Dida Agent Optimizer

• Outcome: Review
• Latest audit: May 28, 2026 · 7:38 AM UTC
• Version: 1.1.0

Overview

This is a real OpenClaw troubleshooting skill, but it gives an agent broad repair authority and includes ongoing self-update and cleanup workflows that need review before use.

Install only if you want an OpenClaw operational repair assistant. Before enabling it, disable or manually approve weekly self-updates, review every proposed reference or SKILL.md change, and require explicit confirmation before deletion, Docker prune, service restart, cron update, or sub-agent kill actions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill's self-evolution workflow expands from local diagnosis/remediation into recurring external retrieval of web content, which materially broadens the trust boundary and attack surface. Even though the examples target engineering best practices, importing and acting on externally sourced guidance can lead to prompt/data poisoning, unsafe updates to local references, and indirect self-modification without adequate review.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The skill claims external messaging must not be sent, yet later prescribes outbound network requests for self-update. This inconsistency can cause operators or downstream agents to believe network egress is prohibited while the workflow still performs it, undermining policy enforcement and making unauthorized data flows more likely.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The manual trigger phrases are broad enough to match ordinary troubleshooting requests, which can cause the optimizer skill to activate in situations the user did not specifically intend. In this skill's context, that matters because the skill is designed to diagnose and propose repairs for system and workflow issues, so accidental invocation increases the chance of unnecessary log access, configuration-oriented actions, or disruptive remediation suggestions.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The automatic trigger condition for 'performance degradation' is underspecified, with no concrete thresholds, baseline, or time window. In an auto-triggered self-healing skill, ambiguous criteria can lead to frequent false positives or attacker-induced triggering, causing unnecessary diagnostics, churn, and possible pressure toward unsafe remediation actions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The template includes destructive cleanup commands that delete files and prune Docker resources without any safety checks, confirmation prompts, scope limitation, or warning about irreversible data loss and operational side effects. In a self-healing/optimizer skill, an agent may apply these commands automatically during troubleshooting, making accidental deletion of logs, memory artifacts, or container resources more likely.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The template recommends restarting or stopping services without warning about downtime, in-flight task interruption, or dependency impact. In an automated repair context, this can cause avoidable service disruption or mask root causes by repeatedly bouncing components.

Self-Modification

High

• Category: Rogue Agent

Content

## 触发方式

### Cron 自动触发
- 每周日 03:00 执行一次（cron 任务：agent-optimizer-self-update）
- 执行环境：isolated session, agentTurn

### 手动触发

• Confidence: 96% confidence
• Finding: This workflow explicitly schedules autonomous self-update behavior for the agent's own reference and skill files. Self-modification is dangerous because it creates a persistence mechanism by which untrusted or low-quality external information can alter future agent behavior without strong human review, enabling prompt drift, policy erosion, or supply-chain-style compromise over time.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Anthropic 最新实践
curl -s "http://localhost:3004/search?q=anthropic+claude+agent+engineering+tool+use+patterns+best+practices&format=json&engines=bing,duckduckgo" | python3 -c "
import json, sys
data = json.load(sys.stdin)
for r in data.get('results', [])[:5]:

• Confidence: 97% confidence
• Finding: The workflow fetches externally sourced search results and immediately pipes them into a Python parser as part of an automated update pipeline. Even though the inline Python is static, this still ingests untrusted network data into a self-modifying process, creating a high-risk trust boundary where manipulated results, malicious URLs, or poisoned content can influence future repository changes and agent behavior.

External Script Fetching

High

• Category: Supply Chain

Content

" 2>/dev/null

# OpenAI 最新实践
curl -s "http://localhost:3004/search?q=openai+agent+patterns+function+calling+structured+outputs+error+recovery&format=json&engines=bing,duckduckgo" | python3 -c "
import json, sys
data = json.load(sys.stdin)
for r in data.get('results', [])[:5]:

• Confidence: 97% confidence
• Finding: This external fetch performs the same unsafe pattern against search results for OpenAI-related practices, feeding untrusted internet-derived content into an automated maintenance workflow. In context, the danger is amplified because the fetched information is intended to update internal guidance files, so poisoned or low-integrity content can become durable agent instructions.

External Script Fetching

High

• Category: Supply Chain

Content

" 2>/dev/null

# 行业 Agent 架构趋势
curl -s "http://localhost:3004/search?q=llm+agent+architecture+patterns+self+healing+error+recovery+2026&format=json&engines=bing,duckduckgo" | python3 -c "
import json, sys
data = json.load(sys.stdin)
for r in data.get('results', [])[:3]:

• Confidence: 97% confidence
• Finding: This instance repeats the same pattern for general industry architecture trends, broadening the attack surface to even less constrained search content. Because the skill is expressly designed for ongoing self-evolution, ingesting trend-search output into a process that edits persistent reference material increases the risk of prompt injection by proxy, misinformation, and long-term behavioral corruption.

Static analysis

No suspicious patterns detected.