELATIONS/*{userId}*.md, while the guest sandbox notes say guests cannot access FRIENDS/ or RELATIONS/. In practice, this ambiguity can lead to insecure deployments, accidental over-permissioning, or fallback behavior that exposes cross-user data to satisfy the documented workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guest configuration explicitly allows exec and process, which grants arbitrary code execution inside the guest sandbox. Even if filesystem scope is constrained, this materially expands attack surface beyond profile/workspace management and can enable abuse such as malware staging, resource exhaustion, or exploitation of container/runtime weaknesses.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

Directory Setup:

bash

mkdir -p ~/.openclaw/workspace/guests/bob

Notes:

Static analysis

No suspicious patterns detected.