Security audit

Agent Doppelgänger

Security checks for vulnerabilities and agentic risk

Overview

This skill is a prototype for replying as the user, but its promised safety checks are mostly placeholders and it persistently stores private message data.

Review carefully before installing. Do not grant real channel-send authority or broad access to private communications until policy checks fail closed, confidence and verification are real, raw audit logging is minimized/redacted with retention, profile writes require explicit approval, and watermarking/disclosure behavior is made transparent and user-controlled.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/adg.py:59
Finding: Trusted contact rules bypass mandatory high-risk and forbidden-topic controls
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/adg.py:50
Finding: Unknown and highly ambiguous messages bypass the domain allowlist
Content: View full analysis
Remediation: View remediation
max_ambiguity: return False, "Intent is too ambiguous for autonomous handling." if intent["domain"] not in allowed_intents: return False, f"Domain '{intent['domain']}' not in allowlist for {channel}." ``` ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/adg.py:95
Finding: Confidence and response verification security gates are non-functional
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/adg.py:126
Finding: Raw private messages and generated responses are persistently logged without redaction
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented purpose is a tightly constrained communication delegate with policy gating, escalation, and domain restrictions, but the observed behavior reportedly does not implement those controls and instead reads/writes local profile files for style anchoring. This mismatch is dangerous because operators may trust the skill to enforce authority boundaries that do not actually exist, creating a confused-deputy situation and opening the door to unauthorized data access or unsafe autonomous behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill metadata does not declare any tool scope or permissions, yet the implementation is reported to use file_read and file_write capabilities. Undeclared filesystem access weakens least-privilege guarantees, makes review harder, and can enable unexpected reading or modification of local data if the skill is invoked in a broader agent environment.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The spec explicitly proposes a private 'identity watermark' to prove authorship while the system communicates 'as you' across third-party channels, yet it does not require disclosure to recipients that messages may be agent-authored. In this skill context, undisclosed identity-proxied communication increases impersonation, deception, consent, and trust-manipulation risks, especially because the product is designed to preserve identity fidelity and evade backlash by framing rather than transparency.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The verify() function claims to perform a final safety check for commitment leakage and tone, but it always returns True and therefore provides no protection. This creates a false sense of security around the last gate before sending identity-proxied responses, increasing the chance that unsafe, overcommitting, or policy-violating content is sent automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill writes raw user messages and decisions to an audit log without any indication of notice, consent, or minimization. Because this tool handles private communications across email and messaging platforms, silent collection of message contents materially increases privacy and compliance risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The log_decision() function persistently stores raw messages in plain-language JSONL files, creating a durable disclosure path for sensitive personal, professional, or financial content. In a delegated communication agent, message bodies are likely to contain confidential information, so plaintext retention substantially raises the impact of local compromise, backup exposure, or unauthorized access.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code deliberately applies a hidden linguistic watermark and non-semantic marker to outbound messages, enabling fingerprinting of delegated communications without any visible user consent or clear operational necessity. In an identity-proxy communication tool, covert tagging is especially sensitive because it can expose automation usage, support tracking across messages, or create attribution risks for the user.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script does more than passive style analysis: it creates and persists profile-related data under the user's home directory, including seeded training samples and a derived style profile. In a delegated identity-proxy skill, silently mutating long-lived identity data is security-relevant because it can alter future impersonation behavior and establish durable state without the user's knowledge or consent.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 86% confidence
Finding: This finding reflects persistent storage of data framed as session-derived seeding for future behavior. Even though the current implementation uses placeholders, the intended pattern is to carry session-like inputs into long-lived profile state, which is risky in an identity-proxied agent because transient interactions can become durable behavioral anchors affecting later delegated communications.
Content: Scanner excerpt · scripts/reanchor_style.py (reported line 50)May include surrounding context.
python
sample_file = os.path.expanduser("~/.openclaw/adg/profile/training_samples.jsonl") if not os.path.exists(sample_file): # Create it with current session data as a seed seed_samples = [ "hi", "what now",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script creates a training samples file in a persistent user profile path without warning, confirmation, or opt-in. In the context of an identity-proxy communication skill, unannounced creation of behavioral training data is dangerous because it can establish a durable user profile that influences future delegated messages and may expose private interaction patterns if the profile directory is later accessed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script overwrites the user's style profile YAML file without warning or change review. For a system designed to preserve identity fidelity and enforce communication boundaries, silently replacing style settings can materially change how the agent represents the user in future conversations, making this more dangerous than a generic config write.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The inline comment says the file will be created with current session data as a seed, implying data derived from the user's real history. In reality, the code writes a fixed list of placeholder phrases, which contradicts the stated intent of the comment and can mislead reviewers about the provenance of identity-training data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.