Boss AI Agent

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:51 AM UTC
• Version: 9.0.0

Overview

This skill is mostly coherent as a management assistant, but its Team Operations mode can run persistent jobs, send employee messages, sync business data, and launch an unpinned external MCP package with an API key.

Use Advisor Mode freely for offline management advice, but treat Team Operations Mode as a high-privilege workplace automation system. Before enabling it, pin and verify the MCP package, use a narrowly scoped API key, review every cron job and sync destination, disable jobs you do not need, preview employee-facing messages, and avoid storing sensitive employee, health, compensation, or performance details in local learning fields.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:99

Finding

Autonomous Scheduled Jobs Create Cross-Session Persistence and External Write Effects

Content

View full analysis

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/setup-guide.md:9

Finding

Unpinned npm Package Is Automatically Downloaded and Executed with an API Key

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (40)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

The README explicitly states that tool parameters including employee names, discussion topics, and message content are sent to a cloud server, and that autonomous cron jobs may send messages to employees. In a management skill handling HR-style data, this is highly sensitive and increases the risk of privacy leakage, unauthorized communications, and harmful automated actions if the backend, configuration, or triggering logic is compromised or misused.

Content

Scanner excerpt · README.md (reported line 115)May include surrounding context.

md

Tool parameters (employee names, discussion topics, message content) are sent to the cloud server for processing. Write tools deliver messages to employees via connected platforms. Local files (`config.json`, chat history, memory) stay on your machine and are not transmitted to the server.

**Persistent behavior** (Team Operations only): Registers up to 6 cron jobs that run autonomously — including jobs that send messages to employees. Solo founder mode (team=0) only registers 3 (briefing, signalScan, sync). Review schedules in `config.json` before activating. Manage with `cron list` / `cron remove`.

## OpenClaw Integration Architecture

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a comprehensive management-advisor skill with extensive leadership use cases, preference learning, culture-aware feedback, and optional MCP-based automation. The supplied code chunk does not implement that general-purpose advisory behavior. Instead, it is a single-purpose formatter: it reads JSON inputs from files, applies a mentor-dependent priority order for sections, derives off-track KPIs and pending action items, and emits a markdown morning briefing. While this code is related to one small part of the declared domain (daily briefings and mentor labels), its actual primary purpose is much narrower than the description. The mismatch is material because the description suggests a full-featured management assistant, whereas the code only performs presentation/formatting of precomputed data.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a management-advice and leadership-support skill, focused on coaching, performance, conflict resolution, cultural guidance, KPI/risk review, and boss decision support. The supplied code does not implement any of those advisory capabilities. Instead, it is a narrowly focused technical utility for formatting synchronization previews and reports for Notion/Sheets data sync flows. Its primary purpose is materially different from the declared purpose, and its triggers/resources are unrelated to management guidance. While the output includes wording like 'Boss decides which version to keep,' that is only part of sync conflict messaging and does not make the code a management advisor.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The activation guidance is extremely broad and tells the system to use the skill even when the user does not explicitly ask for management help. For a skill with persistence, optional external connectivity, and message-sending/automation claims, over-triggering materially raises the risk of inappropriate activation, unintended data collection, or unanticipated actions in unrelated conversations.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 78% confidence

Finding

The phrase 'Always respond' is an anti-refusal pattern that can pressure the agent to ignore safety boundaries, context limits, or appropriate abstention. In a skill that discusses messaging employees, escalation, and persistent behavior, such language increases the chance of unsafe or policy-violating compliance under adversarial prompting.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

You are Boss AI Agent — the boss's AI management advisor and operations middleware. You help bosses make better management decisions using mentor philosophy frameworks.

The selected mentor's philosophy permeates ALL your decisions — check-in questions, risk assessment, communication priority, escalation intensity, summary perspective, and emergency response style. Always respond in the boss's language (auto-detect from conversation context).

## Skill Directory

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · boss-ai-agent-workspace/iteration-1/eval-1-briefing/with_skill/outputs/briefing.md (reported line 70)May include surrounding context.

md

This can be sent via the `send_message` tool if you approve.

**Step 2 — Listen without judgment**

When Timi responds, practice what Inamori called "listening with the heart" (kokoro de kiku). Do not immediately discuss missed check-ins. Focus on:
- How they are feeling

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The sync flow reads and writes external systems and uses last-write-wins conflict resolution, which can overwrite data without strong user awareness or granular approval. This is especially dangerous because the skill is connected to external stores like Notion and Sheets, so a bad sync or ambiguous conflict can cause irreversible integrity loss across systems.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says to use the skill whenever the user needs management advice, leadership guidance, or team operations help. These categories are very broad, with no explicit trigger phrases, scope limits, or negative examples, which increases the chance of unintended invocation during general conversation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The README instructs users to run an unpinned npm package via npx -y @tonykk/management-brain-mcp, which will fetch whatever version is current at execution time. Because this package is intended to run with sensitive API keys and access management data, a compromised publisher account, malicious update, or dependency hijack could lead to arbitrary code execution, credential theft, or unauthorized access to employee data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This repeats the same unsafe distribution pattern: executing an unpinned remote npm package with npx. In this skill's context, the MCP server may receive API keys and interact with company operations, so a malicious package update would have a privileged foothold in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The unpinned npx invocation creates a software supply-chain risk because users will execute the latest published package without review. Given that this package is part of a management automation system handling employee communications and operational data, compromise could expose sensitive business information or enable unauthorized actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This occurrence again directs execution of an unpinned external package through npx, inheriting the same risk of malicious upstream updates or dependency compromise. Because the package is described as an MCP server used for team operations, successful exploitation could lead to code execution plus access to management workflows and secrets.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs the agent to write persistent state to a local config file and to invoke local scripts, but it does not declare a restrictive tool scope such as explicit permissions or allowed-tools. That increases the chance the runtime grants broader file-write capability than users expect, enabling unintended local state changes or abuse if the skill is triggered too broadly.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill explicitly persists session-derived preferences and context to ~/.openclaw/skills/boss-ai-agent/config.json, creating cross-session retention of workplace-related metadata. Even with some stated boundaries, this introduces privacy and data minimization risk, especially because the skill is broadly triggerable and may handle sensitive personnel topics.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

• Inamori (稻盛和夫) — Altruism, respect, team harmony
  • Ma (马云) — Embrace change, teamwork, customer-first
  • (User can ask for the full list of 16 mentors)

3. Write config to ~/.openclaw/skills/boss-ai-agent/config.json:

json

{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill describes storing preferences, decision patterns, and session context in a local config file without surfacing a prominent storage warning at the moment data is first collected. That creates a privacy risk because users may reveal workplace-sensitive information under the assumption it is transient.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill claims Advisor Mode has no persistent behavior while also directing the agent to write and later read a persistent config file. That inconsistency can undermine informed consent, causing users to expose preferences and session context to disk when they believe the mode is ephemeral.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill recommends running an unpinned MCP package via npx -y @tonykk/management-brain-mcp, which fetches the latest published version at execution time. This creates a supply-chain risk: a compromised publisher account or malicious update could introduce code execution or data exfiltration in environments that follow the setup instructions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The briefing presents itself as connected to live team systems and bases recommendations on current employee check-in status, which goes beyond a purely offline advisory output. In a management skill handling employee data, implying real-time access without clearly stating data provenance, authorization boundaries, and privacy safeguards can mislead users and normalize access to sensitive personnel information.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The output offers to perform operational actions such as sending messages and triggering check-ins, which exceeds passive management advice and moves into execution against employee communication channels. Without strong confirmation, scope controls, and audit-oriented warnings, this can lead to unintended or inappropriate outreach to employees using sensitive workplace data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The briefing recommends sending a personal outreach message to an employee via a tool without warning the user that the communication may contain sensitive employment or wellness-related content. In HR and team-management contexts, such messages can expose private employee circumstances or create inappropriate records if sent over the wrong channel or without review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The action menu encourages immediate employee messaging and check-in operations without any safety interstitial about privacy, tone, data sensitivity, or organizational policy compliance. Because the skill is positioned as management middleware, users may treat these actions as routine and send sensitive personnel communications without adequate review or consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document prescribes culture-specific behavior based on an assumed national identity ('Philippines') and applies it as overriding guidance throughout the conversation. This can lead managers to stereotype employees, make unsupported inferences about communication preferences, and shape HR-sensitive interactions on protected or quasi-protected demographic assumptions without verification or user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs the manager to document what was learned from a sensitive 1:1 privately, including potential personal issues, but gives no guidance on data minimization, consent, retention, access controls, or compliance with HR/privacy policies. In a workplace context, this can encourage informal shadow records containing health, family, or performance-adjacent data that are mishandled or later misused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The statement 'All materials must be natively Japanese' imposes a specific language requirement in natural-language guidance. The policy allows locale constraints only when user choice is offered or the constraint is clearly documented as region-specific and justified; this line does not make that justification explicit.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger set is intentionally broad and encourages invocation for many loosely defined 'people leadership' situations, while the skill metadata also says to use it even when the user does not explicitly mention management. That increases the chance of over-triggering into a connected automation-capable skill, causing inappropriate routing, unnecessary access to employee/team context, or unintended operational actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.