OpenClaw Skills Creator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:38 AM UTC
• Version: 1.0.0

Overview

This is a local skill-authoring helper whose file creation and packaging behavior matches its purpose, with no evidence of hidden network, credential, or persistence abuse.

Install only if you want Codex to help author or maintain skills. Use explicit target paths, review diffs before accepting SKILL.md changes, and package only when you intend to publish or share a skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description focuses on authoring, modifying, reviewing, auditing, and restructuring skills and SKILL.md files. The supplied code does not do those tasks as its primary function. Instead, it validates an existing skill folder and packages it into a .skill zip archive, writing a new distributable file to disk. While validation is loosely related to skill maintenance, the main behavior—archiving and distribution—is materially different from the declared purpose and is not represented in the description. Therefore this is a clear description/behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description focuses on authoring and modifying AgentSkills and their metadata/content. The actual code does not create or improve a skill for user-facing authoring purposes; instead, it tests packaging security behavior of an existing packaging module. This is a materially different primary purpose. While packaging may be related to skill tooling broadly, the code shown is specifically a test harness for archive creation and path/symlink safety, which is not represented in the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a general-purpose skill authoring/editing/auditing tool for AgentSkills. The actual code chunk is not implementing those functions directly; it is a test script for a separate validator module (quick_validate). Its primary purpose is automated regression testing of validation logic, using temporary files and monkey-patching parser availability. While validation is mentioned in the declaration, this code is specifically test infrastructure rather than a skill-creation or cleanup capability, so the behavior is materially narrower and different from the declared purpose.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

This skill explicitly instructs the agent to create and modify skill files, including SKILL.md, which is a form of self-modification or modification of agent behavior artifacts. In a system where skills influence future agent actions, letting a skill rewrite those artifacts can persist unsafe instructions, broaden future capabilities, or silently alter trust boundaries.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

md

1. Understand the skill with concrete examples
2. Plan reusable skill contents (scripts, references, assets)
3. Initialize the skill (run init_skill.py)
4. Edit the skill (implement resources and write SKILL.md)
5. Package the skill (run package_skill.py) — **optional, only when user explicitly requests or when publishing to ClawHub**
6. Iterate based on real usage

Self-Modification

High

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The 'Update SKILL.md' instruction directly authorizes changes to the core instruction file that determines future skill behavior. Even if intended for legitimate maintenance, this creates a persistence mechanism for prompt injection, policy drift, or accidental privilege expansion if the content being inserted is unsafe or user input is insufficiently constrained.

Content

Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.

md

If you used `--examples`, delete any placeholder files that are not needed for the skill. Only create resource directories that are actually required.

#### Update SKILL.md

**Writing Guidelines:** Always use imperative/infinitive form.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/init_skill.py (reported line 308)May include surrounding context.

python

# Print next steps
    print(f"\n[OK] Skill '{skill_name}' initialized successfully at {skill_dir}")
    print("\nNext steps:")
    print("1. Edit SKILL.md to complete the TODO items and update the description")
    if resources:
        if include_examples:
            print("2. Customize or delete the example files in scripts/, references/, and assets/")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test_package_skill.py (reported line 67)May include surrounding context.

python

def test_skips_symlink_to_external_file(self):
        skill_dir = self.create_skill("symlink-file-skill")
        outside = self.temp_dir / "outside-secret.txt"
        outside.write_text("super-secret\n")
        link = skill_dir / "loot.txt"
        out_dir = self.temp_dir / "out"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test_package_skill.py (reported line 92)May include surrounding context.

python

def test_skips_symlink_to_external_file(self):
        skill_dir = self.create_skill("symlink-file-skill")
        outside = self.temp_dir / "outside-secret.txt"
        outside.write_text("super-secret\n")
        link = skill_dir / "loot.txt"
        out_dir = self.temp_dir / "out"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test_package_skill.py (reported line 109)May include surrounding context.

python

def test_skips_symlink_to_external_file(self):
        skill_dir = self.create_skill("symlink-file-skill")
        outside = self.temp_dir / "outside-secret.txt"
        outside.write_text("super-secret\n")
        link = skill_dir / "loot.txt"
        out_dir = self.temp_dir / "out"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs the agent to run local scripts, read environment variables for path resolution, and create or modify files, but it does not declare any explicit tool scope or permission boundaries. In a skill that can initialize, edit, validate, and package directories, this increases the chance of unintended shell execution or filesystem changes beyond what the user expected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger text is broad enough to activate on generic phrases like 'review the skill' or 'clean up the skill,' which could cause this high-capability skill to load in contexts the user did not intend. Because the skill then guides shell execution, file edits, restructuring, and optional packaging, accidental invocation can expand agent authority and lead to unnecessary filesystem modifications.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/init_skill.py (reported line 73)May include surrounding context.

python

## Resources (optional)

Create only the resource directories this skill actually needs. Delete this section if no resources are required.

### scripts/
Executable code (Python/Bash/etc.) that can be run directly to perform specific operations.

Static analysis

No suspicious patterns detected.