Security audit

Agent Knowledge Transfer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent knowledge-transfer guide, but it directs broad copying of user profile, memory, history, and tool-context files into agent workspaces without clear minimization or approval controls.

Review this skill carefully before installing. Use it only in trusted OpenClaw environments, transfer only the files each agent actually needs, avoid bulk --all transfers by default, redact private or secret information from USER.md and memory logs, validate agent names before using the shell snippets, and set retention and access controls for copied workspace data.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:42
Finding: Excessive Replication of Sensitive Context Across Agent Workspaces
Content: View full analysis
"$AGENT_WORKSPACE/${AGENT_NAME^^}_IDENTITY.md" << 'EOF' # [AGENT_NAME] Identity Enhancement ``` ```bash # Copy recent memory files (last 30 days) find /root/.openclaw/workspace/memory -name "*.md" -mtime -30 -exec cp {} "$AGENT_WORKSPACE/memory/" \; ``` ```bash # Update OpenClaw configuration to include read tool # This must be done in openclaw.json echo "IMPORTANT: Update openclaw.json to include 'read' tool in agent's tools.allow list" ``` ### Technical Analysis The protocol directs operators to replicate complete identity files, the human user's profile, global memory, tool configuration, system instructions, and up to 30 days of historical memory into every target agen ...[truncated 2236 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:80
Finding: Path Traversal Through an Unvalidated Agent Name
Content: View full analysis
"$AGENT_WORKSPACE/${AGENT_NAME^^}_IDENTITY.md" << 'EOF' ``` ### Technical Analysis `AGENT_NAME` is inserted directly into an absolute filesystem path without validation or canonical containment checks. Shell quoting prevents word splitting and shell metacharacter interpretation, but it does not neutralize path separators or `..` traversal components. If the placeholder is replaced from an untrusted argument, configuration value, automation input, or attacker-influenced agent identifier, a name containing traversal components can cause `AGENT_WORKSPACE` to resolve outside `/root/.openclaw/agents`. The resulting path is used by `mkdir`, `cp`, and shell output redirection. Those operations can create directories, place copies of sensitive files, and overwrite files at an unintended destination. The documented commands use paths under `/root`, indicating that operators may execute them with elevated privileges, which increases the potential impact. ### Attack Path 1. An attacker influences the agent name supplied to an operator or to an implementation based on this procedure. 2. The attacker provides a traversal-bearing identifier, such as one containing `../` path components. 3. The procedure constructs `AGENT_WORKSPACE` without va ...[truncated 1537 chars]
Remediation: View remediation
&2 exit 1 ;; esac ``` 2. Construct and canonicalize the destination, then verify that it remains beneath the approved base directory: ```bash BASE_DIR="/root/.openclaw/agents" AGENT_WORKSPACE="$BASE_DIR/$AGENT_NAME/workspace" RESOLVED_WORKSPACE="$(realpath -m -- "$AGENT_WORKSPACE")" case "$RESOLVED_WORKSPACE" in "$BASE_DIR"/*) ;; *) printf '%s\n' "Workspace escapes the approved base directory" >&2 exit 1 ;; esac ``` 3. Reject identifiers containing `/`, `\`, `.`, `..`, control characters, whitespace, or encoded path separators unless explicitly required. 4. Check every path component for symbolic links before performing privileged writes, and use safe no-follow filesystem operations where available. 5. Refuse to overwrite existing files unless replacement is explicitly approved and securely implemented. 6. Run the transfer under a dedicated unprivileged service account rather than root. 7. Set restrictive creation permissions with an appropriate `umask`, such as `umask 077`. 8. Pass validated identifiers as explicit script arguments rather than asking operators to perform unchecked textual substitution. 9. Add automated tests covering absolute paths, traversal sequences, symlink escapes, empty identifiers, and unusual Unicode or control characters. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs copying broad identity, user context, memory, and history files into agent workspaces, including USER.md, MEMORY.md, and daily memory logs, without any minimization, sensitivity review, or consent gate. This creates a real risk of propagating personal, operational, or confidential data to agents that may not need it, expanding the blast radius of any downstream compromise or misuse.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill’s natural-language instructions direct broad transfer of user profile data, internal memory, decision history, and work logs into agent workspaces. In this context, the danger is not code execution but data leakage by design: the skill normalizes giving multiple agents access to potentially sensitive information they may later disclose, misuse, or expose through other tools.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The automation section recommends transferring knowledge to all agents in bulk, which encourages indiscriminate replication of shared context and memory across the entire agent fleet. Without mandatory review, scoping, or exclusions, a single command can amplify sensitive data exposure and make accidental over-sharing systemic.
Content: No source excerpt is available for this finding.