T01 · Skill Instruction Hijacking
Error
- Location
assets/templates/workspace/AGENTS.md:3- Finding
Persistent Agent Identity and Behavior Replacement
- Content
View full analysis
- Remediation
View remediation
Security audit
一步完成进化
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for building a persistent OpenClaw operating setup, but it should be reviewed because it can install lasting agent instructions, memory workflows, and scheduled automation without strong approval or rollback controls.
Install only when you intentionally want this workspace to become a long-running OpenClaw operating system. Before use, require an explicit file-by-file plan, review changes to AGENTS.md, MEMORY.md, skills, heartbeat, and cron, keep backups, disable implicit invocation if possible, and make scheduled reflection produce proposed diffs instead of applying memory or instruction changes automatically.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:76- Finding
Automated Promotion of Mutable Content into Long-Term Memory and Skills
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Error
- Location
SKILL.md:202- Finding
Unattended Cross-Session Persistence Through Heartbeat and Cron Jobs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (25)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Evolution Loop OpenClaw does not become stronger because someone says "self-evolve". It becomes stronger because a repeatable improvement loop is in place. A practical evolution loop is:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The default prompt describes a very broad, multi-step setup flow for a fresh OpenClaw environment, including memory, cron, heartbeat, rescue, and integrations, without defining clear trigger boundaries or approval checkpoints. In combination with implicit invocation, this increases the chance that the skill is selected for loosely related requests and begins high-impact configuration work beyond the user's intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill enables
allow_implicit_invocation: true, which allows the platform to activate it without an explicit user request. Because this skill performs broad environment setup and reconfiguration actions, unintended invocation could trigger architectural changes, integrations, or automation setup in contexts where the user did not mean to authorize them.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire instruction set is written as a mandatory Chinese-language operating policy, and there is no indication that users may choose another language or that the skill is limited to a China-specific context. This creates a natural-language locale policy concern because the skill appears to impose a language constraint without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file's entire user-facing content is written in Chinese, and there is no indication that language selection is optional or that this skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file’s natural-language content is entirely in Chinese and presents the skill persona and behavior in that language without offering any user opt-in or alternative locale. Under the stated policy, forcing a specific language without choice or justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The entire template is written in Chinese and presents the scheduling blueprint as the default format, with no indication that users may choose another language or locale. Under the policy rule for natural-language constraints, this can constitute a language-policy violation because it implicitly enforces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file's operational instructions are written as a direct mandate in Chinese, which imposes a specific language/locale on the skill's behavior without any user opt-in or documented region-specific need. This matches the policy category for language or locale constraints that are not optional or justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The entire skill identity is written only in Chinese and presents the role definition as the default operating mode, with no indication that users may choose another language or locale. Under the policy for natural-language constraints, a fixed language without opt-in can be a locale/language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill guidance is written as prescriptive Chinese-language behavior and style, with no indication that users can opt into another language or locale. Under the policy, forcing a specific language without user choice or documented regional justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire template, including headings and field labels, is written only in Chinese, which imposes a specific language on users. The file does not offer a language choice or explain that the skill is intended only for a Chinese-speaking or region-specific context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The entire template, including the title and section headings, is written only in Chinese, which indicates a fixed language choice. There is no surrounding text in the file offering a language option or documenting that this template is intentionally region-specific, so it can violate language/locale policy requirements.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file presents all workflow instructions exclusively in Chinese, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the policy rule for language or locale constraints, this is a natural-language policy concern because it imposes a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire template uses Chinese headings and labels, which imposes a specific language on users without any indication of opt-in or locale-specific scope. The policy explicitly flags language or locale constraints when a skill forces a specific language without user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire PRD template is written in Chinese, including all section headings, with no indication that language selection is optional or that the template is intended only for a Chinese-speaking context. This creates a natural-language policy issue because it implicitly enforces a specific language/locale without documented user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The natural-language content in the description and operating instructions is entirely Chinese, which implicitly forces a specific language for users of the skill. Under the policy, language-specific behavior should either be optional for the user or clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest description is written in Chinese and the skill content consistently operates in Chinese, indicating a language-specific behavior without offering a user choice or explaining a region-specific requirement. This can violate language or locale policy when users have not explicitly opted into that language.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs deletion of content ('真正无效的内容要删，不要只追加') without requiring confirmation, scope limits, backup, or preview. In a reflective/maintenance workflow that touches memory, skills, and project files, this can lead to unintended destructive edits or loss of important context if the agent overgeneralizes what is 'invalid'.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The natural-language content of the skill is entirely in Chinese, including the description and operating instructions, with no indication that users may choose another language. Under SQP-3, a skill that effectively enforces a specific language without opt-in can violate language/locale policy expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs writing discovered information into long-term memory or project files without requiring user confirmation, labeling, or safeguards around persistence. In an agent setting, this can cause silent modification of stored state, allowing low-quality, sensitive, or adversarially planted information to become durable context that influences future actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The entire document is written in Chinese and does not indicate that other languages are supported or that Chinese is an optional or region-specific choice. Under the policy rule for language or locale constraints, this can be a natural-language policy violation because it effectively imposes a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The template's headings and instructions are entirely in Chinese, with no indication that language selection is optional or configurable. This can violate language/locale policy when a skill implicitly requires a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file presents all operational instructions and labels in Chinese, with no indication that users may choose another language or that the skill is limited to a Chinese-language context. Under the policy for natural-language violations, forcing a specific language without user opt-in is in scope.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown template uses Chinese section headings throughout, which imposes a specific language on users without indicating that language choice is optional. The policy allows locale constraints only when users can opt in or when the restriction is clearly documented and justified, neither of which appears here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The title is in Chinese while the body immediately switches to English, and the document does not state any intended audience language or offer a locale choice. Under the language/locale policy rule, this can be a natural-language policy issue because it implicitly imposes mixed-language usage without user opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.