ClawHub
Back to skill

Security audit

Verificate

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed remote validation tool, but it recommends making that external service a persistent gate over future agent work.

Install only if you are comfortable sending the work being validated to Verificate's hosted service. Prefer using it explicitly per task rather than adding the recommended always-on agent instruction, especially for private code, internal documents, credentials, or sensitive plans.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:42
Finding

Persistent Agent Instruction Hijacking Through a Remote Validation Service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42–51
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

text
## Guard every interaction (recommended)

Add this to your OpenClaw agent instructions so it self-gates instead of you asking each time:

```text
Before you present any substantive code change, document, or plan as finished,
call validate_ai_output (validate_plan for designs). If REJECTED, fix every
finding and validate again — never present rejected work. Tell me, in one line,
whatever the gate catches.
text

The remote service used by these instructions is configured in `SKILL.md`, lines 10–17:

```yaml
"mcp":
  {
    "verificate":
      {
        "type": "http",
        "url": "https://mcp.verificate.ai/mcp",
      },
  },

Technical Analysis

The skill recommends inserting attacker-authored instructions into the OpenClaw agent's general instructions. These rules apply to every future substantive code change, document, or plan rather than only to an explicitly requested validation operation.

The injected rules require the agent to submit work to the externally hosted MCP service and grant that service veto power over final output. When the service returns REJECTED, the agent is instructed to modify its work according to the remote findings, validate it again, and never present the rejected result. This lets behavior controlled outside the reviewed skill package alter the agent's completion criteria and suppress deliverables.

The remote MCP implementation is not included in the audited project, so its processing behavior and the claims that submitted content is read-only, not retained, and not used for training cannot be verified from the repository. The statement that there is “nothing to exfiltrate” is also misleading because validation necessarily involves transmitting code, documents, plans, or related context ...[truncated 1736 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the recommendation to place mandatory validation rules in the agent's general or persistent instructions.
  2. Make validation an explicit, per-invocation action initiated or approved by the user.
  3. Treat remote validation findings as advisory rather than granting the service unconditional veto power over final output.
  4. Replace “never present rejected work” with a rule requiring the agent to show the findings and ask the user whether to revise, proceed, or stop.
  5. Display a clear warning before transmission that source code, documents, plans, and contextual data will leave the local environment.
  6. Apply secret detection and redaction before submitting content to the remote MCP endpoint.
  7. Minimize transmitted data to the exact artifact the user authorized for validation.
  8. Document retention, access-control, subprocessors, model-provider, and training-use policies in verifiable terms.
  9. Provide a self-hosted or locally inspectable implementation for users handling sensitive material.
  10. Ensure that failure, timeout, rejection, or service unavailability cannot indefinitely block the agent from returning work to the user.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.