Sector Opening Note

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:10 AM UTC
• Version: 1.0.0

Overview

The skill is a simple HK tech pre-market brief generator, but it unnecessarily asks for persistent memory write access.

Review this skill before installing unless memory_write is removed or clearly scoped. Its market-brief behavior is otherwise narrow, but persistent memory access could let future runs store information or instructions beyond what a daily news summary needs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:7

Finding

Unnecessary Persistent-Memory Write Capability

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7-11
Vulnerability Type: Excessive tool permissions
Risk Level: Low

Evidence

yaml

"openclaw":
  {
    "emoji": "📈",
    "requires": { "tools": ["web_search", "memory_write"] },
    "install":

Technical Analysis

The skill declares memory_write as a required tool even though its documented purpose is limited to searching for current Hong Kong technology-sector information and generating a pre-market brief. No documented command, parameter, workflow, or output requirement uses persistent memory.

Granting a persistent write capability that is not necessary for the stated task violates the principle of least privilege. It unnecessarily expands the capability set available while the skill is active. The reviewed file does not explicitly instruct the agent to write data to memory, so there is no evidence of an intentional memory-poisoning operation; the issue is the unjustified permission itself.

Attack Path

1. A host registers the skill and grants all tools listed in its requires metadata.
2. The skill consequently receives access to memory_write, despite only requiring web search for its documented operation.
3. If the execution context is subsequently influenced by untrusted web content, malformed input, or another compromised instruction source, that context may attempt to invoke the unnecessarily available memory-writing tool.
4. Depending on host-side authorization controls, unwanted content could then be stored in persistent agent memory and affect later sessions.

This path requires an additional mechanism capable of inducing a tool call; SKILL.md alone does not contain such an instruction.

Impact Assessment

The excessive declaration potentially exposes persistent agent state to unauthorized modification. Successful abuse could store misleading preferences, fabricated facts, or hostile instructions that influ ...[truncated 316 chars]

Remediation

View remediation

Remediation Suggestions

Remove memory_write from the required tool list and retain only the capability needed by the documented workflow:

yaml

"requires": { "tools": ["web_search"] }

Additionally:

1. Require explicit user approval before granting any persistent-state write capability.
2. Enforce per-invocation tool authorization rather than granting every declared capability for the entire skill run.
3. Restrict persistent-memory writes to an allowlisted schema and trusted data sources.
4. Treat web-search results as untrusted data and prevent retrieved content from authorizing tool calls.
5. Add a registration-time validation rule that rejects capabilities not referenced by a skill's documented workflow.
6. If persistent storage later becomes a legitimate requirement, document exactly what is stored, when writes occur, the retention period, and how users can inspect or delete stored data.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill requests persistent memory_write capability even though its stated function is only to search public web sources and generate a same-session market brief. Unnecessary write access expands the attack surface by allowing the skill or downstream prompt flow to store data, instructions, or tracking artifacts persistently, which is not needed for this use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The required brief sections are specified in Chinese, and the example output mixes Chinese-labeled sections with English content, implying the skill expects a specific language/locale format by default. The file does not offer the user a language choice or document this as an explicit opt-in requirement.

Content

No source excerpt is available for this finding.