Inference Optimizer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:39 AM UTC
• Version: 0.3.4

Overview

The skill fits an OpenClaw audit/optimization purpose, but its setup and cleanup flows can persistently expand agent permissions, create broad local backups, and move or delete session and memory files.

Install only if you are comfortable with a skill that can modify OpenClaw workspace instructions and execution approvals. Review setup.sh --apply before running it, keep preflight backups private, avoid --delete unless you have verified what will be removed, and consider manually approving only the read-only audit path instead of pre-approving mutating scripts.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/setup.sh:53

Finding

Setup Permanently Expands Execution Approvals for File-Changing Scripts

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/preflight.sh:16

Finding

Preflight Creates Sensitive State Archives Without Enforcing Restrictive Permissions

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/purge-stale-sessions.sh:9

Finding

Session Purge Command Also Removes Memory Files Based Solely on File Size

Content

View full analysis

/dev/null || true for f in "$MEMORY_DIR"/*.md; do [[ -f "$f" ]] || continue if [[ $(wc -c < "$f") -lt 200 ]]; then if [[ "$DO_DELETE" = true ]]; then rm -f "$f" && ((PURGED++)) || true echo " deleted $(basename "$f")" else mkdir -p "$ARCHIVE_DIR/memory" mv "$f" "$ARCHIVE_DIR/memory/" 2>/dev/null && ((PURGED++)) || true echo " archived $(basename "$f")" fi fi done [[ $PURGED -eq 0 ]] && echo " none found" || true else echo " memory dir not found: $MEMORY_DIR" fi MEMORY_ACTION_COUNT=$PURGED ``` ### Technical Analysis The user-facing operation is named `purge sessions`, and the documentation primarily describes it as stale-session cleanup. The implementation additionally processes top-level Markdown files in an agent memory directory. A memory file is selected solely because it contains fewer than 200 bytes. File size does not establish that the memory is stale, redundant, invalid, or safe to remove. A concise but important durable fact can legitimately be shorter than this threshold. In archive mode, selected files are moved out of the active memory directory and immediately cease to participate in normal agent memory behavior. In `--delete` mode, they are permanently removed without archive recovery. The script does not provide a dry-run listing, per-file confirmation, age requirement, content classification, or exclusion mechanism for pro ...[truncated 1496 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 74)May include surrounding context.

Uninstall

bash

rm -rf ~/clawd/skills/inference-optimizer

Safety

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 74)May include surrounding context.

Uninstall

bash

rm -rf ~/clawd/skills/inference-optimizer

Safety

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The declared purpose emphasizes runtime auditing and inference/token optimization, but the documented behavior also includes installation verification and validation of documentation and approval configuration files. While not inherently malicious, this gap weakens informed consent and can cause operators to approve broader access than intended.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose emphasizes runtime auditing and inference/token optimization, but the documented behavior also includes installation verification and validation of documentation and approval configuration files. While not inherently malicious, this gap weakens informed consent and can cause operators to approve broader access than intended.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose emphasizes runtime auditing and inference/token optimization, but the documented behavior also includes installation verification and validation of documentation and approval configuration files. While not inherently malicious, this gap weakens informed consent and can cause operators to approve broader access than intended.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared purpose emphasizes runtime auditing and inference/token optimization, but the documented behavior also includes installation verification and validation of documentation and approval configuration files. While not inherently malicious, this gap weakens informed consent and can cause operators to approve broader access than intended.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose emphasizes runtime auditing and inference/token optimization, but the documented behavior also includes installation verification and validation of documentation and approval configuration files. While not inherently malicious, this gap weakens informed consent and can cause operators to approve broader access than intended.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This script performs destructive maintenance on session and memory data, which goes beyond the stated skill purpose of auditing runtime health and optimizing inference speed/token usage. Even in archive mode, it materially alters user/application state; in delete mode, it permanently removes data based on coarse heuristics (age and file size), creating risk of unintended data loss and operational disruption.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The --delete path directly deletes OpenClaw session JSONL files older than 24 hours and memory markdown files under 200 bytes without validating whether they are safe to remove or necessary for recovery, auditing, or ongoing workflows. Because this is packaged under an inference-optimization skill, an operator may invoke it expecting performance tuning rather than destructive cleanup, increasing the chance of accidental execution and irreversible loss of context/state.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrase "purge sessions" is broad, natural-language text that could be invoked accidentally during ordinary conversation, especially in an agent environment that maps free-form user text to skill actions. Because this skill is operational and the phrase is tied to session archival/removal behavior, ambiguous activation increases the risk of unintended state changes or data handling actions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises and instructs use of shell execution, file reads/writes, and environment access, but it does not declare an explicit tool/permission scope. That creates an authorization ambiguity where a reviewer or platform may under-estimate what the skill can do, especially because the documented workflows include setup, allowlist edits, backups, and purge actions affecting local state.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

- only then context pressure, stale sessions, cache-trace, pruning, and concurrency
3. **Diagnosis rule**: Do not conclude from warnings alone. If process output is partial or truncated, report the result as inconclusive and verify installed version, service state, and logs before naming a cause.
4. **No helper-shell prelude**: For `/audit` and `/optimize`, do not run shell helper commands like `ls`, `rg`, `find`, `openclaw status`, or `openclaw gateway status` before the main audit script. If you need context first, use `read` on `MEMORY.md` or `memory_search`. The first shell exec in the optimize flow should be the audit script itself.
5. **Approval semantics**: If exec returns `allowlist miss` or `exec denied`, that is a hard deny, not a pending approval. Do not tell the user to send `/approve ...` unless the tool output explicitly contains a real approval request with an ID. If there is no ID, say there is no approval request to approve and the fix must be on the bot side.
6. **VPS gateway ownership**: On this VPS, `openclaw-gateway.service` is the authoritative gateway owner. Keep `clawdbot.service` disabled, and preserve `pass-cli run --env-file /etc/clawdbot.env.pass` inside the user service itself.

### Optimization branch

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill instructs rewriting always-loaded workspace files such as SOUL.md, AGENTS.md, TOOLS.md, MEMORY.md, and daily memory files. Persistent modification of agent context and memory is security-sensitive because it can accidentally destroy safeguards, introduce prompt-injection persistence, or irreversibly alter future agent behavior beyond the current session.

Content

Scanner excerpt · optimization-agent.md (reported line 66)May include surrounding context.

md

---

## Task 2 — Rewrite workspace files

For each file identified in Task 1 with savings > 100 tokens:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented /audit and /optimize triggers are broad and lack clear activation constraints or negative examples, increasing the chance that an agent may invoke analysis or optimization flows too eagerly based on casual chat text. Because /optimize leads to operational actions and script execution, ambiguous triggering can result in unintended system modifications.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The preflight script goes beyond the skill's stated audit and optimize scope by performing backups, invoking setup and verification scripts, and giving purge-related operational guidance. Expanding behavior beyond the declared interface increases the attack surface and can mislead users into running privileged or state-changing actions they did not expect from an inference-optimization skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script creates tar archives of entire OpenClaw and workspace directories, which may contain secrets, chat history, tokens, configs, and unrelated user data. For a skill framed as inference optimization, this broad data collection is excessive and creates confidentiality risk if the backups are later exposed, retained insecurely, or accessed by other local users.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script prepares allowlist entries for multiple executable paths, including setup and purge actions, thereby broadening execution privileges for agents. Automatically seeding approvals is dangerous because it weakens approval boundaries and can make later command execution appear pre-authorized, especially in multi-agent or shared workspace environments.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script injects managed command blocks into AGENTS.md and TOOLS.md, effectively registering new agent commands in workspace documentation and behavior. Even though this is framed as convenience setup, it creates persistent operational hooks not disclosed by the stated skill purpose, which increases the chance of users enabling additional capabilities without a clear security review.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

When run with --apply, the setup script edits workspace AGENTS.md and TOOLS.md and also updates the execution approvals file, expanding what downstream agents may execute. This changes trust and control surfaces beyond simple inference auditing/optimization, and can silently persist new command pathways into shared workspaces if a user approves the setup without understanding the scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises a /preflight command and install-check behavior that are outside the declared manifest scope of /audit and /optimize. This scope drift is dangerous because it creates hidden or unexpected execution paths, making users and reviewers less able to predict what actions the skill may perform.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.