ReSoul

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:28 AM UTC
• Version: 0.1.3

Overview

This reset skill is coherent, but it should be reviewed because it replaces persistent assistant bootstrap state with mutable network-fetched instructions and relies on prose-only confirmation for destructive identity-file changes.

Install only if you intend to let this skill reset OpenClaw identity/bootstrap files. Before running it, confirm the exact workspace path, understand that SOUL.md, USER.md, and IDENTITY.md will be moved out of the root, and consider reviewing or pinning the downloaded BOOTSTRAP.md source before starting a new session with /new.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/fetch_official_bootstrap.sh:9

Finding

Mutable Remote Bootstrap Instructions Are Retrieved Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: scripts/fetch_official_bootstrap.sh:9, 20-30, 48-51; related workflow in SKILL.md:28-38, 49-58
Vulnerability Type: Unpinned remote payload retrieval
Risk Level: Medium

Vulnerable Code

bash

URL="https://raw.githubusercontent.com/openclaw/openclaw/main/docs/reference/templates/BOOTSTRAP.md"

bash

if command -v curl >/dev/null 2>&1; then
  curl -fsSL "$URL" -o "$TMP"
elif command -v wget >/dev/null 2>&1; then
  wget -qO "$TMP" "$URL"
else
  echo "Neither curl nor wget is available." >&2
  exit 1
fi

if [[ ! -s "$TMP" ]]; then
  echo "Fetched BOOTSTRAP.md is empty." >&2
  exit 1
fi

markdown

bash {{SKILL_DIR}}/scripts/fetch_official_bootstrap.sh <workspace-dir>

markdown

Tell the user to run `/new` after completion so the next session starts from the restored bootstrap flow.

Technical Analysis

The script retrieves BOOTSTRAP.md from the mutable main branch of an external GitHub repository. It does not pin the resource to a reviewed commit, verify a cryptographic checksum or signature, or validate the downloaded instructions beyond confirming that the file is nonempty.

Although the declared URL points to the official OpenClaw repository, its contents can change after this Skill package has been reviewed. The fetched file is installed as the workspace bootstrap file, and the documented workflow instructs the user to run /new. Consequently, the remote document can control instructions processed by a subsequent Agent session.

No evidence was found that the currently referenced upstream content is malicious. The vulnerability arises from trusting mutable future content without integrity or authenticity controls.

Attack Path

1. An attacker compromises the upstream repository, its main branch, a maintainer account, or the publication process.
2. The attacker modifies the remo ...[truncated 1038 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the upstream URL to a specific, reviewed Git commit rather than the mutable main branch.
2. Bundle an expected SHA-256 digest with the Skill and verify the temporary file before modifying any workspace files.
3. Prefer a cryptographically signed release artifact and verify its signature against a pinned trusted key.
4. Treat an integrity-verification failure as fatal and leave SOUL.md, USER.md, IDENTITY.md, and the existing BOOTSTRAP.md untouched.
5. Consider packaging a reviewed bootstrap template locally and making remote synchronization a separate, explicitly approved update operation.
6. If updates must remain dynamic, display the source commit and verified digest to the user before installation.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/fetch_official_bootstrap.sh:10

Finding

Collision-Prone Archive Names Can Silently Replace Existing Identity Backups

Content

View full analysis

Vulnerability Details

File Location: scripts/fetch_official_bootstrap.sh:10, 34-44
Vulnerability Type: Unsafe archive-file replacement
Risk Level: Low

Vulnerable Code

bash

TIMESTAMP="$(date +%Y%m%d-%H%M%S)"

bash

if [[ -f "$SOUL" ]]; then
  mv "$SOUL" "$TRASH_DIR/SOUL.md.$TIMESTAMP"
fi

if [[ -f "$USER_FILE" ]]; then
  mv "$USER_FILE" "$TRASH_DIR/USER.md.$TIMESTAMP"
fi

if [[ -f "$IDENTITY_FILE" ]]; then
  mv "$IDENTITY_FILE" "$TRASH_DIR/IDENTITY.md.$TIMESTAMP"
fi

Technical Analysis

Archive filenames are unique only to one-second resolution. The script neither checks whether a destination already exists nor uses no-clobber semantics. Standard mv behavior can replace an existing destination file when permissions allow it.

A second execution within the same second, a previously retained archive with a matching timestamp, or deliberate pre-creation of the expected destination can therefore cause an earlier backup to be overwritten. This weakens the promised archival safety of a destructive identity reset.

Attack Path

1. A file such as .trash/SOUL.md.20260916-120000 already exists.
2. The reset runs while TIMESTAMP evaluates to 20260916-120000.
3. The script executes mv "$SOUL" "$TRASH_DIR/SOUL.md.$TIMESTAMP".
4. The existing archive is replaced by the current SOUL.md.
5. The previous archived identity state is lost and cannot be restored from that backup.

The same path applies independently to USER.md and IDENTITY.md.

Impact Assessment

Successful exploitation or an accidental collision can destroy previously archived identity files, reducing rollback and recovery capability. The impact is confined to colliding files under the workspace .trash/ directory. It does not grant additional privileges, execute attacker-supplied commands, or directly affect unrelated project and memory files.

Remediation

View remediation

Remediation Suggestions

1. Create a unique archive directory using mktemp -d, then place all identity files for one reset inside that directory.
2. Alternatively, use filenames containing nanoseconds and a random suffix, followed by an explicit collision check.
3. Use no-clobber behavior, such as mv -n, where supported, and verify afterward that the move succeeded.
4. For portable and predictable behavior, test each destination with [[ -e "$destination" ]] and abort before moving any files if a collision exists.
5. Prepare and validate all archive destinations before the first move to avoid partially completed reset operations.
6. Report only files that were actually archived rather than printing unconditional “if present” destination messages.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill describes a destructive reset workflow that depends on a second explicit confirmation, but SKILL.md contains only natural-language instructions and no enforceable mechanism ensuring that safeguard is actually implemented before shell commands run. Because the workflow archives/removes identity files and replaces bootstrap state, any mismatch between description and execution can lead to unintended destructive changes and remote content being written into the workspace.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

- Do not execute this skill without a second explicit confirmation in the current conversation.
- Do not hand-author a replacement bootstrap unless the user explicitly asks for a customized variant after syncing the official file.
- Only archive and remove `SOUL.md`, `USER.md`, and `IDENTITY.md` from the workspace root; do not delete memory, project files, skills, or other workspace content.
- Fetch the official template successfully before archiving or removing any existing identity files.
- Archive existing `SOUL.md`, `USER.md`, and `IDENTITY.md` into `.trash/` before removing them from the workspace root when those files exist.
- Do not execute the bootstrap ritual automatically after syncing; stop after preparing the workspace and instruct the user to run `/new`.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes shell execution via a bundled script but does not declare any tool scope or allowed-tools restrictions. That creates an authorization and review gap: an agent may execute destructive filesystem and network-fetch operations without an explicit capability boundary, increasing the risk of misuse or accidental execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This reset skill has a broader capability than its description suggests because it performs outbound network access to GitHub. In a sensitive 'persona/bootstrap reset' context, silently introducing network dependency increases attack surface, enables remote content influence over future assistant behavior, and may violate least-privilege expectations for a local reset operation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script restores BOOTSTRAP.md by downloading content from a remote GitHub URL at execution time, but the skill description frames this as restoring an official local/default bootstrap. That creates a supply-chain and transparency risk: users may not realize a reset operation depends on network content that can change over time or be unavailable, and the fetched file is trusted without pinning or verification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The completion message says the file was written from a temporary file but omits that the temporary file was populated from a remote download. This is misleading and reduces auditability, making it easier for operators to miss that assistant bootstrap state was replaced with network-fetched content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.