Security audit

Openclaw Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent management assistant, but it enables persistent team monitoring, employee profiling, outbound cloud use, messaging, and host command capability with insufficient scoping and disclosure.

Install only after deciding you are comfortable with persistent workplace monitoring. Before enabling it, require explicit channel and employee allowlists, per-job approval for cron tasks, retention and deletion rules for employee profiles, clear employee/organization consent, pinned MCP package versions, and a documented cloud data-flow policy. Avoid setting BOSS_AI_AGENT_API_KEY or BOSS_AI_AGENT_URL unless you trust the endpoint and understand what prompts, employee data, and analytics may leave the local environment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T06 · System Persistence

Error

Location: SKILL.md:96
Finding: Recurring monitoring and messaging jobs are installed without per-job approval
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:402
Finding: Broad channel surveillance creates persistent sensitive employee profiles
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:621
Finding: Bearer API credential can be transmitted to an arbitrary environment-controlled host
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:617
Finding: Cloud privacy guarantee contradicts documented transmission of local prompts
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:470
Finding: Remote cloud responses are permitted to override local agent decision behavior
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:656
Finding: Unpinned npx package execution exposes users to supply-chain compromise
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 70% confidence
Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
The selected mentor's philosophy affects ALL your decisions — not just check-in question style, but also risk assessment approach, communication priority, escalation intensity, summary perspective, and emergency response style. Mentor permeation is total: every output you produce is filtered through the active mentor's lens. Always respond in the boss's language. Auto-detect from conversation context. Support both English and Chinese natively. ## Permissions & Transparency

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill claims spawned sub-agents are read-only and cannot modify state, but other sections instruct sub-agents to use tools like exec and define only prompt-level constraints rather than enforced tool restrictions. This mismatch can cause operators to trust sub-agents with broader authority than advertised, increasing risk of unauthorized actions or unsafe data handling.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill grants use of exec for arbitrary shell commands even though its core purpose is management automation, messaging, and reporting. Because the command examples are open-ended and tied to emergency workflows, the agent could be induced to run host-level commands against internal services, exposing the system to command abuse, data access, or lateral movement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README presents the cloud platform as optional and highlights analytics, virtual board discussions, and an MCP HTTP endpoint, but it does not explicitly state what categories of team data may be sent to manageaibrain.com or when remote transmission occurs. In a management/monitoring skill that handles employee status, sentiment, alerts, and cross-system integrations, this omission can mislead users into exposing sensitive organizational and personnel data off-device without informed consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instruction "Always respond in the boss's language. Auto-detect from conversation context" imposes a language-selection policy automatically rather than offering the user a choice. The documented support for English and Chinese does not include an explicit opt-in or preference-setting mechanism for language/locale behavior.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.
Invoke:

text
web_fetch --url "https://api.github.com/repos/{owner}/{repo}/pulls?state=open"

When: Use to pull live data from GitHub PRs and issues, Linear sprint boards, Jira boards, Notion pages, and email APIs during patrol and briefing scenarios.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.
md
--- ### read / write **What**: Read from and write to local files.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The exec example uses curl to arbitrary URLs from the host shell, combining outbound network access with local command execution. In context of emergency response and sub-agent use, this materially enlarges the attack surface and can be repurposed to probe internal services, exfiltrate data, or chain with shell features for broader compromise.
Content: Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.
Invoke:

text
exec --command "curl -s https://api.example.com/health"

When: Use to check deployment status, tail logs for error signals, or run health checks against internal services during emergency response.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 419)May include surrounding context.
md
### 6. Knowledge Base Management **Trigger:** Boss says "record this decision" / "update Notion" / "记下来" / "save to knowledge base" / "write this down" **Process:**

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes broad phrases like "record this decision," "save to knowledge base," and especially "write this down," which are common conversational utterances that could occur in many contexts. The skill does not provide negative examples or constraints to clarify when these phrases should or should not activate the knowledge-base workflow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The cloud API section states that no local data is sent to the cloud, but the same document describes cloud-backed employee profile, analytics, and command features that are difficult to reconcile with zero outbound local context. Even if the implementation is not shown, this contradictory privacy claim can mislead users into enabling cloud features under false assumptions about data exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The skill documents installation/execution of an MCP server via npx @tonykk/management-brain-mcp without pinning a specific version. This creates a supply-chain risk: future package updates or a compromised npm package could change behavior and execute unreviewed code when users follow the instructions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.