RLM Controller

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:05 PM UTC
• Version: 1.2.0

Overview

The skill appears purpose-built for long-document analysis, but it uses autonomous exec and session spawning while some advertised safety limits and prompt-isolation protections are not fully enforced.

Install only if you are comfortable with a skill that can run bundled helper scripts, write full input copies and prompts to disk, and spawn sub-agent sessions. Use it in a workspace you control, avoid sensitive inputs unless you trust the redaction limits, review generated toolcalls before execution, consider enabling disableModelInvocation for confirmation, and run cleanup carefully because CLEAN_RETENTION=0 deletes matching scratch files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/rlm_auto.py:63

Finding

Untrusted slice content is not isolated from sub-agent instructions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/rlm_auto.py:28

Finding

Documented hard limits can be overridden during prompt generation

Content

View full analysis

args.slice_max: end = start + args.slice_max trimmed.append({"start": start, "end": end, "kw": sl.get("kw","")}) ``` ### Technical Analysis The security documentation describes 32 subcalls and 16,000 characters per slice as hard safeguards. In `rlm_auto.py`, however, these values are only command-line defaults. The program does not verify that: - `max_subcalls` is between 1 and 32. - `slice_max` is between 1 and 16,000. - The aggregate size of generated prompt artifacts remains bounded. An invocation can therefore provide values exceeding the documented limits. Excessive values can cause oversized or excessive prompt files to be generated before downstream scripts apply the separate 32-entry spawn-manifest limit. Invalid lower-bound values are also unsafe. In the fall ...[truncated 1324 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/rlm_auto.py:36

Finding

Derived output paths can follow symlinks outside the workspace

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (42)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding highlights undeclared cleanup and file deletion behavior exposed through scripts/cleanup.sh, including environment-controlled retention and ignore settings. Hidden destructive filesystem operations are dangerous because operators may invoke the skill expecting analysis only, while it can also purge artifacts or potentially remove unintended files if path handling or retention logic is flawed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This finding highlights undeclared cleanup and file deletion behavior exposed through scripts/cleanup.sh, including environment-controlled retention and ignore settings. Hidden destructive filesystem operations are dangerous because operators may invoke the skill expecting analysis only, while it can also purge artifacts or potentially remove unintended files if path handling or retention logic is flawed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This finding highlights undeclared cleanup and file deletion behavior exposed through scripts/cleanup.sh, including environment-controlled retention and ignore settings. Hidden destructive filesystem operations are dangerous because operators may invoke the skill expecting analysis only, while it can also purge artifacts or potentially remove unintended files if path handling or retention logic is flawed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding highlights undeclared cleanup and file deletion behavior exposed through scripts/cleanup.sh, including environment-controlled retention and ignore settings. Hidden destructive filesystem operations are dangerous because operators may invoke the skill expecting analysis only, while it can also purge artifacts or potentially remove unintended files if path handling or retention logic is flawed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This finding highlights undeclared cleanup and file deletion behavior exposed through scripts/cleanup.sh, including environment-controlled retention and ignore settings. Hidden destructive filesystem operations are dangerous because operators may invoke the skill expecting analysis only, while it can also purge artifacts or potentially remove unintended files if path handling or retention logic is flawed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding highlights undeclared cleanup and file deletion behavior exposed through scripts/cleanup.sh, including environment-controlled retention and ignore settings. Hidden destructive filesystem operations are dangerous because operators may invoke the skill expecting analysis only, while it can also purge artifacts or potentially remove unintended files if path handling or retention logic is flawed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding highlights undeclared cleanup and file deletion behavior exposed through scripts/cleanup.sh, including environment-controlled retention and ignore settings. Hidden destructive filesystem operations are dangerous because operators may invoke the skill expecting analysis only, while it can also purge artifacts or potentially remove unintended files if path handling or retention logic is flawed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This finding highlights undeclared cleanup and file deletion behavior exposed through scripts/cleanup.sh, including environment-controlled retention and ignore settings. Hidden destructive filesystem operations are dangerous because operators may invoke the skill expecting analysis only, while it can also purge artifacts or potentially remove unintended files if path handling or retention logic is flawed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding highlights undeclared cleanup and file deletion behavior exposed through scripts/cleanup.sh, including environment-controlled retention and ignore settings. Hidden destructive filesystem operations are dangerous because operators may invoke the skill expecting analysis only, while it can also purge artifacts or potentially remove unintended files if path handling or retention logic is flawed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This finding highlights undeclared cleanup and file deletion behavior exposed through scripts/cleanup.sh, including environment-controlled retention and ignore settings. Hidden destructive filesystem operations are dangerous because operators may invoke the skill expecting analysis only, while it can also purge artifacts or potentially remove unintended files if path handling or retention logic is flawed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding highlights undeclared cleanup and file deletion behavior exposed through scripts/cleanup.sh, including environment-controlled retention and ignore settings. Hidden destructive filesystem operations are dangerous because operators may invoke the skill expecting analysis only, while it can also purge artifacts or potentially remove unintended files if path handling or retention logic is flawed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding highlights undeclared cleanup and file deletion behavior exposed through scripts/cleanup.sh, including environment-controlled retention and ignore settings. Hidden destructive filesystem operations are dangerous because operators may invoke the skill expecting analysis only, while it can also purge artifacts or potentially remove unintended files if path handling or retention logic is flawed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding highlights undeclared cleanup and file deletion behavior exposed through scripts/cleanup.sh, including environment-controlled retention and ignore settings. Hidden destructive filesystem operations are dangerous because operators may invoke the skill expecting analysis only, while it can also purge artifacts or potentially remove unintended files if path handling or retention logic is flawed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding highlights undeclared cleanup and file deletion behavior exposed through scripts/cleanup.sh, including environment-controlled retention and ignore settings. Hidden destructive filesystem operations are dangerous because operators may invoke the skill expecting analysis only, while it can also purge artifacts or potentially remove unintended files if path handling or retention logic is flawed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding highlights undeclared cleanup and file deletion behavior exposed through scripts/cleanup.sh, including environment-controlled retention and ignore settings. Hidden destructive filesystem operations are dangerous because operators may invoke the skill expecting analysis only, while it can also purge artifacts or potentially remove unintended files if path handling or retention logic is flawed.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/security.md (reported line 35)May include surrounding context.

md

These scripts:
- Accept only structured CLI arguments (argparse)
- Produce only JSON or plain-text output to stdout
- Never call `eval()`, `exec()`, `subprocess.Popen(shell=True)`, or equivalent
- Never interpret model output as code or commands
- Never make network requests

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/security.md (reported line 35)May include surrounding context.

md

These scripts:
- Accept only structured CLI arguments (argparse)
- Produce only JSON or plain-text output to stdout
- Never call `eval()`, `exec()`, `subprocess.Popen(shell=True)`, or equivalent
- Never interpret model output as code or commands
- Never make network requests

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_path_validation.py (reported line 31)May include surrounding context.

python

cmd = [
            sys.executable,
            os.path.join(SCRIPTS_DIR, 'rlm_ctx.py'),
            'store', '--infile', '../../../etc/passwd',
            '--ctx-dir', self.tmpdir,
        ]
        result = subprocess.run(cmd, capture_output=True, text=True, cwd=self.tmpdir)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_path_validation.py (reported line 55)May include surrounding context.

python

cmd = [
            sys.executable,
            os.path.join(SCRIPTS_DIR, 'rlm_ctx.py'),
            'store', '--infile', '../../../etc/passwd',
            '--ctx-dir', self.tmpdir,
        ]
        result = subprocess.run(cmd, capture_output=True, text=True, cwd=self.tmpdir)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_path_validation.py (reported line 66)May include surrounding context.

python

cmd = [
            sys.executable,
            os.path.join(SCRIPTS_DIR, 'rlm_ctx.py'),
            'store', '--infile', '../../../etc/passwd',
            '--ctx-dir', self.tmpdir,
        ]
        result = subprocess.run(cmd, capture_output=True, text=True, cwd=self.tmpdir)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises use of powerful capabilities (read, write, exec, sessions_spawn) but does not declare an explicit tool scope such as permissions or allowed-tools. That creates a policy gap where the runtime may grant broader access than intended, increasing the blast radius if prompts, helper scripts, or spawned sessions are abused.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The skill explicitly uses exec and sessions_spawn, both of which materially increase attack surface, yet the only stated guard is a textual safelist claim in documentation. Without enforceable tool scoping and independently verified argument/path constraints, a compromised helper script, prompt-manipulated workflow, or unsafe spawned session could lead to command execution, file modification, or lateral expansion of model actions.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

## Tooling
- Uses OpenClaw tools: `read`, `write`, `exec`, `sessions_spawn`
- `exec` is used **only** to invoke the safelisted helper scripts bundled in `scripts/`
- Does **not** execute arbitrary code from model output
- All emitted toolcalls are validated against an explicit safelist before output

## Autonomous Invocation

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation provides a destructive cleanup command that can delete all retained files by setting CLEAN_RETENTION=0, but it does not include warnings, confirmation steps, scope limitations, or examples showing how to verify the target directories before execution. In a controller skill that operates over workspace scratch data and generated run artifacts, this increases the chance of accidental data loss by operators or downstream automation that follows the documented flow verbatim.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a controller for treating inputs as external context, slicing/searching them, and spawning bounded recursive subcalls for analysis. This script instead deletes files from scratch and log directories, which is operational workspace maintenance rather than long-context control behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/rlm_auto.py (reported line 15)May include surrounding context.

python

def run_plan(ctx, goal):
    cmd = ["python3", os.path.join(os.path.dirname(__file__), "rlm_plan.py"),
           "--ctx", ctx, "--goal", goal]
    out = subprocess.check_output(cmd, text=True)
    return json.loads(out)

def read_text(path):

Static analysis

No suspicious patterns detected.