Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:07 AM UTC
• Version: 3.2.0

Overview

The skill mostly matches its advertised agent-configuration purpose, but it installs persistent behavior and scheduled automation with insufficient confirmation, rollback, and safety controls.

Review this skill carefully before installing. Prefer the ClawHub install path over the README's remote shell command, back up `~/.openclaw/workspace` and your crontab first, and only enable the weekly audit if you intentionally want recurring automation. After installation, inspect or edit the auto-loaded `AGENTS.md`, `SOUL.md`, `USER.md`, and `MEMORY.md` so memory writes require explicit confirmation and unwanted behavioral triggers are removed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:9

Finding

Unverified Remote Script Is Piped Directly into Bash

Content

View full analysis

Remediation

View remediation

install.sh" | sha256sum --check - ``` 5. Sign releases and verify the signature using a documented trusted public key. 6. Instruct the user to inspect the downloaded script before explicitly running `bash install.sh`. 7. Ensure the documented version matches the package version and avoid mutable branch references. ]]>

T06 · System Persistence

Error

• Location: scripts/install.sh:53

Finding

Installer Silently Creates a Persistent Weekly Cron Job

Content

View full analysis

/dev/null | grep -q "检查token优化"; then (crontab -l 2>/dev/null; echo "0 3 * * 1 cd ${WORKSPACE} && echo '检查token优化' >> ${WORKSPACE}/.audit-trigger 2>&1") | crontab - echo " ✅ Weekly token audit configured (Mondays 03:00)" echo " Cron: 0 3 * * 1 (每周一凌晨3点)" else echo " ⏭️ Token audit already configured, skipping" fi ``` Related documentation presents this as automatically configured: ```markdown **Default Schedule**: Every Monday at 03:00 (cron) 0 3 * * 1 cd ~/.openclaw/workspace && echo '检查token优化' >> ~/.openclaw/workspace/.audit-trigger ``` ### Technical Analysis The installer describes the cron feature as optional but creates it automatically without an option, command-line flag, or interactive confirmation. This changes persistent user state and survives completion of the installer and future login sessions. The declared core functionality is installation of agent configuration templates. A persistent scheduled task is not required to copy or initialize those templates. Automatic crontab modification therefore exceeds the minimum privileges and side effects necessary for the base installation. The cron command currently appends a trigger string to `.audit-trigger`; it does not itself execute the token audit. Nevertheless, it establishes a recurring persistent event inside the auto-loaded agent workspace and can continue writing indefinitely. The package also provides no uninstall procedure that removes the entry. ### Attack Path 1. A user runs `scripts/install.sh`, potentially through the documented remote execution command. 2. The installer reads the user's current crontab and installs an additional weekly entry. ...[truncated 919 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: assets/CONFIG_CHECKLIST.md:105

Finding

Documented Cron Recovery Command Replaces the Entire User Crontab

Content

View full analysis

> ~/.openclaw/workspace/.audit-trigger ``` **如果没有**，手动配置： ```bash echo "0 3 * * 1 cd ~/.openclaw/workspace && echo '检查token优化' >> ~/.openclaw/workspace/.audit-trigger 2>&1" | crontab - ``` ``` ### Technical Analysis `crontab -` replaces the user's complete crontab with the standard input it receives. The documented recovery command supplies only the MoltCare entry and does not merge it with `crontab -l`. A user following these instructions can therefore erase every existing scheduled task. Existing jobs may include backups, monitoring, certificate renewal, synchronization, security scans, or business-critical maintenance. The installer itself attempts to preserve existing entries by combining `crontab -l` with the new line. The checklist's fallback command does not, creating an inconsistent and destructive recovery path. ### Attack Path 1. The cron entry is absent or the user believes it is absent. 2. The user follows the post-installation checklist. 3. The shell sends one MoltCare cron line to `crontab -`. 4. Cron replaces the complete user crontab with that one line. 5. All pre-existing scheduled jobs stop running without being restored automatically. ### Impact Assessment This issue permits loss of all scheduled tasks belonging to the affected user. It does not grant additional privileges to an attacker, but it can cause significant availability, integrity, operational, and recovery impact. Security controls and backup jobs implemented through cron may also be disabled. ]]>

Remediation

View remediation

/dev/null || true printf '%s\n' "0 3 * * 1 cd \"$HOME/.openclaw/workspace\" && printf '%s\n' '检查token优化' >> \"$HOME/.openclaw/workspace/.audit-trigger\" 2>&1 # moltcare-token-audit" ) | crontab - ``` 3. Check for the unique marker before adding an entry. 4. Save `crontab -l` to a timestamped backup before modification. 5. Require explicit user confirmation and show a diff of the old and proposed crontab. 6. Document a removal procedure that deletes only the uniquely marked entry. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: assets/AGENTS.md:28

Finding

Auto-Loaded Templates Persistently Override General Agent Behavior

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: assets/AGENTS.md:143

Finding

Conversation Triggers Can Automatically Poison Persistent Agent Memory

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (66)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The chaining of curl output directly into bash removes any opportunity for inspection and turns remote content into immediate command execution. This is especially risky in an installation guide because users are primed to trust and run the command verbatim, so any compromise of the source or script contents results in silent arbitrary code execution.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

clawhub install moltcare-open

Or manually

curl -fsSL https://raw.githubusercontent.com/useens/moltcare-open/master/skill/scripts/install.sh | bash

text

## What You Get

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill claims to install and configure a sophisticated trigger, memory, and decision framework, but the file mostly documents copying markdown templates and adding a cron entry. This mismatch can mislead users into enabling persistence and storing data under the assumption that safety, trigger logic, and controls are actually implemented when they are not.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/SOUL.md (reported line 181)May include surrounding context.

md

## ⚠️ 安全红线

- 绝不泄露用户私人文档、凭证、个人信息
- 禁止自主执行：`rm -rf /`, `mkfs`, `dd`
- 外部操作（发邮件/发推）必须确认
- 保护敏感文件：`.env`, `*.key`, `*.pem`, `id_rsa`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/SOUL.md (reported line 181)May include surrounding context.

md

## ⚠️ 安全红线

- 绝不泄露用户私人文档、凭证、个人信息
- 禁止自主执行：`rm -rf /`, `mkfs`, `dd`
- 外部操作（发邮件/发推）必须确认
- 保护敏感文件：`.env`, `*.key`, `*.pem`, `id_rsa`

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The milestone triggers include very common conversational phrases like '完成了', '搞定了', and generic references to phase completion. In an agent framework, such broad phrases can cause unintended execution of token-audit behavior during normal conversation, creating prompt-trigger collisions, unnecessary file writes, or unexpected workflow branching without clear user intent.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Explicitly listing sensitive paths such as ~/.env and ~/.ssh in an agent-facing tools document increases the chance that an autonomous agent or downstream prompt will treat those locations as normal inspection targets. In a skill designed to configure an agent framework with file-read and exec capabilities, this context makes secret discovery and accidental credential exposure more plausible.

Content

Scanner excerpt · assets/TOOLS.md (reported line 69)May include surrounding context.

bash

# 凭证存储位置
~/.config/openclaw/credentials/
~/.env
~/.ssh/

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad everyday expressions such as 'I prefer' or 'I like,' making it likely that normal conversation will automatically update stored preferences. This creates a high risk of unintended memory writes, overcollection of user data, and manipulation by prompting the agent to persist misleading or sensitive information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README instructs users to download and immediately execute a remote shell script via a pipe to bash, with no integrity verification, code review step, pinning to a specific commit, or warning about the trust boundary. This creates a direct remote code execution path where a compromised repository, branch, account, CDN, or network path can run arbitrary commands on the user's machine.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation condition includes broad language such as applying when the user 'needs a complete Agent configuration system,' which can cause the skill to trigger outside narrow user intent. Over-broad activation increases the chance of unsolicited configuration guidance, persistence setup, or data-handling behaviors in unrelated contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger architecture defines exact and semantic activators exclusively in Chinese, and later manual trigger examples also require Chinese phrases. This imposes a language constraint on users without stating that other languages are supported or giving users a choice, which is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The semantic trigger design instructs the agent to infer significance from conversational phrases and persist user information and preferences automatically. This creates a privacy risk because sensitive data may be stored long-term without explicit, contextual consent or minimization.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill normalizes storing user profile and long-term memory in auto-loaded root workspace files, making persisted data available across future sessions automatically. If those files contain sensitive preferences, constraints, or personal details, they can be unintentionally exposed or over-relied upon later.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

❌ WRONG - Do NOT do this:

bash

# Wrong - creates subfolders
mkdir -p ~/.openclaw/workspace/core
mkdir -p ~/.openclaw/workspace/assets
cp assets/* ~/.openclaw/workspace/core/  # ❌ WRONG

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installation steps copy files into fixed workspace paths without clearly warning that existing AGENTS.md, SOUL.md, USER.md, or MEMORY.md may be overwritten. This can destroy prior configuration or replace trusted instructions with new persistent behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document states that a weekly token audit is automatically configured during installation, but only shows a cron line and manual instructions. Users may wrongly believe a trusted install path set this up safely, leading to unnoticed persistence or inconsistent system state.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

Editing crontab establishes persistence beyond the current session and can cause recurring actions without ongoing user awareness. In this skill's context, that persistence is especially relevant because the scheduled task appends trigger text into the workspace, influencing future agent behavior.

Content

Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.

To change schedule, edit crontab:

bash

crontab -e
# Change: 0 3 * * 1 (Monday 03:00)
# To daily: 0 3 * * * (daily 03:00)
# To disable: Comment out or remove the line

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The quick-start examples encourage recording user statements like preferences and reminders into enduring records based on ordinary phrasing. This trains users toward silent persistence and increases the chance that casual conversation is transformed into long-lived state without deliberate approval.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger rules instruct the agent to capture and remember preferences, constraints, and notable statements from ordinary conversation for later reuse. In a skill centered on agent configuration and memory triggers, this is more dangerous because routine dialogue can silently become persistent profile data without clear user awareness.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger rule "架构/安全/风险主题 → [🧠] 建议多专家" is overly broad and can match many ordinary conversations, making it unclear when the mode should or should not activate. The file does not provide exclusion conditions or concrete boundaries for what qualifies as such a topic.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The startup condition says the mode activates when the user says "多专家讨论：" or when the discussion involves architecture, security, or complex tradeoffs. While the explicit phrase is specific, the topic-based fallback is open-ended and does not distinguish suggestion from activation with concrete limits.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill defines a structured memory system that persists long-term memory, daily task records, and learning debt based on conversational signals and self-evaluation. Without strict minimization and consent controls, this can accumulate sensitive user information and task history that may later be reused inappropriately or exposed through other components.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file instructs the agent to automatically write conversation-derived information into persistent memory files without requiring user notice or consent. This creates a privacy and data-retention risk because sensitive user data, preferences, or task details may be stored beyond the current session unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill guidance is written entirely in Chinese and does not offer any language choice or state that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown defines activation as either a scheduled time or when the user says "检查token优化". This phrase is relatively broad and the file provides no limiting context, explicit trigger list, or negative examples clarifying when the skill should or should not activate, which could cause unintended invocation during ordinary discussion of token optimization.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The phrase for recording important information is overly broad and can capture ordinary user statements as high-priority memory without deliberate consent. In a framework centered on persistent memory, this increases the chance of storing sensitive, incorrect, or manipulative data that later affects agent behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.