Skill Vetter Guide

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:13 AM UTC
• Version: 1.1.0

Overview

This is a security-audit guide, but it asks agents to make persistent policy and scheduled-task changes without enough scoping or rollback guidance.

Review before installing. Use the one-time vetting checklist if useful, but do not let it directly edit AGENTS.md or create cron jobs unless you explicitly want persistent policy and scheduled audits. Pin the exact source version or commit, review the proposed AGENTS.md diff and cron line, choose a report retention location, and document how to disable or remove any scheduled task.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: references/prompt-templates.md:54

Finding

Persistent Agent Policy Modification Through AGENTS.md

Content

View full analysis

Vulnerability Details

File Location: references/prompt-templates.md:54-65
Vulnerability Type: Persistent instruction modification
Risk Level: High

Vulnerable Code Snippet

markdown

## Enforce "Vet Before Install" Rule

```text
Please add the following rule to the current agent's AGENTS.md:

All third-party skills must be vetted with Skill Vetter before installation. No exceptions.

Requirements:
1. Tell me which file it should go in
2. Write it directly
3. Explain how this rule affects future skill installation tasks
4. Give me an example of what to say so the agent automatically vets before installing

text

The same behavior is also promoted in `SKILL.md:94-107` and the corresponding Chinese-language copies.

### Technical Analysis

The Skill explicitly instructs an agent to write a mandatory rule into `AGENTS.md`. This file can govern agent behavior across subsequent tasks and sessions, so modifying it goes beyond providing an advisory security checklist within the current interaction.

The rule is security-oriented, but the mechanism establishes a precedent whereby loaded Skill instructions can alter persistent agent policy. The wording “No exceptions” further attempts to constrain future behavior without requiring a task-specific approval, exact proposed diff, or rollback procedure.

### Attack Path

1. A user or automated workflow loads the Skill and selects the enforcement prompt.
2. The prompt instructs the agent to locate the current agent’s `AGENTS.md`.
3. The agent writes the supplied mandatory rule directly into that file.
4. Future sessions load the modified instructions.
5. Subsequent skill-installation tasks are governed by the persisted rule, even when this Skill is no longer active.

### Impact Assessment

Successful exploitation can persistently alter future agent decision-making and installation workflows. The modification is limited to instruction-level control and does not itself grant operating-system privileges
...[truncated 294 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to write directly to AGENTS.md.
• Present the policy as an optional recommendation rather than an automatic enforcement action.
• Require explicit, informed user approval immediately before any persistent instruction-file modification.
• Display the exact target path and proposed diff before writing.
• Restrict changes to a clearly delimited section and preserve a backup of the original file.
• Provide explicit rollback instructions.
• Do not use absolute wording such as “No exceptions” unless the user has independently selected that policy.
• Keep security-vetting behavior scoped to the active task by default.

T06 · System Persistence

Warning

• Location: references/prompt-templates.md:83

Finding

Recurring Audit Persistence Through Cron

Content

View full analysis

Vulnerability Details

File Location: references/prompt-templates.md:83-95
Vulnerability Type: Persistent scheduled execution
Risk Level: Medium

Vulnerable Code Snippet

markdown

## Set Up Automated Audit Cron

```text
Please create a cron job that runs a skills security audit every 4 hours.

Requirements:
1. Run in an isolated session
2. Audit all third-party skills under ~/.agents/skills/
3. Check against the Skill Vetter red flag checklist
4. Write results to security-audits/skills-audit-YYYY-MM-DD_HHMM.md
5. Keep historical files (don't overwrite)
6. Send a brief summary back to the current chat

text

Recurring cron-based auditing is also recommended in `SKILL.md:84-91` and the corresponding Chinese-language copies.

### Technical Analysis

The template asks the agent to establish a scheduled task that survives the initiating session and executes every four hours. Although the intended payload is a security audit, the project does not define a fixed reviewed executable, a constrained runtime identity, resource limits, retention limits, an authenticated summary-delivery mechanism, or a removal procedure.

The phrase “isolated session” is not accompanied by enforceable sandboxing details. The scheduled process is directed to scan all third-party skills under a user-global directory and preserve every historical report, creating recurring filesystem access and potentially unbounded storage growth.

### Attack Path

1. A user submits the provided cron setup template.
2. The agent creates a recurring scheduler entry.
3. Every four hours, the scheduled process scans `~/.agents/skills/`.
4. The process writes a new timestamped report without overwriting previous files.
5. The task continues after the original conversation ends and attempts to return summaries to a chat context.
6. If the invoked audit command or its dependencies later change, the scheduler continues running the changed behavior automatically.

### Impact Assessment

The
...[truncated 553 chars]

Remediation

View remediation

Remediation Suggestions

• Default to manually initiated audits rather than recurring scheduled execution.
• Require separate, explicit user approval before creating a cron entry.
• Provide the exact proposed scheduler entry and executable command for review.
• Pin the scheduled command to a locally reviewed, immutable script.
• Execute under a dedicated least-privilege account or an enforceable sandbox.
• Constrain reads to the intended skills directory and writes to a dedicated audit directory.
• Add execution timeouts, concurrency controls, file-size limits, and a report-retention policy.
• Define an authenticated and privacy-preserving summary destination instead of “the current chat.”
• Document how to list, disable, and permanently remove the scheduled task.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Installation From an Unpinned and Ambiguous Third-Party Source

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:12-22
Vulnerability Type: Unsafe third-party component sourcing
Risk Level: Medium

Vulnerable Code Snippet

markdown

## Install Skill Vetter

Install to the user-global skills directory so all agents can use it:

~/.agents/skills/skill-vetter/

text

Source: `useai-pro/openclaw-skills-security@skill-vetter` on ClawHub, or the equivalent GitHub repo.

After installation, verify:

The installation prompt repeats the mutable source at references/prompt-templates.md:5-15.

Technical Analysis

The installation guidance identifies a ClawHub package name but does not pin an immutable version, commit identifier, release artifact, or cryptographic digest. The alternative phrase “the equivalent GitHub repo” does not specify a canonical repository URL and permits ambiguous source selection.

Consequently, the artifact reviewed during vetting may not be the exact artifact installed afterward. A mutable package update, compromised publisher account, repository takeover, lookalike repository, or source-resolution error could replace the reviewed content with a different payload.

Installation into ~/.agents/skills/ makes the resulting component available to all agents using that user-global directory, increasing the reach of a compromised package.

Attack Path

1. An agent resolves the package name or searches for an “equivalent” GitHub repository.
2. The selected source is reviewed at its current mutable revision.
3. The upstream package, branch, tag, or repository content changes after review, or the agent resolves an unofficial lookalike repository.
4. The agent installs the changed artifact into ~/.agents/skills/skill-vetter/.
5. All agents using the user-global skills directory can subsequently load the unreviewed content.

Impact Assessment

The immediate project contains no embedded executable payload, so the final impact depends on the third-party artifact retrieved during ...[truncated 315 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the ambiguous source description with one canonical, verified HTTPS repository or registry URL.
• Pin installation to an immutable release version and commit hash.
• Publish and verify a cryptographic digest or signed provenance record for the complete artifact.
• Ensure the installed bytes exactly match the bytes reviewed during vetting.
• Reject redirects to unofficial repositories, mutable branches, and lookalike package names.
• Record the source URL, commit, digest, and verification result in the audit report.
• Re-run the complete review whenever the pinned version changes.
• Prefer a per-agent or isolated installation scope unless user-global availability is explicitly required.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description says the skill should be used when 'auditing existing skills,' 'skill security,' or 'review skill safety,' and lists broad trigger phrases like 'audit skills.' These phrases are not narrowly scoped to this specific vet-before-install workflow, and there are no exclusion conditions or negative examples to limit unintended activation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

### 6. Document Installation

After installing, record: date, skill name, source, risk level, review summary, install path.
Write to `memory/YYYY-MM-DD.md` or a dedicated `security-audits/` directory.

## Periodic Audit

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

来源：ClawHub 上的 `useai-pro/openclaw-skills-security@skill-vetter`，或对应的 GitHub 仓库。

安装后验证：
1. 确认 `~/.agents/skills/skill-vetter/SKILL.md` 存在且内容完整
2. 检查该 skill 出现在 agent 的可用 skills 列表中

## 审查 SOP

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 23)May include surrounding context.

md

来源：ClawHub 上的 `useai-pro/openclaw-skills-security@skill-vetter`，或对应的 GitHub 仓库。

安装后验证：
1. 确认 `~/.agents/skills/skill-vetter/SKILL.md` 存在且内容完整
2. 检查该 skill 出现在 agent 的可用 skills 列表中

## 审查 SOP

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/prompt-templates.md (reported line 63)May include surrounding context.

Requirements:

1. Tell me which file it should go in
2. Write it directly
3. Explain how this rule affects future skill installation tasks
4. Give me an example of what to say so the agent automatically vets before installing

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The phrase 'create a cron job' explicitly requests persistence, which can survive beyond the current session and repeatedly execute tasks. Even though the stated goal is benign security auditing, persistence is security-relevant because it can be repurposed, misconfigured, or used to normalize unattended privileged behavior.

Content

Scanner excerpt · references/prompt-templates.md (reported line 86)May include surrounding context.

Set Up Automated Audit Cron

text

Please create a cron job that runs a skills security audit every 4 hours.

Requirements:
1. Run in an isolated session

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This template instructs creation of a cron job without warning that it establishes persistent scheduled execution on the host. Persistent automation increases attack surface because a user may authorize ongoing execution and filesystem activity without understanding the long-term effect or reviewing the exact command being scheduled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template instructs the agent to directly modify AGENTS.md without explicitly warning that this changes a persistent user configuration file. In practice, this can cause durable behavior changes to future skill-installation workflows and may surprise users into accepting policy changes they did not fully understand.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The template directs creation of a recurring security audit task every 4 hours and persistent audit files, but does not clearly disclose the ongoing nature of the scheduled job or its system impact. Persistent automation can alter host behavior over time, consume resources, and create durable artifacts or scheduled-task entries that users may not realize were installed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown template is entirely written in Simplified Chinese and instructs reviewers to use that format every time, which implies a fixed language requirement. The file does not offer user opt-in, alternative locales, or any justification that the skill is intended only for a Chinese-specific context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file contains a prompt template that tells the agent to modify the current agent's AGENTS.md and to 'Write it directly.' While the action is intentional, the template does not warn the user that it will change an on-disk configuration file affecting future agent behavior. Under the markdown-file criteria for missing user warnings, this is a system-affecting behavior that should be disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The template directs the agent to 'Write results to a timestamped markdown file,' which creates files on the user's system. The surrounding description does not explicitly warn that running this prompt will produce persistent audit artifacts. For markdown guidance that affects user data or system state, a user-facing warning is expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

该段说明会把巡检结果写入文件，这是对用户文件系统的持久化写入。模板没有提醒将创建新文件、存储位置或可能包含敏感审计信息，属于影响用户数据/系统状态的行为缺少警示。

Content

No source excerpt is available for this finding.