Security audit

Handover Hangover

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate handoff purpose, but it installs persistent hooks and trusts editable workspace state too broadly, so users should review it carefully before installing.

Install only if you are comfortable with a skill that is active every turn, writes persistent handoff files under memory/, and may install an OpenClaw lifecycle hook. Before enabling integration, review scripts/install-integration.sh and hooks/handover-hangover/handler.js, and prefer a version that executes only the managed hook copy, verifies integrity, treats handoff files as untrusted notes, and documents how to disable or uninstall the hook.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Warning

Location: scripts/install-integration.sh:14
Finding: Persistent OpenClaw Lifecycle Hook Is Installed and Enabled Across Sessions
Content: View full analysis
/dev/null 2>&1 && openclaw hooks --help >/dev/null 2>&1; then if openclaw hooks enable handover-hangover >/dev/null 2>&1; then ``` The installed hook declares persistent lifecycle triggers: ```yaml "events": ["message:received", "command:new", "command:reset", "gateway:startup"], ``` ### Technical Analysis The integration installer copies executable JavaScript and shell code into the user's persistent OpenClaw hook directory and enables the hook through the OpenClaw CLI. Once enabled, the code executes automatically when messages are received, sessions are created or reset, and the gateway starts. This behavior is documented and is related to the Skill's stated continuity function. Nevertheless, it creates a cross-session execution mechanism under the user's OpenClaw privileges. The installer does not request an explicit confirmation immediately before enabling the hook and does not provide a corresponding uninstall or disable operation. The persistence becomes especially security-sensitive because later modification or replacemen ...[truncated 1054 chars]
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: hooks/handover-hangover/handler.js:37
Finding: Lifecycle Hook Can Execute a Mutable Workspace Script Without Integrity Validation
Content: View full analysis
{ if (!ensureExecutable(scriptPath)) { console.warn(`[${HOOK_NAME}] watchdog script is not executable: ${scriptPath}`); resolve(); return; } // ... const child = execFile(scriptPath, { env: { ...process.env, WORKSPACE: workspaceDir }, timeout: 5000, killSignal: "SIGTERM", windowsHide: true, }, (error, stdout, stderr) => { ``` ### Technical Analysis When the installer-managed script adjacent to `handler ...[truncated 2395 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:128
Finding: Untrusted Workspace Memory Is Treated as Authoritative Agent Instructions
Content: View full analysis
` or `--- generated by` line. If the author is **your own model name** — this is a normal continuation, not a switch. Delete `memory/.handoff-pending`, skip to step 6, and continue working. No epistemic reset needed. **Safe-fail on name mismatch.** If you cannot parse the author line or your model name differs from what the previous instance wrote (aliases, provider prefixes), treat it as a different model and run the full read-side. A false full-reboot is cheap; a false early-exit is dangerous. If the author is a **different model** or the note contains `script-generated fallback` — a switch occurred. Continue with step 2. ``` ```markdown ### Step 6 — Continue work Use the handoff note and current-task as your authoritative source for what to do next. Do **not** ask the user "where were we?" — that is an indicator of failure. ``` The watchdog reads workspace-controlled task content and embeds it into a persistent handoff record: ```bash read_current_task() { if [ -f "$CURRENT_TASK" ]; then head -n 5 "$CURRENT_TASK" 2>/dev/null || echo "(error reading current-task.md)" else echo "(no current-task.md found — this is a fresh start)" fi } ``` ```bash generate_fallback() { local reason="$1" local task task=$(read_current_task) # ... cat > "$HANDOFF_NOTE" <
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The language section explicitly requires all artifacts and any user-facing messages to be in English. This is a natural-language policy concern because it forces a specific language choice without offering the user a locale option or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 21)May include surrounding context.
md
Handover Hangover is a **three-channel** OpenClaw skill (`always: true`) that uses layered defense to ensure handoff continuity even when one channel fails: - **Channel 1: System prompt** (`SKILL.md`) — tells the model *what* to write and *when* - **Channel 2: Filesystem** (`memory/handoff-note.md`, `memory/current-task.md`) — stores the handoff data - **Channel 3: Bash watchdog** (`scripts/handoff.sh`) — ensures the data *exists*, even if the model didn't follow instructions. Idempotent — safe for boot, heartbeat, hooks, and cron. Requires explicit integration (see [Integration](#integration))

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.md (reported line 31)May include surrounding context.
md
**Detection:** the agent self-checks on every turn whether a model switch may have occurred, using three heuristic indicators. Biased toward false positives — better to re-read state than to assume continuity. **Read-side:** when a handoff is detected, the incoming model reads the baton, performs an epistemic reset, verifies tool state, and continues work without asking "where were we?" **Watchdog:** an idempotent bash script that checks whether a handoff note exists and generates a mechanical fallback if not. Safe for any execution frequency — repeated runs without a new note are no-ops. Wire it through the managed hook pack, boot sequence, heartbeat, or manual scheduler. See [Integration](#integration).

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly instructs users to execute an installer script that copies files into hook directories, enables hooks, and modifies runtime behavior, but it does not give a clear warning to inspect the script or explain the trust boundary. In a prompt-injected skill ecosystem, encouraging direct execution of bundled shell scripts increases the chance of users running unreviewed code that persists across sessions and triggers automatically.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is configured with always: true, which causes it to activate on every turn regardless of relevance. In this skill, that broad activation is more dangerous because the instructions explicitly push frequent file reads/writes and operational checks at the start of every turn, increasing the chance of unintended side effects, context interference, and unnecessary access to persistent state.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · CHANGELOG.md (reported line 68)May include surrounding context.
md
# the previous model didn't follow prompt instructions. # # Integration: add to AGENTS.md boot sequence and/or HEARTBEAT.md. # OpenClaw does not auto-execute skill scripts — this must be wired # explicitly. See README.md for details. # # Four scenarios:

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · scripts/handoff.sh (reported line 9)May include surrounding context.
sh
# the previous model didn't follow prompt instructions. # # Integration: add to AGENTS.md boot sequence and/or HEARTBEAT.md. # OpenClaw does not auto-execute skill scripts — this must be wired # explicitly. See README.md for details. # # Four scenarios:

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/handoff.sh (reported line 24)May include surrounding context.
sh
# - Effect: prevents repeated fallback generation on the same boundary # - Scope: internal watchdog state — the model never reads or writes it # # All paths create .handoff-pending ("baton available"). # The model's read-side then checks the baton author: # - same model -> cheap early-exit, no full reboot # - different model or script-generated -> full read-side with epistemic reset

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · tests/run-tests.sh (reported line 93)May include surrounding context.
sh
ws="$(make_workspace hook-nonexec)" mkdir -p "$ws/skills/handover-hangover/scripts" cp "$ROOT/scripts/handoff.sh" "$ws/skills/handover-hangover/scripts/handoff.sh" chmod 0644 "$ws/skills/handover-hangover/scripts/handoff.sh" node --input-type=module <<NODE import hook from '$ROOT/hooks/handover-hangover/handler.js'; await hook({ type: 'message', action: 'received', context: { workspaceDir: '$ws', cfg: {} } });

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The seal lifecycle comments say '.handoff-sealed' is internal watchdog state that 'the model never reads or writes' it. However, the surrounding comments describe a model-side protocol that reacts to handoff state, and the absolute claim about model non-interaction is stronger than what the code can guarantee, creating intent/documentation divergence about who may observe or manipulate this state.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: hooks/handover-hangover/handler.js:102