T06 · System Persistence
Error
- Location
references/dual-env-adaptation.md:40- Finding
Recurring Autonomous Tasks Create Cross-Session Persistence
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent优化专家
Security checks for vulnerabilities and agentic risk
Overview
This skill is a real diagnostics helper, but it also sets up recurring self-repair and self-update behavior that can modify local agent files and run disruptive maintenance commands.
Install only if you want an operations skill that can inspect agent/system state and you are prepared to keep cron or heartbeat setup manual. Do not allow its recurring jobs, self-evolution updates, memory cleanup, Docker pruning, service restarts, or sub-agent termination to run without reviewing the exact commands and approving each change.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
references/self-evolution.md:13- Finding
Untrusted Web Search Results Can Poison Persistent Skill References
- Content
View full analysis
/dev/null # OpenAI latest practices curl -s "http://localhost:3004/search?q=openai+agent+patterns+function+calling+structured+outputs+error+recovery&format=json&engines=bing,duckduckgo" | python3 -c " import json, sys data = json.load(sys.stdin) for r in data.get('results', [])[:5]: print(f'- [{r.get(\"title\",\"\")}]({r.get(\"url\",\"\")})') " 2>/dev/null # Industry Agent architecture trends curl -s "http://localhost:3004/search?q=llm+agent+architecture+patterns+self+healing+error+recovery+2026&format=json&engines=bing,duckduckgo" | python3 -c " import json, sys data = json.load(sys.stdin) for r in data.get('results', [])[:3]: print(f'- [{r.get(\"title\",\"\")}]({r.get(\"url\",\"\")})') " 2>/dev/null ``` The subsequent workflow instructs the Agent to compare the retrieved information against these files and append new entries or templates: ```text anthropic-patterns.md — append new Thinking or Tool Use patterns openai-patterns.md — append new Agent patterns error-taxonomy.md — add new error categories fix-templates.md — add new repair templates ``` ### Technical Analysis The flagged pipelines are not `curl | bash` execution. They retrieve JSON from a localhost SearXNG service and pass it to fixed Python parsing code. The parser only prints result titles and URLs, so the commands do not directly execute downloaded shell code. The security is ...[truncated 2352 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/fix-templates.md:102- Finding
Cleanup Template Can Irreversibly Delete Agent Memory and Docker Resources
- Content
View full analysis
/dev/null du -sh ~/.openclaw/workspace/learnings/ 2>/dev/null ``` ```bash # Delete Markdown files older than 30 days find ~/.openclaw/workspace/memory/ -name "*.md" -mtime +30 -delete 2>/dev/null # Remove unused Docker resources docker system prune -f 2>/dev/null ``` ### Technical Analysis The first repair command recursively deletes every matching Markdown file older than 30 days under the Agent memory directory. The path is not a dedicated disposable log directory, and no validation establishes that matching files are temporary or recoverable. The command uses `-delete`, making deletion immediate, while `2>/dev/null` suppresses errors that could reveal unexpected path, permission, or traversal conditions. The second command performs a forced Docker system prune. Depending on Docker state and version, this can remove stopped containers, unused networks, dangling or unused images, and build cache. The `-f` option bypasses interactive confirmation, and stderr suppression obscures failures. These commands conflict with the Skill's stated safeguards. `SKILL.md` classifies deletion and core changes as high-risk actions requiring explicit authorization, while the error taxonomy also prohibits automatic irreversible deletion. Elsewhere, however, temporary-file cleanup is categorized as automatically executable. Because this template is labeled as disk cleanup without an inline confirmation gate, an Agent may incorrectly treat it as low-risk maintenance. ### Attack Path 1. Disk usage is reported as high, or an attacker induces disk pressure. 2. The Agent selects the disk-cleanup repair template. 3. The generic “temporary file cleanup” permission is interpreted as authorization to run the co ...[truncated 1377 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (27)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The skill performs a network search, parses untrusted results, and proposes incorporating new external guidance into local reference material as part of self-evolution. Even though the shown pipeline does not directly execute remote code, it creates an external-content ingestion path that can poison future behavior, especially because the skill is framed to update its own operational knowledge.
- Content
- 标记已过时实践（不删除，标「⚠️ 已废弃」）
bash curl -s "http://localhost:3004/search?q=anthropic+agent+engineering+best+practices+$(date +%Y)&format=json&engines=bing,duckduckgo" | python3 -c " import json, sys data = json.load(sys.stdin) for r in data.get('results', [])[:5]:
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
The skill explicitly defines a self-update cron workflow that modifies its own supporting knowledge and version records over time. Self-modification is dangerous because it enables persistence of bad guidance, gradual policy drift, and incorporation of untrusted content without a strong review boundary, especially when triggered automatically.
- Content
md ## 触发方式 ### Cron 自动触发 - 每周日 03:00 执行一次（cron 任务：agent-optimizer-self-update） - 执行环境：isolated session, agentTurn ### 手动触发
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
This step fetches external search data and pipes it directly into a Python parser in an automated update workflow. Even though the Python snippet is static, the larger risk is that untrusted network content is being ingested and used to drive persistent documentation updates, creating a content-poisoning and supply-chain attack surface.
- Content
bash # Anthropic 最新实践 curl -s "http://localhost:3004/search?q=anthropic+claude+agent+engineering+tool+use+patterns+best+practices&format=json&engines=bing,duckduckgo" | python3 -c " import json, sys data = json.load(sys.stdin) for r in data.get('results', [])[:5]:
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
This command repeats the same unsafe pattern: external network retrieval feeding an automated parser that informs file updates. In the context of a self-evolving agent, poisoned or manipulated search results can silently alter future behavior and recommendations, making the risk more severe than a one-off manual lookup.
- Content
md " 2>/dev/null # OpenAI 最新实践 curl -s "http://localhost:3004/search?q=openai+agent+patterns+function+calling+structured+outputs+error+recovery&format=json&engines=bing,duckduckgo" | python3 -c " import json, sys data = json.load(sys.stdin) for r in data.get('results', [])[:5]:
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
This retrieval of general industry architecture trends introduces the same untrusted external content path into an automated self-update process. Because the results affect long-term reference material, an attacker who can influence search outputs or the local search service could steer the agent's evolution toward harmful or degraded practices.
- Content
md " 2>/dev/null # 行业 Agent 架构趋势 curl -s "http://localhost:3004/search?q=llm+agent+architecture+patterns+self+healing+error+recovery+2026&format=json&engines=bing,duckduckgo" | python3 -c " import json, sys data = json.load(sys.stdin) for r in data.get('results', [])[:3]:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description and invocation guidance are primarily written in Chinese with embedded English terms, which imposes a specific language expectation for activation and use. There is no indication that the skill supports alternate languages or lets the user opt in to Chinese, so this can violate language/locale policy requirements.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The invocation phrases are broad and loosely bounded, increasing the chance that the skill activates for generic requests about optimization, inspection, or repair. In this skill's context, unintended activation is more dangerous because the skill is authorized to inspect the system, alter cron/configuration, and create logs.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documented 'do not auto-execute' safety posture conflicts with other sections that instruct automatic cron creation for self-checks and knowledge updates. Contradictory safety rules are dangerous because operators may believe the skill is passive while it actually establishes persistence or scheduled behavior.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill includes a periodic self-evolution workflow that performs external searches and updates internal reference material, which exceeds the narrowly scoped purpose of troubleshooting local agent execution issues. This expands the trust boundary from local diagnostics to ingesting unvetted external content, creating supply-chain and prompt-injection risk if search results or fetched guidance influence future behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The first-run protocol authorizes automatic system inspection and creation of learnings/error-log.md without a prominent consent warning. Silent inspection and file writes are risky because they normalize autonomous state changes and can surprise users in sensitive environments.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md ### 自动触发 当检测到上述问题时，小七应： 1. 读取 `skills/agent-optimizer/SKILL.md` 2. 按照诊断工作流执行 3. 输出修复建议 4. 用户确认后执行修复
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manual trigger phrases are generic operational requests such as '检查一下系统问题' and '优化一下配置', which can easily overlap with ordinary user intent and cause this powerful diagnostic skill to activate unexpectedly. In context, the skill is designed to inspect logs, retry operations, clean temporary files, and propose repairs, so overly broad activation increases the chance of unnecessary privilege use or unintended workflow changes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file title and all instructional content are presented only in Chinese, with no indication that language choice is optional or that the skill is region-specific. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
These instructions create recurring cron jobs that automatically run diagnostics, perform repairs, and write to local files such as learnings/error-log.md without clear user warning or consent. Autonomous scheduled modification is dangerous because it can repeatedly change workspace state, mask failures through self-modifying behavior, or create noisy/unreviewed edits that are hard to audit.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The weekly knowledge-update workflow expands the skill from diagnostics/self-healing into autonomous external research and local content modification. That broadens the trust boundary: a maintenance skill can start ingesting untrusted external information and persist changes into references/ without explicit approval, creating a supply-chain style risk and increasing the chance of prompt/data poisoning or unintended repository changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The HEARTBEAT.md guidance sets up periodic self-checks that can automatically load this skill and perform diagnostic repair actions when anomalies are detected, again without warning that workspace or system state may be changed. In context, this is more dangerous because the skill is framed as self-healing and cross-environment compatible, so the automation can trigger repeatedly across agent platforms and perform unreviewed remediation steps.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file's operational instructions and templates are entirely in Chinese, which effectively forces a specific language for users consuming the skill content. There is no indication that this language choice is optional, user-selected, or justified as a region-specific constraint.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
docker ps --filter "status=exited"
检查端口
curl -s http://localhost:3002/health # Firecrawl curl -s http://localhost:3004/health # SearXNG curl -s http://localhost:3003/health # Crawl4AI
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The template includes destructive cleanup commands such as deleting files older than 30 days and pruning Docker resources without requiring confirmation, scoping checks, backup guidance, or warning about irreversible data loss. In an automation or agent-operated context, this can cause unintended deletion of logs, memory artifacts, or container resources that may still be needed for recovery or forensic analysis.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Commands to kill sub-agents and restart the gateway can terminate in-flight work, discard unsaved state, and disrupt other sessions, yet the template omits warnings about interruption risk. Because this skill is explicitly designed for automated diagnosis and self-repair, these instructions are more dangerous than ordinary documentation: they may be operationalized by an agent without human review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The document promotes automated repair/self-healing behavior and strategy testing without explicitly requiring safety checks, user confirmation, rollback validation, or warnings about possible system and data impact. In the context of an agent-optimization skill that diagnoses and repairs cron, workflows, and system issues, this can normalize unsafe autonomous changes and increase the chance of destructive or destabilizing actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The workflow performs automated external data retrieval and then uses the results to update local documentation files, yet it provides no explicit warning, approval gate, or trust boundary for those actions. This creates a supply-chain style risk where untrusted search results can influence persistent project content during unattended cron execution.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The claim that the skill 'will not run by itself' is undermined by the later first-load protocol that performs an automatic self-check and writes a log file. While lower impact than cron persistence, this still causes unprompted system inspection and filesystem modification, which can violate least surprise and user consent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. The title and all instructional content in this markdown file are exclusively in Chinese, with no indication that users may choose another language or that the locale restriction is required for a region-specific purpose.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Service restart/stop instructions are provided as direct fixes without warning that they can interrupt active workloads, break dependent automations, or create temporary downtime. In a self-healing or optimization skill, an agent may apply them automatically, magnifying operational impact beyond a human-administered troubleshooting step.
- Content