ClawHub
Back to skill

Security audit

Agent Config

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious, but it can change persistent agent behavior and memory files, including private user context, with some scope and consent concerns.

Install only if you intentionally want a skill that edits persistent OpenClaw behavior, personality, user-profile, tool, and memory files. Review the silent logging and BOOTSTRAP deletion guidance first, and prefer requiring explicit confirmation before any change to AGENTS.md, USER.md, MEMORY.md, HEARTBEAT.md, or startup behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Vague Triggers

High
Confidence
96% confidence
Finding
The skill advertises extremely broad trigger conditions such as changing agent behavior, updating rules, fixing, improving, or evolving agent behavior through context file changes. In an agentic system, this can cause the skill to activate on ordinary editing or refinement requests and then modify high-trust prompt/configuration files, creating a prompt-injection and policy-tampering pathway. The fact that it targets core files like AGENTS.md, SOUL.md, USER.md, and TOOLS.md makes accidental or adversarial activation more dangerous, not less.

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
### Opus
- Very capable but expensive
- May over-think simple tasks
- Tendency toward verbosity without constraints
- Needs explicit terse/concise instructions

**Compensation:**
Confidence
80% confidence
Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Self-Modification

High
Category
Rogue Agent
Content
**System prompt assembly order:**
1. Tooling (available tools + descriptions)
2. Skills (when available, auto-trigger on description match)
3. OpenClaw self-update capability
4. Workspace (current working directory)
5. Documentation (local docs path)
6. **→ Workspace Files (YOUR CONTEXT FILES INJECTED HERE) ←**
Confidence
90% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
❌ **Bloat** - Adding when updating existing would work  
❌ **Format mismatch** - Prose in table-heavy file, bullets in narrative file  
❌ **Subagent blindness** - Operational rule in file subagents don't see  
❌ **Size ignorance** - Adding to 19K file without checking

## When to Use References
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The instruction `Wit/sarcasm aren't optional` mandates a particular tone for responses, which is a natural-language policy constraint applied without offering user choice. The file presents this as a default compensation pattern rather than an opt-in persona or a region/domain-specific requirement.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The file explicitly documents 'silent logging' and 'don't announce, don't ask permission' for daily logs, which normalizes recording user activity without transparency or consent. In an agent-config skill, this is more dangerous because it shapes persistent operational behavior across sessions and may cause sensitive user data to be stored automatically in memory files.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The bootstrap section states that BOOTSTRAP.md is read, executed, and then deleted, but does not frame deletion as a destructive action requiring confirmation or auditability. While likely intended as a one-time setup convenience, automatic deletion can erase evidence of what instructions were run and hinder review or rollback if the file is malicious or mistaken.

Static analysis

No suspicious patterns detected.