ClawHub
Back to skill

Security audit

Super Claw Local Knowledge

Security checks for vulnerabilities and agentic risk

Overview

This skill has a clear local-knowledge purpose, but it asks to persistently change agent behavior and store/reuse uploaded documents with limited user control.

Install only if you are comfortable with uploaded documents being converted, stored, indexed, and reused from the local OpenClaw workspace. Avoid adding the SOUL.md proactive-retrieval block unless you deliberately want persistent cross-session behavior, and keep backups of originals because the ingestion workflow recommends deleting uploaded source files after conversion.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Error
Location
README.md:55
Finding

Persistent Agent Policy Modification Through SOUL.md Injection

Content
View full analysis

Vulnerability Details

File Location: README.md:55-73
Mirrored Location: README_zh.md:55-73
Vulnerability Type: Persistent agent memory and policy poisoning
Risk Level: High

Vulnerable Code Snippet:

markdown
### Configure SOUL.md

If the `SOUL.md` file exists in the OpenClaw workspace, inject the following instructions in the original `SOUL.md` style to enable proactive knowledge retrieval:

```plaintext
## Local Knowledge (claw-local-knowledge skill)
Please attempt to load the **claw-local-knowledge skill** when encountering uncertain or specialized knowledge, and retrieve relevant information according to the instructions.

**Retrieval Process:**
1. Read `memory/knowledge_base_index.json` to obtain the file list.
2. Match relevant files based on keywords.
3. Read the corresponding Markdown files from `memory/knowledge_base/`.
4. Integrate the information and reply to the user.

**Note:**
The knowledge base path is `workspace/memory/knowledge_base/`, and the index file is `workspace/memory/knowledge_base_index.json`.
text

### Technical Analysis

The installation documentation directs the user or agent to inject skill-specific instructions into `SOUL.md`, a persistent workspace policy file. These instructions cause future agent sessions to load the skill proactively whenever the agent encounters uncertain or specialized knowledge.

This crosses the boundary between task-scoped skill configuration and persistent agent-policy modification. Once installed, the rule can continue influencing future sessions even when the user did not explicitly request this skill. It also instructs those sessions to read the local knowledge-base index and selected documents and incorporate their contents into responses.

The same persistent modification is presented in both the English and translated README files. No executable code automatically performs the modification, so exploitation requires th
...[truncated 1703 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the instructions that direct users or agents to modify SOUL.md.
  2. Require explicit user activation of the skill for each ingestion or retrieval request.
  3. Store any necessary configuration in a skill-scoped configuration file rather than a global or persistent agent-policy file.
  4. Ask for informed user consent immediately before reading the knowledge-base index or document contents.
  5. Restrict retrieval to the minimum set of documents required for the current request.
  6. Treat retrieved document text as untrusted data and prohibit it from overriding system, developer, user, or skill instructions.
  7. If optional proactive retrieval is retained, expose it as a clearly labeled, reversible setting that is disabled by default and can be audited or removed without editing persistent agent identity files.
  8. Update both README.md and README_zh.md so their setup guidance remains consistent and does not recommend persistent policy injection.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The skill includes a direct shell deletion command against uploaded content, which is dangerous because agents or operators may generalize the example into a real command path without sufficient validation or confirmation. In this context, the command targets user-provided files in a processing pipeline, so mistakes, path substitution, or broadened deletion behavior could destroy source data and make recovery difficult or impossible.

Content

Scanner excerpt · references/add_knowledge.md (reported line 75)May include surrounding context.

bash
# 删除原始文件（以 docx 为例）
rm .openclaw/workspace/temp_file/文件.docx

注意：仅在转换成功且已更新索引后才删除原始文件。

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README explicitly instructs agents to persist uploaded document contents and derived markdown on local disk, but it does not warn about retention, sensitivity, access control, or cleanup. In a knowledge-ingestion skill, this can lead to accidental storage of confidential documents, creating privacy and data-handling risk even if no overt exfiltration is described.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The README instructs operators to inject a fixed English instruction block into SOUL.md to control agent behavior, without offering language or locale choice. This can violate language/locale policy expectations when users or deployments operate in other languages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README describes uploading documents and adding them to a local knowledge base, but it does not clearly warn users that uploaded files are converted, stored persistently under the workspace, and indexed for future retrieval. This can lead users to provide sensitive documents under the mistaken assumption that uploads are temporary, creating privacy and data-retention risk in an agent environment where later prompts may access the stored content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Most of the user-facing skill documentation is written in Chinese, including the functional description and usage guidance, with no indication that users may choose another language. This creates a natural-language policy concern because it effectively imposes a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill's invocation guidance is overly broad and triggers on generic situations like needing to query or add knowledge, without defining limits, consent requirements, trusted file sources, or situations where the skill must not be used. In a document-ingestion skill, this can cause overuse on untrusted uploads or inappropriate retrieval from local data stores, increasing the risk of unauthorized data exposure or unsafe processing of attacker-controlled files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The instructions require semantic Chinese filenames and Chinese summaries, which imposes a specific language policy on output. There is no opt-in, alternative locale handling, or stated justification that this skill is intended only for a Chinese-language environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs deletion of original uploaded files after processing, but does not require a user-facing confirmation, backup, retention window, or recovery mechanism. This creates a real data-loss risk if conversion is incomplete, incorrect, or if the generated Markdown omits important content, and the danger is amplified because the files are user uploads that may be the only local copy in the workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The entire skill guidance is written only in Chinese and does not indicate that the user or operator may choose another language or locale. Under the stated policy, language-specific behavior should be opt-in or explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.