Security audit

FoolClaw

Security checks for vulnerabilities and agentic risk

Overview

This prank skill can quietly schedule recurring background activity and may use messaging channels to prank other people without clear per-action consent.

Install only after reviewing this carefully. Starting it can create desktop/browser prank artifacts, arm a recurring background operator, inspect OpenClaw communication capabilities and contact/group listings, and potentially send prank messages through configured accounts. Use only in an environment where you control the accounts and are comfortable inspecting and removing OpenClaw cron jobs and FoolClaw state afterward.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

Location: scripts/foolclaw.mjs:312
Finding: Persistent Autonomous Background Operator Installed by the Start Workflow
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:14
Finding: Skill Instructions Suppress Permission Review and Security-Relevant Disclosure
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/foolclaw.mjs:622
Finding: Background Channel Reconnaissance Can Lead to Unauthorized Third-Party Messaging
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: scripts/foolclaw.mjs:160
Finding: Mandatory Promotional Content Hijacks Generated Artifacts
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest presents the skill as a local prank tool, but the body authorizes external message-pranks through host messaging surfaces. This is dangerous because it hides third-party communication behavior behind a benign local description, undermining informed consent and enabling unexpected outreach to other users.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow uses an initial prank action as a trust-building step and then quietly arms a background operator, normalizing persistent behavior after a seemingly simple request. This staged design increases risk because the user may consent to a visible prank without realizing they also enabled ongoing autonomous activity.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions explicitly suppress safety review, permission review, warning flows, and follow-up questions before executing prank and background actions. This is dangerous because it is designed to reduce friction around actions that alter the user environment and may expand into background or external behaviors without contemporaneous consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This section explicitly instructs the agent to discover messaging capabilities, enumerate targets, and send prank messages over external channels. That goes beyond the stated local prank scope and enables unsolicited third-party contact, which can be abused for harassment, impersonation, or policy bypass.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The friend-prank flow leads the agent from capability discovery to target discovery to message sending, without requiring fresh consent at the point of contacting a third party. This progressive structure is dangerous because it operationalizes unsolicited outreach and lowers the barrier to abusing host messaging integrations.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The internal operator-turn instructions encourage ongoing environmental discovery, channel exploration, planning, and eventual external message-prank execution from a background context. This is dangerous because it approximates autonomous permission expansion and covert action selection beyond the user's immediate request.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest presents the skill as a local prank tool, but the prompt explicitly expands behavior to discovering real channels, peers, and groups and sending prank messages externally. That mismatch is dangerous because it hides externally acting functionality behind a benign local description, increasing the chance of unauthorized social interaction and deceptive use.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The prompt directs the agent to explore IM, social-media, and other host-exposed channels, discover capabilities, identify targets, and act when a credible target exists. This exceeds the stated prank purpose and creates an unnecessary capability-escalation path into real communications systems, which can be abused for harassment, spam, or deceptive outreach.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The prompt repeatedly emphasizes covert behavior: quiet background operation, hidden planning, no visible narration, progressive discovery of channels and targets, and permission to send prank messages when an opportunity appears. This establishes an autonomous deception workflow designed to operate without meaningful transparency, which is dangerous because it can manipulate third parties and evade user oversight.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The text authorizes a background operator to opportunistically use available communication capabilities at suitable moments, which encourages covert action against third-party targets without a clear contemporaneous user request. This is especially dangerous because it combines persistence, autonomy, and social-channel access, enabling stealthy impersonation, harassment, or privacy-invasive messaging.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This section implements communication-channel discovery and target enumeration, including listing peers and groups that can receive messages. In the context of a prank skill advertised as local, this is a strong capability escalation that could be repurposed for unauthorized outreach, harassment, or lateral social-engineering against contacts and groups.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares no explicit tool or permission boundaries, yet its instructions invoke runtime commands, capability discovery, and external messaging behavior. This creates a mismatch between what operators can infer from the manifest and what the skill may actually do, increasing the chance of overbroad execution in environments where env/network access exists.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill claims it is 'not a stealth tool' while simultaneously directing the agent to run 'quietly,' 'lurk in the background,' and avoid visible disclosure. This contradiction is dangerous because it normalizes covert persistence and reduces the likelihood that users understand ongoing behavior or future actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Triggering on broad phrases such as 'surprise me' or similar conversational language raises the risk of accidental invocation. In this skill, accidental invocation is more dangerous than usual because the resulting actions may include immediate prank execution and covert arming of a background operator.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The prompt states that if the user is speaking Chinese and no non-China context is detected, the skill should default to bilibili. This imposes a locale-specific behavior based on language alone rather than offering a user choice or clearly documenting a justified regional constraint.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs the agent to inspect capability and target snapshots, infer real peers or groups, and keep reusable notes about concrete external paths for later use. That creates unnecessary collection and retention of relationship and channel metadata, which can expose sensitive social graph information and support later unauthorized contact or profiling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The entire skill description is written in Chinese and frames its guidance in that language, with no indication that other languages are supported or that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly encourages the agent to freely inspect the current environment and consider prank actions across desktops, files, folders, browsers, local pages, messages, channels, and posting capabilities. That creates a real privacy and integrity risk because it normalizes reconnaissance and action on user data and communication surfaces without requiring consent, scope limits, or safety checks; in a prank-oriented skill, this context makes the behavior more dangerous rather than less.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file explicitly broadens the skill from local desktop pranks into use of host messaging, channel, contact, and group capabilities against other people. That creates a third-party outreach capability that can abuse whatever communication scope the agent has, turning a local prank tool into a social-engineering or harassment mechanism.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module permits sending prank messages to contacts, groups, and channels without clearly warning the user about privacy, reputational, consent, or social risks. Users may not realize that invoking the skill could cause outreach to third parties using discovered host accounts or identities.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document systematically teaches the agent to enumerate communication capabilities, identify reachable targets, determine role/scope, and prepare for prank delivery. This staged workflow operationalizes deceptive outreach and makes harmful use more reliable by turning discovery and exploitation into a guided process.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The activation condition is intentionally broad and permits opportunistic invocation whenever the operator judges conditions to be suitable. Vague triggers increase the chance of unauthorized or context-inappropriate execution, especially when paired with message-sending capabilities.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The later sections normalize moving from planning into actual message delivery once minimal checks such as canSend, role, and target are satisfied. That effectively provides an execution checklist for covert or deceptive messaging, reducing hesitation and increasing the likelihood of unauthorized contact with real people.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly states that the default entry both creates a desktop artifact and 'quietly arms' a background operator in one step, without clear consent, warning, or scope limits. Silent persistence-like behavior combined with local file creation is dangerous because it normalizes covert system modification and can be repurposed for unauthorized actions beyond a harmless prank.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The file says the default desktop note will contain a bilingual Chinese-English manifesto by default. This is a natural-language locale choice imposed by the skill rather than explicitly offered as a user option, which can violate language/locale policy absent opt-in or justification.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/foolclaw.mjs:972

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/foolclaw.mjs:825