ClawHub
Back to skill

Security audit

Agent Config

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious, but it can change persistent agent behavior and memory files, including private user context, with some scope and consent concerns.

Install only if you intentionally want a skill that edits persistent OpenClaw behavior, personality, user-profile, tool, and memory files. Review the silent logging and BOOTSTRAP deletion guidance first, and prefer requiring explicit confirmation before any change to AGENTS.md, USER.md, MEMORY.md, HEARTBEAT.md, or startup behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill advertises extremely broad trigger conditions such as changing agent behavior, updating rules, fixing, improving, or evolving agent behavior through context file changes. In an agentic system, this can cause the skill to activate on ordinary editing or refinement requests and then modify high-trust prompt/configuration files, creating a prompt-injection and policy-tampering pathway. The fact that it targets core files like AGENTS.md, SOUL.md, USER.md, and TOOLS.md makes accidental or adversarial activation more dangerous, not less.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · references/claude-patterns.md (reported line 412)May include surrounding context.

md
### Opus
- Very capable but expensive
- May over-think simple tasks
- Tendency toward verbosity without constraints
- Needs explicit terse/concise instructions

**Compensation:**

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/file-map.md (reported line 20)May include surrounding context.

md
**System prompt assembly order:**
1. Tooling (available tools + descriptions)
2. Skills (when available, auto-trigger on description match)
3. OpenClaw self-update capability
4. Workspace (current working directory)
5. Documentation (local docs path)
6. **→ Workspace Files (YOUR CONTEXT FILES INJECTED HERE) ←**

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.

md
❌ **Bloat** - Adding when updating existing would work  
❌ **Format mismatch** - Prose in table-heavy file, bullets in narrative file  
❌ **Subagent blindness** - Operational rule in file subagents don't see  
❌ **Size ignorance** - Adding to 19K file without checking

## When to Use References

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The instruction Wit/sarcasm aren't optional mandates a particular tone for responses, which is a natural-language policy constraint applied without offering user choice. The file presents this as a default compensation pattern rather than an opt-in persona or a region/domain-specific requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file explicitly documents 'silent logging' and 'don't announce, don't ask permission' for daily logs, which normalizes recording user activity without transparency or consent. In an agent-config skill, this is more dangerous because it shapes persistent operational behavior across sessions and may cause sensitive user data to be stored automatically in memory files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The bootstrap section states that BOOTSTRAP.md is read, executed, and then deleted, but does not frame deletion as a destructive action requiring confirmation or auditability. While likely intended as a one-time setup convenience, automatic deletion can erase evidence of what instructions were run and hinder review or rollback if the file is malicious or mistaken.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.