Php Full Stack Developer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:19 AM UTC
• Version: 0.1.0

Overview

The skill is mostly a PHP workflow guide, but it automatically reads broad OpenClaw profile and memory files before tasks, so users should review that access first.

Install only if you are comfortable with the skill loading OpenClaw workspace profile and memory files whenever it starts. Prefer a version that narrows reads to project-specific logs, asks before accessing persistent memory, and treats loaded memory as untrusted context.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: INFO_RUNTIME.md:7

Finding

Overbroad Access to Agent Identity and Persistent Memory Files

Content

View full analysis

Vulnerability Details

File Location: INFO_RUNTIME.md, lines 7–12
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code

markdown

## A) Boot Read Order (OpenClaw Action List)
On boot, open these workspace files and read in this order (note: `MEMORY.md` is a single Markdown file in the workspace):
1. `~/.openclaw/workspace/SOUL.md`
2. `~/.openclaw/workspace/USER.md`
3. `~/.openclaw/workspace/memory/YYYY-MM-DD.md` (today + yesterday)
4. If in MAIN SESSION, also read `~/.openclaw/workspace/MEMORY.md`

Technical Analysis

The Skill mandates reading global Agent identity, user-profile, daily-memory, and long-term-memory files whenever it boots. This access is broader than the project-scoped context necessary to provide PHP development governance.

The instruction violates least-privilege and data-minimization principles by loading potentially unrelated information into the active context without establishing task necessity or requesting explicit consent. Memory files may contain personal information, secrets, prior-session details, or untrusted content. Loading them also expands the indirect prompt-injection surface: instructions previously introduced into persistent memory could influence the current engineering session.

The reviewed files do not instruct the Agent to exfiltrate this information or use it maliciously. The issue is therefore an overbroad access requirement rather than confirmed data theft.

Attack Path

1. A user activates the PHP full-stack Skill for an engineering task.
2. The mandatory boot sequence causes the Agent to open SOUL.md, USER.md, recent daily-memory files, and, in a main session, MEMORY.md.
3. Sensitive or attacker-controlled content stored in those files enters the Agent's context even when unrelated to the requested task.
4. Poisoned memory content may influence technical decisions, generated code, ...[truncated 784 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the mandatory global boot-read sequence from the Skill.
2. Do not read SOUL.md, USER.md, daily-memory files, or MEMORY.md by default.
3. Restrict reads to project-scoped records that are directly necessary for the current task.
4. Obtain explicit user consent before accessing persistent memory, and identify the exact files and purpose.
5. Load only narrowly selected entries rather than entire memory files.
6. Treat all loaded memory as untrusted data, not authoritative instructions, and prevent it from overriding system, developer, user, or Skill-level constraints.
7. Redact secrets, credentials, personal data, and unrelated prior-session content before incorporating memory into the active context.
8. Document retention, access-control, and deletion policies for project logs.
9. Add tests or policy checks confirming that ordinary Skill activation does not access global identity or memory files.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation criteria cover almost any engineering-related request, including broad phrases like backend, frontend, debugging, refactors, and API work. Although the file adds one exclusion at L15, it does not provide a narrow trigger phrase set or negative examples sufficient to distinguish when this skill should not activate during ordinary conversation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.