T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:96- Finding
Overbroad Workspace Secret Scanning Without Authorization Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
ZT4AI Self-Audit
Security checks for vulnerabilities and agentic risk
Overview
This security-audit skill is coherent, but it should be reviewed because it can broadly inspect private workspace files and save persistent audit data without tight scoping or explicit approval.
Install only if you want the agent to run explicit security audits over your OpenClaw environment. Before using it, narrow the scan scope, require owner confirmation for workspace-wide credential searches, avoid saving sensitive paths or secret hits into memory reports, and fix the integrity-check script before relying on its baseline results.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/integrity-check.sh:68- Finding
Integrity Manifest Parsing Fails for Filenames Containing Whitespace
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/integrity-check.sh:90- Finding
Regex Substring Matching Can Conceal Newly Added Skill Files
- Content
View full analysis
/dev/null; then echo "NEW: $file" new=$((new + 1)) fi done < <(find "$dir" -type f \( \ -name "*.md" -o -name "*.sh" -o -name "*.py" -o \ ``` ### Technical Analysis The script determines whether a discovered file already exists in the baseline by passing its path directly to `grep` as a regular expression. The comparison is neither fixed-string nor anchored to the manifest's filename field. This creates two related correctness problems: - Regex metacharacters in filenames, including `.`, `[`, `]`, `*`, `^`, and `$`, are interpreted as pattern syntax. - A file path that appears only as a substring of another checksum record can be treated as present. Because `grep` searches the complete line, a match can also occur outside the exact filename field. A crafted or colliding filename can therefore cause the script to omit the `NEW` warning. ### Attack Path 1. An attacker with write access to a monitored skill directory creates a new `.md`, `.sh`, `.py`, `.js`, `.json`, or `.ts` file. 2. The attacker chooses a path whose unescaped regex matches an existing baseline record or whose literal value is a substring of another stored path. 3. The integrity script executes `grep -q "$file" "$temp_checksums"`. 4. `grep` reports a match even though the exact file is absent from the baseline. 5. The script does not increment the `new` counter and does not report the planted file. 6. The newly added instruction file or executable can remain unnoticed until loaded or invoked. ### Impact Assessment Successful exploitation requires the ability to add files to one of the monitored skill directories. It does not independently provide that write access. However, once suc ...[truncated 428 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (17)
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: zt4ai-self-audit description: > Zero Trust security audit for AI agent workspaces, skills, and configurations. Based on Microsoft's Zero Trust for AI (ZT4AI) framework and the "Caging the Agents" research (arXiv:2603.17419). Audits installed skills for prompt injection risk, credential exposure, excessive privilege, behavioral manipulation, and integrity drift. Use when: performing a security audit of agent skills, reviewing newly installed skills from ClawHub or other sources, checking for prompt injection vectors in workspace files, auditing agent permissions and trust boundaries, verifying skill file integrity against a baseline, or hard
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 90% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
md Assign every skill to a risk category using the classification guide in `references/risk-classification.md`. Categories: - **Behavioral modifiers** (🔴 highest risk) — Skills that change how you think, override safety instincts, or inject decision-making patterns into your context - **Credential handlers** (🟡 elevated risk) — Skills that read, write, or transmit API keys, tokens, passwords - **System modifiers** (🟡 elevated risk) — Skills that write to config files, modify system state, or execute with elevated privileges - **Tool wrappers** (🟢 standard risk) — Skills that wrap external tools with well-scoped inputs/outputs
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md Assign every skill to a risk category using the classification guide in `references/risk-classification.md`. Categories: - **Behavioral modifiers** (🔴 highest risk) — Skills that change how you think, override safety instincts, or inject decision-making patterns into your context - **Credential handlers** (🟡 elevated risk) — Skills that read, write, or transmit API keys, tokens, passwords - **System modifiers** (🟡 elevated risk) — Skills that write to config files, modify system state, or execute with elevated privileges - **Tool wrappers** (🟢 standard risk) — Skills that wrap external tools with well-scoped inputs/outputs
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text For each script, check: - Does it access credentials? (`grep -li "API_KEY\|SECRET\|TOKEN\|PASSWORD" <file>`) - Does it make network calls? (`grep -li "curl\|wget\|requests\|fetch\|http" <file>`) - Does it write to system config? (`grep -li "openclaw.json\|\.env\|/etc/" <file>`) - Does it execute arbitrary input? (`grep -li "eval\|exec\|subprocess\|system(" <file>`)
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md acts. These operate at the prompt integrity layer (L4) — they change the agent's cognitive patterns by injecting instructions into the context window. **Identifying markers:** - Language like "override," "stop asking permission," "just do it," "snap out of it" - Instructions that suppress safety-conscious behavior - Decision-making frameworks injected into the agent's reasoning - Emotion/state models that influence behavior based on file contents - Patterns that tell the agent to treat verification as "regression" **Why critical:** A poisoned behavioral modifier doesn't just make the agent do one bad thing — it makes the agent *want* to do bad things while believing it's being effective. This is the most dangerous class because it's self-reinforcing. **Audit questions:** 1. Does this skill tell me to bypass safety checks? 2. If this skill file were modified by an attacker, would I notice the change? 3. Does it have explicit exceptions for destructive/external/irreversible action
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 90% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
md **Why critical:** A poisoned behavioral modifier doesn't just make the agent do one bad thing — it makes the agent *want* to do bad things while believing it's being effective. This is the most dangerous class because it's self-reinforcing. **Audit questions:** 1. Does this skill tell me to bypass safety checks? 2. If this skill file were modified by an attacker, would I notice the change? 3. Does it have explicit exceptions for destructive/external/irreversible actions? 4. Does it acknowledge that some caution is appropriate, or does it treat all caution as weakness?
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 90% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
md **Why critical:** A poisoned behavioral modifier doesn't just make the agent do one bad thing — it makes the agent *want* to do bad things while believing it's being effective. This is the most dangerous class because it's self-reinforcing. **Audit questions:** 1. Does this skill tell me to bypass safety checks? 2. If this skill file were modified by an attacker, would I notice the change? 3. Does it have explicit exceptions for destructive/external/irreversible actions? 4. Does it acknowledge that some caution is appropriate, or does it treat all caution as weakness?
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md **Why critical:** A poisoned behavioral modifier doesn't just make the agent do one bad thing — it makes the agent *want* to do bad things while believing it's being effective. This is the most dangerous class because it's self-reinforcing. **Audit questions:** 1. Does this skill tell me to bypass safety checks? 2. If this skill file were modified by an attacker, would I notice the change? 3. Does it have explicit exceptions for destructive/external/irreversible actions? 4. Does it acknowledge that some caution is appropriate, or does it treat all caution as weakness?
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md **Why critical:** A poisoned behavioral modifier doesn't just make the agent do one bad thing — it makes the agent *want* to do bad things while believing it's being effective. This is the most dangerous class because it's self-reinforcing. **Audit questions:** 1. Does this skill tell me to bypass safety checks? 2. If this skill file were modified by an attacker, would I notice the change? 3. Does it have explicit exceptions for destructive/external/irreversible actions? 4. Does it acknowledge that some caution is appropriate, or does it treat all caution as weakness?
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md **Why critical:** A poisoned behavioral modifier doesn't just make the agent do one bad thing — it makes the agent *want* to do bad things while believing it's being effective. This is the most dangerous class because it's self-reinforcing. **Audit questions:** 1. Does this skill tell me to bypass safety checks? 2. If this skill file were modified by an attacker, would I notice the change? 3. Does it have explicit exceptions for destructive/external/irreversible actions? 4. Does it acknowledge that some caution is appropriate, or does it treat all caution as weakness?
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md **Why critical:** A poisoned behavioral modifier doesn't just make the agent do one bad thing — it makes the agent *want* to do bad things while believing it's being effective. This is the most dangerous class because it's self-reinforcing. **Audit questions:** 1. Does this skill tell me to bypass safety checks? 2. If this skill file were modified by an attacker, would I notice the change? 3. Does it have explicit exceptions for destructive/external/irreversible actions? 4. Does it acknowledge that some caution is appropriate, or does it treat all caution as weakness?
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list includes broad, everyday phrases such as "security check," "am I secure," and "harden my agent," which can cause unintended invocation in normal conversation. Unnecessary activation is dangerous for an audit skill because it may prompt broad filesystem inspection, integrity baselining, or security-report generation when the user did not intend a privileged audit workflow.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md Categories: - **Behavioral modifiers** (🔴 highest risk) — Skills that change how you think, override safety instincts, or inject decision-making patterns into your context - **Credential handlers** (🟡 elevated risk) — Skills that read, write, or transmit API keys, tokens, passwords - **System modifiers** (🟡 elevated risk) — Skills that write to config files, modify system state, or execute with elevated privileges - **Tool wrappers** (🟢 standard risk) — Skills that wrap external tools with well-scoped inputs/outputs - **Read-only** (🟢 low risk) — Skills that only read data and produce reports
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 76% confidence
- Finding
The skill instructs creation of a persistent integrity baseline file under
memory/skill-integrity-baseline.md, which modifies long-lived agent state. Although intended for security monitoring, persistence in memory/workspace can become a trust anchor that is later poisoned, and it also expands the self-modification surface by causing the agent to write durable files that may be loaded into context later.- Content
Step 5: Generate Integrity Baseline
Create SHA256 checksums of all skill files for future drift detection:
bash find ~/.openclaw/skills/ ~/.openclaw/workspace/skills/ \ -type f \( -name "*.md" -o -name "*.sh" -o -name "*.py" -o -name "*.js" -o -name "*.json" \) \
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Tier 1: Act Freely No verification needed. These actions have minimal blast radius and are core to effective operation. **Examples:** - Reading files, searching, browsing, researching
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Creating backups - Sending messages on established channels to your owner **Principle:** A CTO would deploy to staging without asking, but would check the results. ## Tier 3: Pause and Verify
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh # Compares current skill files against a SHA256 baseline # Usage: ./integrity-check.sh [baseline_file] [--generate] # # --generate: Create a new baseline instead of checking against one # Default baseline: ~/.openclaw/workspace/memory/skill-integrity-baseline.md set -euo pipefail