T01 · Skill Instruction Hijacking
Error
- Location
CLAUDE.md:5- Finding
Auto-Injected Instructions Attempt to Override Session-Wide Agent Authorization Policy
- Content
View full analysis
- Remediation
View remediation
Security audit
CRUD
Security checks for vulnerabilities and agentic risk
Overview
This skill is disclosed and not visibly malicious, but it broadly tells the agent to read files, search, and browse directories without approval across sessions, which needs review before use.
Install only if you want a persistent CRUD approval workflow that lets the agent perform read operations without a second confirmation. Review or modify it first if your environment contains secrets, private repositories, logs, credentials, or other sensitive files that should require explicit approval before being read or searched.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (14)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
rmdir /S /Q %USERPROFILE%.openclaw\skills\crud
Linux/Mac
rm -rf ~/.openclaw/skills/crud
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
rmdir /S /Q %USERPROFILE%.openclaw\skills\crud
Linux/Mac
rm -rf ~/.openclaw/skills/crud
text
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md You are now using CRUD Approval Mode. Please strictly follow these principles: 1. **Read** - Fully unrestricted, no approval needed, execute directly 2. **Create, Update/Edit, and Delete** - Must first return an action list and wait for user's secondary confirmation before executing ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## 📌 Memory Tips 1. **Read = Fast** - No approval needed, prioritize efficiency 2. **Create/Update/Delete = Safe** - Must confirm, prevent accidental operations 3. **No Exceptions** - All write operations require confirmation
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md # CRUD Skill Usage Examples ## Scenario 1: Read File (No Approval Needed) **User:** Help me see the content of main.py
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md # CRUD Skill Usage Examples ## Scenario 1: Read File (No Approval Needed) **User:** Help me see the content of main.py
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **User:** Help me see the content of main.py **Your Response:** Directly call Read tool to read file, no confirmation needed ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file provides uninstall commands that recursively and forcefully delete the skill directory using
rmdir /S /Qandrm -rf, but it does not warn users that these commands are destructive and irreversible. Under the markdown-specific missing-warning rule, documentation should disclose behaviors that could affect user data or system integrity.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
The README explicitly defines a policy where read operations are executed without user approval. In an agent skill, unrestricted reads can expose sensitive local files, credentials, tokens, configuration, or proprietary code if the agent misclassifies a request as 'read' or if a prompt induces broad data access. The surrounding context makes this more dangerous because it is presented as an automatic security control, which may encourage operators to trust a policy that still permits data exfiltration paths.
- Content
md | Operation Type | Approval Required | Description | |---------------|-------------------|-------------| | **Read** | ❌ No Approval | File reading, search queries, etc. | | **Create** | ✅ Requires Confirmation | File creation, new skill creation, etc. | | **Update/Edit** | ✅ Requires Confirmation | File modification, code editing, etc. | | **Delete** | ✅ Requires Confirmation | File deletion, directory removal, etc. |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
The workflow states that read requests are executed directly with no approval step. This creates an autonomous decision path for data-access operations, allowing the agent to retrieve and return sensitive information without a user checkpoint, especially in cases of ambiguous intent, overbroad search, or prompt-injection-driven file discovery. Because this is described as an operational workflow, it is more than incidental wording and indicates intended behavior.
- Content
🔄 Workflow
No Approval Needed (Read)
text User Request → Execute Directly → Return Result
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 96% confidence
- Finding
The skill explicitly authorizes unrestricted read operations, including file reading, search, and directory browsing, without any approval gate. In an agent context, reads can expose secrets, credentials, proprietary code, or sensitive filesystem metadata, so treating them as inherently safe is an unsafe autonomous decision policy.
- Content
md | Operation Type | Approval Required | Description | |---------------|------------------|-------------| | **Read** | ❌ No approval | File reading, search queries, directory browsing, etc. | | **Create** | ✅ Requires confirmation | File creation, new skill creation, directory creation, etc. | | **Update/Edit** | ✅ Requires confirmation | File modification, code editing, config updates, etc. | | **Delete** | ✅ Requires confirmation | File deletion, directory deletion, skill deletion, etc. |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 98% confidence
- Finding
The workflow instructs the agent to execute read requests directly with no approval step. This creates a clear path for autonomous data access and exfiltration because attackers can phrase malicious objectives as read-only operations while still obtaining sensitive information.
- Content
Workflow
1. No Approval Flow (Read)
text User Request → Execute Directly → Return Result
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 93% confidence
- Finding
The stated use case promotes approval-free read operations as a productivity feature, reinforcing a policy that undervalues confidentiality risk. In practice, unrestricted reads can be chained with summarization or reporting to leak sensitive contents even when no write action occurs.
- Content
md ## Use Cases - Daily development: Quick read operations without approval restrictions - Critical operations: Confirmation mechanism before all write operations - Skill development: New skill creation requires confirmation for safety
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file includes the user example "Help me see the content of main.py," where the trigger phrase "Help me" is a common everyday expression rather than a narrowly scoped invocation. Without additional negative examples or explicit trigger constraints, this can suggest an activation pattern that is broader than intended.
- Content
Static analysis
No suspicious patterns detected.