Agent优化专家

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 1.4.0

Overview

This skill is a real diagnostics helper, but it also sets up recurring self-repair and self-update behavior that can modify local agent files and run disruptive maintenance commands.

Install only if you want an operations skill that can inspect agent/system state and you are prepared to keep cron or heartbeat setup manual. Do not allow its recurring jobs, self-evolution updates, memory cleanup, Docker pruning, service restarts, or sub-agent termination to run without reviewing the exact commands and approving each change.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: references/dual-env-adaptation.md:40
• Finding: Recurring Autonomous Tasks Create Cross-Session Persistence<![CDATA[ ## Vulnerability Details **File Location**: `references/dual-env-adaptation.md:40-55`; related instructions at `SKILL.md:101-105` **Vulnerability Type**: Scheduled-task and heartbeat persistence **Risk Level**: High ### Vulnerable Code Snippet ```text ### Hermes 环境：Cron Job # 每日自检 cronjob(action='create', name='🔧 Agent 每日自检', schedule='0 8 * * *', prompt='执行 agent-optimization-expert 场景 3（系统健康度巡检）和场景 1（Cron 任务扫描）。检查磁盘/内存/容器/本地服务/所有 cron jobs。如有异常按诊断决策树修复并记录到 learnings/error-log.md。无异常只记录"一切正常"。', deliver='local') # 每周知识更新 cronjob(action='create', name='📚 Agent 知识更新', schedule='0 3 * * 0', prompt='执行 agent-optimization-expert 路径 2（定期知识更新）：搜索 Anthropic/OpenAI 最新 Agent 工程实践，对比 references/ 现有内容，发现新模式追加到对应文件。', deliver='local') ``` Related top-level instructions: ```text - Hermes environment → use `cronjob(action='create')` to create daily self-check and weekly knowledge-update tasks - OpenClaw environment → configure a heartbeat checklist in `workspace/HEARTBEAT.md` ``` ### Technical Analysis The Skill is presented as a diagnostic and repair utility, but its integration instructions expand execution beyond the current request by creating recurring Cron jobs or modifying a persistent heartbeat configuration. These mechanisms survive the initiating session and repeatedly grant the Skill access to system state, Cron configuration, containers, local services, logs, and writable knowledge files. Scheduled diagnostics can be legitimate when explicitly requested. However, automatic or setup-driven installation exceeds the minimum privilege necessary for an on-demand diagnostic Skill. The documentation does not require informed, task-specific approval immediately before creating each persistent task, does not define an expiration time, and does not provide removal commands. The weekly task is especially sensitive because it combines persistence, network-derived information, and mutation of trusted Skill files. ### Att ...[truncated 1301 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove recurring task creation from default installation and first-run behavior. 2. Require explicit, informed user approval immediately before each Cron or heartbeat change. 3. Present the exact schedule, command, prompt, writable paths, and expected permissions before approval. 4. Separate one-time diagnostics from optional monitoring installation. 5. Add expiration dates or bounded run counts to recurring tasks. 6. Provide exact commands for listing, disabling, and deleting every installed task. 7. Restrict scheduled diagnostics to read-only operations by default. 8. Require fresh approval before any scheduled task modifies configuration, restarts services, deletes files, or updates Skill content. 9. Record task creation, modification, execution, and removal in an auditable log. 10. Do not treat the presence of Hermes or OpenClaw as authorization to install persistence. ]]>

T02 · Agent Memory Poisoning

Error

• Location: references/self-evolution.md:13
• Finding: Untrusted Web Search Results Can Poison Persistent Skill References<![CDATA[ ## Vulnerability Details **File Location**: `references/self-evolution.md:13-44`; related workflow at `SKILL.md:188-213` **Vulnerability Type**: Persistent instruction poisoning through web-derived content **Risk Level**: High ### Vulnerable Code Snippet ```bash # Anthropic latest practices curl -s "http://localhost:3004/search?q=anthropic+claude+agent+engineering+tool+use+patterns+best+practices&format=json&engines=bing,duckduckgo" | python3 -c " import json, sys data = json.load(sys.stdin) for r in data.get('results', [])[:5]: print(f'- [{r.get(\"title\",\"\")}]({r.get(\"url\",\"\")})') " 2>/dev/null # OpenAI latest practices curl -s "http://localhost:3004/search?q=openai+agent+patterns+function+calling+structured+outputs+error+recovery&format=json&engines=bing,duckduckgo" | python3 -c " import json, sys data = json.load(sys.stdin) for r in data.get('results', [])[:5]: print(f'- [{r.get(\"title\",\"\")}]({r.get(\"url\",\"\")})') " 2>/dev/null # Industry Agent architecture trends curl -s "http://localhost:3004/search?q=llm+agent+architecture+patterns+self+healing+error+recovery+2026&format=json&engines=bing,duckduckgo" | python3 -c " import json, sys data = json.load(sys.stdin) for r in data.get('results', [])[:3]: print(f'- [{r.get(\"title\",\"\")}]({r.get(\"url\",\"\")})') " 2>/dev/null ``` The subsequent workflow instructs the Agent to compare the retrieved information against these files and append new entries or templates: ```text anthropic-patterns.md — append new Thinking or Tool Use patterns openai-patterns.md — append new Agent patterns error-taxonomy.md — add new error categories fix-templates.md — add new repair templates ``` ### Technical Analysis The flagged pipelines are not `curl | bash` execution. They retrieve JSON from a localhost SearXNG service and pass it to fixed Python parsing code. The parser only prints result titles and URLs, so the commands do not directly execute downloaded shell code. The security is ...[truncated 2352 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable autonomous writes to Skill references and repair templates. 2. Treat search results and fetched pages as untrusted data, never as executable instructions. 3. Restrict research to an allowlist of authenticated, official vendor domains. 4. Fetch and validate canonical URLs rather than trusting search-result titles or snippets. 5. Detect and reject embedded instructions, shell commands, encoded payloads, and requests to alter Agent policy. 6. Require a human-reviewed diff before modifying any persistent Skill file. 7. Require explicit approval for every proposed command added to `fix-templates.md`. 8. Store proposed updates in a quarantine or staging file rather than directly modifying active references. 9. Validate proposed commands against an allowlist and block destructive flags, remote execution, privilege changes, and credential access. 10. Add cryptographic hashes or signed releases for approved reference versions. 11. Preserve retrieval errors and validation failures in logs instead of suppressing all stderr. 12. Ensure recurring jobs can research and report recommendations but cannot write active instructions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/fix-templates.md:102
• Finding: Cleanup Template Can Irreversibly Delete Agent Memory and Docker Resources<![CDATA[ ## Vulnerability Details **File Location**: `references/fix-templates.md:102-118` **Vulnerability Type**: Unsafe destructive maintenance commands **Risk Level**: High ### Vulnerable Code Snippet ```bash # Diagnosis df -h / du -sh ~/.openclaw/workspace/memory/ 2>/dev/null du -sh ~/.openclaw/workspace/learnings/ 2>/dev/null ``` ```bash # Delete Markdown files older than 30 days find ~/.openclaw/workspace/memory/ -name "*.md" -mtime +30 -delete 2>/dev/null # Remove unused Docker resources docker system prune -f 2>/dev/null ``` ### Technical Analysis The first repair command recursively deletes every matching Markdown file older than 30 days under the Agent memory directory. The path is not a dedicated disposable log directory, and no validation establishes that matching files are temporary or recoverable. The command uses `-delete`, making deletion immediate, while `2>/dev/null` suppresses errors that could reveal unexpected path, permission, or traversal conditions. The second command performs a forced Docker system prune. Depending on Docker state and version, this can remove stopped containers, unused networks, dangling or unused images, and build cache. The `-f` option bypasses interactive confirmation, and stderr suppression obscures failures. These commands conflict with the Skill's stated safeguards. `SKILL.md` classifies deletion and core changes as high-risk actions requiring explicit authorization, while the error taxonomy also prohibits automatic irreversible deletion. Elsewhere, however, temporary-file cleanup is categorized as automatically executable. Because this template is labeled as disk cleanup without an inline confirmation gate, an Agent may incorrectly treat it as low-risk maintenance. ### Attack Path 1. Disk usage is reported as high, or an attacker induces disk pressure. 2. The Agent selects the disk-cleanup repair template. 3. The generic “temporary file cleanup” permission is interpreted as authorization to run the co ...[truncated 1377 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace deletion with a dry-run command that lists exact candidate files, sizes, owners, and modification times. 2. Require explicit user approval after presenting the candidate list and estimated reclaimed space. 3. Back up or archive persistent memory before deleting any file. 4. Restrict cleanup to a dedicated disposable log or cache directory. 5. Use an application-managed retention policy instead of recursive filename-based deletion. 6. Remove `-delete`, `-f`, and blanket stderr suppression from default repair templates. 7. Validate the resolved cleanup path and reject symlinks or paths outside an approved root. 8. Use `find` with explicit file-type and path constraints, and move candidates to quarantine before final deletion. 9. Replace `docker system prune -f` with inspection commands such as `docker system df` and named-resource cleanup. 10. Display exactly which Docker objects will be affected and require separate approval. 11. Create rollback or restoration instructions before any destructive operation. 12. Reclassify all memory deletion and Docker pruning as high-risk operations requiring explicit authorization. 13. Log the approved command, affected resources, user authorization, execution result, and recovery information. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

External Script Fetching

High

• Category: Supply Chain

Content

4. 标记已过时实践（不删除，标「⚠️ 已废弃」）

```bash
curl -s "http://localhost:3004/search?q=anthropic+agent+engineering+best+practices+$(date +%Y)&format=json&engines=bing,duckduckgo" | python3 -c "
import json, sys
data = json.load(sys.stdin)
for r in data.get('results', [])[:5]:

• Confidence: 93% confidence
• Finding: The skill performs a network search, parses untrusted results, and proposes incorporating new external guidance into local reference material as part of self-evolution. Even though the shown pipeline does not directly execute remote code, it creates an external-content ingestion path that can poison future behavior, especially because the skill is framed to update its own operational knowledge.

Self-Modification

High

• Category: Rogue Agent

Content

## 触发方式

### Cron 自动触发
- 每周日 03:00 执行一次（cron 任务：agent-optimizer-self-update）
- 执行环境：isolated session, agentTurn

### 手动触发

• Confidence: 97% confidence
• Finding: The skill explicitly defines a self-update cron workflow that modifies its own supporting knowledge and version records over time. Self-modification is dangerous because it enables persistence of bad guidance, gradual policy drift, and incorporation of untrusted content without a strong review boundary, especially when triggered automatically.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Anthropic 最新实践
curl -s "http://localhost:3004/search?q=anthropic+claude+agent+engineering+tool+use+patterns+best+practices&format=json&engines=bing,duckduckgo" | python3 -c "
import json, sys
data = json.load(sys.stdin)
for r in data.get('results', [])[:5]:

• Confidence: 95% confidence
• Finding: This step fetches external search data and pipes it directly into a Python parser in an automated update workflow. Even though the Python snippet is static, the larger risk is that untrusted network content is being ingested and used to drive persistent documentation updates, creating a content-poisoning and supply-chain attack surface.

External Script Fetching

High

• Category: Supply Chain

Content

" 2>/dev/null

# OpenAI 最新实践
curl -s "http://localhost:3004/search?q=openai+agent+patterns+function+calling+structured+outputs+error+recovery&format=json&engines=bing,duckduckgo" | python3 -c "
import json, sys
data = json.load(sys.stdin)
for r in data.get('results', [])[:5]:

• Confidence: 95% confidence
• Finding: This command repeats the same unsafe pattern: external network retrieval feeding an automated parser that informs file updates. In the context of a self-evolving agent, poisoned or manipulated search results can silently alter future behavior and recommendations, making the risk more severe than a one-off manual lookup.

External Script Fetching

High

• Category: Supply Chain

Content

" 2>/dev/null

# 行业 Agent 架构趋势
curl -s "http://localhost:3004/search?q=llm+agent+architecture+patterns+self+healing+error+recovery+2026&format=json&engines=bing,duckduckgo" | python3 -c "
import json, sys
data = json.load(sys.stdin)
for r in data.get('results', [])[:3]:

• Confidence: 95% confidence
• Finding: This retrieval of general industry architecture trends introduces the same untrusted external content path into an automated self-update process. Because the results affect long-term reference material, an attacker who can influence search outputs or the local search service could steer the agent's evolution toward harmful or degraded practices.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The manifest description and invocation guidance are primarily written in Chinese with embedded English terms, which imposes a specific language expectation for activation and use. There is no indication that the skill supports alternate languages or lets the user opt in to Chinese, so this can violate language/locale policy requirements.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The invocation phrases are broad and loosely bounded, increasing the chance that the skill activates for generic requests about optimization, inspection, or repair. In this skill's context, unintended activation is more dangerous because the skill is authorized to inspect the system, alter cron/configuration, and create logs.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The documented 'do not auto-execute' safety posture conflicts with other sections that instruct automatic cron creation for self-checks and knowledge updates. Contradictory safety rules are dangerous because operators may believe the skill is passive while it actually establishes persistence or scheduled behavior.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill includes a periodic self-evolution workflow that performs external searches and updates internal reference material, which exceeds the narrowly scoped purpose of troubleshooting local agent execution issues. This expands the trust boundary from local diagnostics to ingesting unvetted external content, creating supply-chain and prompt-injection risk if search results or fetched guidance influence future behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The first-run protocol authorizes automatic system inspection and creation of learnings/error-log.md without a prominent consent warning. Silent inspection and file writes are risky because they normalize autonomous state changes and can surprise users in sensitive environments.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

### 自动触发
当检测到上述问题时，小七应：
1. 读取 `skills/agent-optimizer/SKILL.md`
2. 按照诊断工作流执行
3. 输出修复建议
4. 用户确认后执行修复

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The manual trigger phrases are generic operational requests such as '检查一下系统问题' and '优化一下配置', which can easily overlap with ordinary user intent and cause this powerful diagnostic skill to activate unexpectedly. In context, the skill is designed to inspect logs, retry operations, clean temporary files, and propose repairs, so overly broad activation increases the chance of unnecessary privilege use or unintended workflow changes.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The file title and all instructional content are presented only in Chinese, with no indication that language choice is optional or that the skill is region-specific. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: These instructions create recurring cron jobs that automatically run diagnostics, perform repairs, and write to local files such as learnings/error-log.md without clear user warning or consent. Autonomous scheduled modification is dangerous because it can repeatedly change workspace state, mask failures through self-modifying behavior, or create noisy/unreviewed edits that are hard to audit.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The weekly knowledge-update workflow expands the skill from diagnostics/self-healing into autonomous external research and local content modification. That broadens the trust boundary: a maintenance skill can start ingesting untrusted external information and persist changes into references/ without explicit approval, creating a supply-chain style risk and increasing the chance of prompt/data poisoning or unintended repository changes.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The HEARTBEAT.md guidance sets up periodic self-checks that can automatically load this skill and perform diagnostic repair actions when anomalies are detected, again without warning that workspace or system state may be changed. In context, this is more dangerous because the skill is framed as self-healing and cross-environment compatible, so the automation can trigger repeatedly across agent platforms and perform unreviewed remediation steps.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file's operational instructions and templates are entirely in Chinese, which effectively forces a specific language for users consuming the skill content. There is no indication that this language choice is optional, user-selected, or justified as a region-specific constraint.

External Transmission

Medium

• Category: Data Exfiltration

Content

docker ps --filter "status=exited"

# 检查端口
curl -s http://localhost:3002/health  # Firecrawl
curl -s http://localhost:3004/health  # SearXNG
curl -s http://localhost:3003/health  # Crawl4AI
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The template includes destructive cleanup commands such as deleting files older than 30 days and pruning Docker resources without requiring confirmation, scoping checks, backup guidance, or warning about irreversible data loss. In an automation or agent-operated context, this can cause unintended deletion of logs, memory artifacts, or container resources that may still be needed for recovery or forensic analysis.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Commands to kill sub-agents and restart the gateway can terminate in-flight work, discard unsaved state, and disrupt other sessions, yet the template omits warnings about interruption risk. Because this skill is explicitly designed for automated diagnosis and self-repair, these instructions are more dangerous than ordinary documentation: they may be operationalized by an agent without human review.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document promotes automated repair/self-healing behavior and strategy testing without explicitly requiring safety checks, user confirmation, rollback validation, or warnings about possible system and data impact. In the context of an agent-optimization skill that diagnoses and repairs cron, workflows, and system issues, this can normalize unsafe autonomous changes and increase the chance of destructive or destabilizing actions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow performs automated external data retrieval and then uses the results to update local documentation files, yet it provides no explicit warning, approval gate, or trust boundary for those actions. This creates a supply-chain style risk where untrusted search results can influence persistent project content during unattended cron execution.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: The claim that the skill 'will not run by itself' is undermined by the later first-load protocol that performs an automatic self-check and writes a log file. While lower impact than cron persistence, this still causes unprompted system inspection and filesystem modification, which can violate least surprise and user consent.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy violations. The title and all instructional content in this markdown file are exclusively in Chinese, with no indication that users may choose another language or that the locale restriction is required for a region-specific purpose.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: Service restart/stop instructions are provided as direct fixes without warning that they can interrupt active workloads, break dependent automations, or create temporary downtime. In a self-healing or optimization skill, an agent may apply them automatically, magnifying operational impact beyond a human-administered troubleshooting step.

Static analysis

No suspicious patterns detected.