ClawHub
Back to skill

Security audit

Agent Brainstorm Chair

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly understandable multi-agent meeting skill, but its OpenClaw bridge exposes more local computer authority than its read-only brainstorming purpose needs.

Review before installing. Use this only if you trust the local OpenClaw binary and the agents it will contact. Prefer disabling ACP filesystem-write and terminal capabilities, run it in a low-privilege or sandboxed environment, avoid secrets in environment variables, and use explicit invocation rather than broad meeting phrases.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/openclaw_agent_query.py:207
Finding

ACP Bridge Advertises Unnecessary Filesystem Write and Terminal Capabilities

Content
View full analysis
dict[str, Any]: return { "jsonrpc": "2.0", "id": INIT_REQUEST_ID, "method": "initialize", "params": { "protocolVersion": 1, "clientCapabilities": { "fs": {"readTextFile": True, "writeTextFile": True}, "terminal": True, }, "clientInfo": {"name": "openclaw-agent-query", "version": "0.2"}, }, } ``` ### Technical Analysis The ACP initialization request advertises filesystem write and terminal capabilities even though the documented purpose of the bridge is a read-only consultation. The prompt generated by `build_consult_prompt()` tells the consulted agent not to modify files, write memory, or trigger external actions, but prompt instructions do not provide an enforceable security boundary. Granting or advertising `writeTextFile` and terminal access violates the principle of least privilege. If the ACP runtime makes these capabilities available to the consulted agent, a compromised, misconfigured, or prompt-injected agent could attempt local file modifications or terminal operations using the privileges of the user running the bridge. The bridge also launches OpenClaw with a copy of the current process environment. Consequently, any permitted operation would execute in the security context of the current user rather than in a purpose-built restricted sandbox. ### Attack Path 1. A user or upstream data source supplies content that is forwarded as the meeting topic or consultation prompt. 2. The chair invokes `scripts/openclaw_agent_query.py`, directly or through `scripts/openclaw_meeting_round.py`. 3. The script launches the OpenClaw ACP bridge under the c ...[truncated 1335 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (33)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents a high-level brainstorming/orchestration skill for multi-agent collaboration, including debate mechanics and automatic adaptation across multiple environments. The supplied code does not implement any of those behaviors. Instead, it is a low-level utility wrapper around the openclaw acp command: it discovers the OpenClaw executable, launches a subprocess, forwards CLI arguments, relays stdin, filters stdout to keep JSON-RPC-like payloads on stdout, sends noise to stderr, suppresses echoed input, and forwards SIGINT/SIGTERM. While there is a small overlap in mentioning OpenClaw and environment discovery, the actual primary purpose is stream-cleaning for an OpenClaw ACP process, which is materially different from the declared multi-agent structured brainstorming host skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

该代码的核心功能是执行 openclaw acp 子进程，通过 JSON-RPC 完成 initialize / session/load / session/prompt，然后把 prompt 发给指定 agent 并返回文本结果。这是一个 OpenClaw agent 查询桥，而不是一个完整的多 Agent 头脑风暴主持器。虽然代码中出现了少量与“chair/主持”相关的 prompt 规范化命名，但并没有实现多角色编排、轮次推进、辩论阶段切换、交接棒协议或自动调度多个 agent。相反，接口要求显式传入 --agent，一次只查询一个 agent。另一个明显偏差是“零配置”说法：ALIASES、CHAIR_PROMPT_BUILDERS、CHAIR_PROMPT_PATTERNS 都是待用户填充的配置位。代码确实有一定环境探测（查找 openclaw 可执行文件、HOME、PATH 前缀），但这只支持桥接工具的可发现性，不足以支撑描述中的完整主持能力。因此描述与实际行为存在实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

该脚本的核心功能是读取命令行参数，加载 openclaw_agent_query.py 作为桥接模块，然后对 --agents 指定的代理逐个发起咨询请求，最后汇总结果。它更像“多代理顺序批量查询/咨询轮执行器”，而不是“结构化头脑风暴主持技能”。声明中强调的高级编排能力——自动模式检测、两阶段辩论、轮次管理、角色分工、交接棒——在给出的代码中均没有可见实现。代码也明确要求用户提供 agent 列表和提示输入，因此与“零配置、安装即用”的表述不符。虽然该脚本确实涉及多 Agent 协作，并可围绕 topic 构造一定的咨询提示，但这只部分覆盖了声明中的宽泛方向，无法支撑所宣称的主要能力，因此应判定为描述与实际行为存在实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The description presents a full multi-agent brainstorming/facilitation skill with automatic environment adaptation and structured debate orchestration. The actual code provided is only a unit test module for build_baton.py. It validates output strings related to baton passing, round numbering, facilitator recovery, and template substitution, which aligns with a small supporting part of a baton protocol but does not implement the broader declared functionality. Because the chunk’s primary purpose is testing baton message construction—not providing the described end-user skill behavior—the description does not accurately represent this supplied code chunk.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md
python3 scripts/openclaw_agent_query.py \

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

md
详见 [references/clawhub-publishing.md](references/clawhub-publishing.md)。

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
93% confidence
Finding

Copying the full environment into a spawned process can leak API keys, tokens, cloud credentials, and other secrets to an external binary. In an agent skill, this is more dangerous because such runtimes commonly carry high-value credentials in environment variables, and the binary path can be influenced through OPENCLAW_BIN or PATH resolution.

Content

Scanner excerpt · scripts/openclaw_acp_clean.py (reported line 125)May include surrounding context.

python
openclaw_bin = str(OPENCLAW_BIN if OPENCLAW_BIN.exists() else "openclaw")
    cmd = ["script", "-q", "/dev/null", openclaw_bin, "acp", *iter_args(args)]

    env = os.environ.copy()
    env["PATH"] = f"{OPENCLAW_BIN.parent}:{env.get('PATH', '')}".rstrip(":")
    proc = subprocess.Popen(
        cmd,

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
91% confidence
Finding

Copying the full parent environment into the spawned OpenClaw process can expose secrets such as API keys, tokens, and internal configuration to a downstream agent process that may not need them. In this skill's context, the bridge is explicitly connecting to another agent runtime, so broad environment inheritance meaningfully enlarges the secret exposure surface.

Content

Scanner excerpt · scripts/openclaw_agent_query.py (reported line 430)May include surrounding context.

python
if pid == 0:
        try:
            command = build_openclaw_command(session_key, reset_session)
            env = os.environ.copy()
            env["PATH"] = f"{PATH_PREFIX}:{env.get('PATH', '')}".rstrip(":")
            os.execvpe(command[0], command, env)
        except Exception as exc:

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/openclaw_agent_query.py (reported line 432)May include surrounding context.

python
command = build_openclaw_command(session_key, reset_session)
            env = os.environ.copy()
            env["PATH"] = f"{PATH_PREFIX}:{env.get('PATH', '')}".rstrip(":")
            os.execvpe(command[0], command, env)
        except Exception as exc:
            sys.stderr.write(f"failed to exec openclaw acp bridge: {exc}\n")
            sys.stderr.flush()

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/openclaw_meeting_round.py (reported line 45)May include surrounding context.

python
()
    for token in raw_tokens:
        normalized = token.strip()
        if not normalized or normalized in seen:
            continue
        seen.add(normalized)
        ordered.append(normalized)
    if not ordered:
        raise SystemExit("At least one agent must be provided.")
    return ordered


def build_parser() -> argparse.ArgumentParser:
    parser = argparse.ArgumentParser(
        description="Run a stable Hermes → OpenClaw consultation round across multiple agents.",
    )
    parser.add_argument(
        "--agents",
        required=True,
        help="Comma- or space-separated agent ids in consultation order.",
    )
    parser.add_argument("--topic", help="Meeting topic. When set, build agent-specific prompts automatically.")
    parser.add_argument("--prompt", help="Prompt text to send to every consulted agent.")
    parser.add_argument("--prompt-file", type=Path, help="Read prompt text from a file.")
    parser.add_argument("--timeout-per-agent", type=int, defau

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/openclaw_agent_query.py (reported line 132)May include surrounding context.

python
def build_agent_source_prompt(bridge: Any, *, agent_id: str, prompt_text: str, args: argparse.Namespace) -> str:
    if not args.topic:
        return prompt_text
    builder = getattr(bridge, "CHAIR_PROMPT_BUILDERS", {}).get(agent_id)
    if callable(builder):
        return builder(prompt_text)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/openclaw_agent_query.py (reported line 135)May include surrounding context.

python
def build_agent_source_prompt(bridge: Any, *, agent_id: str, prompt_text: str, args: argparse.Namespace) -> str:
    if not args.topic:
        return prompt_text
    builder = getattr(bridge, "CHAIR_PROMPT_BUILDERS", {}).get(agent_id)
    if callable(builder):
        return builder(prompt_text)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/openclaw_agent_query.py (reported line 138)May include surrounding context.

python
def build_agent_source_prompt(bridge: Any, *, agent_id: str, prompt_text: str, args: argparse.Namespace) -> str:
    if not args.topic:
        return prompt_text
    builder = getattr(bridge, "CHAIR_PROMPT_BUILDERS", {}).get(agent_id)
    if callable(builder):
        return builder(prompt_text)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/openclaw_meeting_round.py (reported line 103)May include surrounding context.

python
def build_agent_source_prompt(bridge: Any, *, agent_id: str, prompt_text: str, args: argparse.Namespace) -> str:
    if not args.topic:
        return prompt_text
    builder = getattr(bridge, "CHAIR_PROMPT_BUILDERS", {}).get(agent_id)
    if callable(builder):
        return builder(prompt_text)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger guidance uses very broad everyday phrases like “开会”, “头脑风暴”, and “主持议事” to auto-load the skill. In a general assistant environment, such common phrases can cause unintended activation during normal conversation, leading the agent to switch into a multi-agent orchestration workflow when the user did not explicitly request this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The OpenClaw configuration instructs the host agent to invoke the meeting workflow whenever the user says “开会”, without additional scoping, confirmation, or context checks. Because this trigger can launch external script-based agent coordination, accidental activation is more dangerous here than in pure simulation mode: it may cause unnecessary multi-agent calls, resource consumption, and unintended propagation of user content to other agents.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill instructs the agent to run shell commands (which openclaw, ls ~/.openclaw/agents/) and inspect local filesystem state, but it does not declare any tool scope or permissions boundary. That creates an implicit capability expansion: a caller may trigger environment probing and local path disclosure without the skill clearly constraining or documenting those actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest description and all operational instructions are presented in Chinese, and the skill provides no opt-in or alternative language behavior. Under the policy, forcing a specific language without offering the user a choice is a natural-language policy violation unless the locale constraint is clearly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The startup trigger phrases are very broad (e.g. ordinary requests about meetings or brainstorming), so the skill may activate unexpectedly during normal conversation. In this skill's context, accidental activation is more dangerous because activation can lead to shell execution and local environment inspection, expanding impact beyond mere UX confusion.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The mode table says discussion mode triggers when the user "只说要讨论" while execution mode triggers when they explicitly say they want delivery or actual completion. This leaves unclear boundary cases for many ordinary requests and does not define how to resolve ambiguous phrasing, which can cause unintended mode selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The default prompts returned by the skill are written entirely in Chinese and direct the responder to answer in that language. In a code file, this is a natural-language locale policy issue because the skill does not offer a language choice or explain why Chinese is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The generated baton message includes multiple hard-coded Chinese instructions, which effectively constrain the interaction language for downstream agents. Because the file provides no user-facing locale selection or justification for this restriction, it violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

This code file defines and forwards sensitive authentication inputs such as --token, --password, --token-file, and --password-file, but provides no warning in the CLI description, comments, or user-facing output about handling credentials. Because credential access/transmission is safety-relevant under the rule, the absence of any disclosure is a reportable gap.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/openclaw_acp_clean.py (reported line 127)May include surrounding context.

python
env = os.environ.copy()
    env["PATH"] = f"{OPENCLAW_BIN.parent}:{env.get('PATH', '')}".rstrip(":")
    proc = subprocess.Popen(
        cmd,
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,

Tainted flow: 'env' from os.environ.get (line 23, credential/environment) → subprocess.Popen (code execution)

Medium
Category
Data Flow
Confidence
86% confidence
Finding

The child process inherits a near-complete copy of the parent environment via os.environ.copy(), and the executed program is selected partly from environment-controlled input (OPENCLAW_BIN). In an agent-skill context, this can expose sensitive environment secrets to the spawned binary and increases risk if an attacker can influence the execution environment or binary resolution.

Content

Scanner excerpt · scripts/openclaw_acp_clean.py (reported line 127)May include surrounding context.

python
env = os.environ.copy()
    env["PATH"] = f"{OPENCLAW_BIN.parent}:{env.get('PATH', '')}".rstrip(":")
    proc = subprocess.Popen(
        cmd,
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/openclaw_meeting_round.py:24

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/test_build_baton.py:11