Skill Sediment

• Outcome: Malicious
• Latest audit: Jul 13, 2026 · 1:39 PM UTC
• Version: 1.0.2

Overview

This skill appears to install a powerful conversation-learning plugin that can persist, promote, modify, report, and delete skill content, with several controls and disclosures that are too broad or unclear for default installation.

Review carefully before installing. This is not just an installer: it can observe conversations, create persistent skills, promote them into active agent behavior, report metadata externally, mutate or delete skill files, and restart services. Install only in a controlled workspace, require an explicit agent scope, disable or restrict telemetry/background review where possible, and verify bundle integrity before running the installer.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (19)

Tainted flow: 'req' from os.environ.get (line 216, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

req = urllib.request.Request(
            CDN_PLUGIN_TARGZ, headers={"User-Agent": "skill-sediment-installer"}
        )
        with urllib.request.urlopen(req, timeout=60) as resp, open(
            dest_targz, "wb"
        ) as f:
            shutil.copyfileobj(resp, f)

• Confidence: 94% confidence
• Finding: The script can download a plugin bundle from a URL fully controlled by the SKILL_SEDIMENT_CDN environment variable and then install/extract it. If EXPECTED_SHA256 is unset, there is no authenticity verification, so an attacker who can influence environment variables or deployment configuration can supply a malicious bundle that gets deployed as a plugin, leading to arbitrary code execution in the OpenClaw environment.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill describes and instructs use of capabilities including shell execution, file reads/writes, environment inspection, and optional network download paths, but it does not declare permissions. This creates a transparency and review gap: users or policy engines may treat the skill as lower risk than it is, while the actual operational steps can modify configuration, deploy code, and restart services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The documentation frames the skill as an installer/operator for a plugin, but the described and referenced behavior is materially broader: autonomous conversation review, hidden skill management actions, persistence across restarts, telemetry/reporting, migration, eviction, and policy gating. This mismatch can prevent informed consent and cause operators to install software with far greater authority and behavioral scope than the summary suggests.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The code unconditionally reports review subagent sessions to external/backend services and may send whitelist notifications via reportSession and sendUserQueryWhitelistHiMessage. This behavior extends beyond the declared install/heal/doctor/recover/status/config/uninstall scope and can leak session metadata and operational activity to external systems without clear user disclosure or consent.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The telemetry path sends detailed session identifiers, review session keys, agent identifiers, model names, token usage, and skill-action outcomes to an external event endpoint. Even if intended for analytics, this is a privacy and data-governance risk because it exports sensitive metadata not described in the manifest and may enable user/session correlation across systems.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The tool schema explicitly exposes a 'promote' action that moves agent-generated sediment skills into the engine-loaded skills/ directory, crossing from a staging area into an automatically loaded execution surface. That materially expands trust and capability beyond the skill metadata, which states this skill only installs/operates the sediment plugin and does not cover promotion behavior; a misleading scope boundary increases the chance of unsafe deployment of generated content.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file header shows this tool can create, edit, patch, delete, and write arbitrary supporting files for skills, effectively acting as a generalized skill-authoring and self-modification interface. Those capabilities are far broader than the declared plugin lifecycle management purpose, so an agent using this skill gains hidden power to alter reusable instructions and behavior beyond what an operator would reasonably expect.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The implementation supports destructive operations such as deleting whole sediment skills and overwriting/removing files, which can erase or replace reusable agent behavior. In a plugin whose stated purpose is extension lifecycle management, this creates an unnecessary integrity risk: compromised or mistaken calls could tamper with skill content, disable safeguards, or destroy auditability.

Intent-Code Divergence

Medium

• Confidence: 85% confidence
• Finding: The entrypoint documentation claims sedimentDir is the only write base, but the implementation also writes to skills/ for promoted and sediment-origin skills. This mismatch weakens operator trust and review assumptions: defenders may approve the tool believing writes are confined to an isolated staging directory when it can actually modify the active engine-loaded area.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The scanner explicitly skips all analysis for `builtin` skills and returns a safe verdict unconditionally. If a builtin skill is compromised in the supply chain, mispackaged, or later modified locally, this trust bypass suppresses all detection and can allow dangerous content to install or run unnoticed.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly states that a background sub-agent listens to conversations and writes successful workflows into SKILL.md files, but it does not prominently warn that potentially sensitive conversation content may be captured, stored, and later promoted into reusable artifacts. In a tool that operates on user conversations, the lack of a clear privacy and consent notice increases the risk of unintended retention or exposure of secrets, personal data, or proprietary workflows.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger list includes broad phrases like install/port/clone sediment and sediment not working, which can cause the skill to activate in loosely related contexts. Over-broad activation increases the chance of accidental execution of installation, diagnostic, or repair guidance in the wrong conversation or environment.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The configuration explicitly states that when validAgentId is omitted, the plugin applies to all agents, which creates a broad default trust boundary for a component that can create, edit, and security-scan skills. In this skill context, broad activation is more dangerous because the plugin influences procedural knowledge generation and promotion across agents, increasing the chance of unintended execution scope, cross-agent contamination, or abuse if one agent is less trusted or differently permissioned.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The background review flow fetches parent session messages, condenses them, and forwards that conversation context to a review subagent/backend path without any visible user-facing notice in this file. This can expose potentially sensitive user prompts, tool outputs, and workflow details to additional processing components, materially increasing confidentiality risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document states that the plugin automatically listens to conversations and writes successful non-trivial workflows to `SKILL.md`, but it does not present a clear user-facing warning about this persistent data creation behavior. Because conversations may contain sensitive operational details, prompts, or internal workflow logic, automatic persistence without explicit notice or consent can create confidentiality and compliance risks, especially in shared or managed workspaces.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The heal command can autonomously restart the gateway without an interactive confirmation prompt unless --no-restart is supplied. In an agent-skill context, this increases the risk of service disruption or denial of service if the script is invoked automatically or by a user who does not fully understand the side effects.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The review prompt explicitly instructs the system to quote user text verbatim and carry forward user intents, artefacts, and notes in a persistent handoff block. That creates a built-in mechanism for retaining and re-exposing potentially sensitive conversation data across reviews and sessions, increasing the risk of privacy leakage, over-retention, and unintended disclosure to later review agents.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The prior handoff preamble tells later reviews to merge context from previous reviews of the same session, preserving earlier review content in plain language. This creates a persistence channel for prior conversational data that can accumulate sensitive details and make them available beyond the original interaction scope, especially since the handoff is later injected back into prompts.

Self-Modification

High

• Category: Rogue Agent

Content

success: false,
        error:
          `Sediment skill '${name}' not found. ` +
          `This plugin can only modify skills under sediment_skills/ ` +
          `or sediment-originated skills (originSource="SEDIMENT") under skills/. ` +
          `Use skill_manage(action='list') to see available sediment skills, ` +
          `or action='create' to add a new one.`,

• Confidence: 90% confidence
• Finding: This is a real self-modification capability: the tool is designed to modify skills under sediment_skills/ and previously promoted sediment-origin skills under skills/. Even with some origin checks, allowing an agent-accessible tool to rewrite reusable skills creates persistence and privilege-amplification risk, because malicious or compromised content can be planted into future agent behavior and later activated.

Static analysis

Detected: malicious.crypto_mining, suspicious.dangerous_exec, suspicious.dynamic_code_execution (+1 more)

Possible crypto mining behavior detected.

Critical

• Code: malicious.crypto_mining
• Location: assets/plugin-source/src/skills-guard.ts:688

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: assets/plugin-source/src/skills-guard.ts:531

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: assets/plugin-source/src/skills-guard.ts:524

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: assets/plugin-source/src/skills-guard.ts:157