Autooptimise

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:33 AM UTC
• Version: 0.1.0

Overview

The skill does what it claims, but users should be careful because it can run tests against other skills and edit them after approval.

Install only from a source/version you trust, invoke it with an explicit target skill, and avoid unattended HEARTBEAT use on sensitive skills. Review every proposed diff before approving because approved changes alter how another skill behaves.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:126

Finding

Unpinned Package Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 126–134
Vulnerability Type: Mutable third-party package execution
Risk Level: Medium

Vulnerable Code

bash

# Via ClawHub CLI
npx clawhub@latest install autooptimise

# Or manual
git clone https://github.com/WealthVisionAI-Source/autooptimise \
  ~/.openclaw/workspace/skills/autooptimise

Technical Analysis

The recommended installation command invokes npx clawhub@latest, which downloads and executes whichever release currently has the mutable npm latest tag. Neither an exact package version nor an integrity value is specified. Consequently, the code executed during installation can differ from the code that was available when this project was audited.

If the package publisher account, npm package, release process, or an associated dependency is compromised, an attacker could publish a malicious version and assign it to latest. A user following the documented command would then retrieve and execute that version with the user's local permissions.

The manual git clone alternative is also not pinned to a reviewed commit or signed release tag. However, it retrieves repository content rather than directly invoking it through the displayed command, so it represents a weaker form of the same supply-chain concern.

Attack Path

1. An attacker compromises the clawhub npm publisher account, package release pipeline, or another mechanism capable of controlling the package's latest release.
2. The attacker publishes a malicious package version or modifies the dependency chain used by that version.
3. The malicious release is assigned to the mutable latest tag.
4. A user follows the documented npx clawhub@latest install autooptimise instruction.
5. npx downloads and runs the attacker-controlled package.
6. Malicious package initialization or CLI logic executes with the privileges of the invoking user.

Impact Assessment

Successful exploitation could permit arbi ...[truncated 633 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest tag with an exact, reviewed package version:

   bash

   npx clawhub@X.Y.Z install autooptimise
   

2. Verify the selected package version and its dependency tree before documenting it as the recommended installer.

3. Publish checksums, provenance attestations, or signatures for official releases and instruct users how to verify them.

4. Where supported, execute the installer under a lockfile or other integrity-enforcing mechanism.

5. Pin the manual installation method to a reviewed commit or signed release tag:

   bash

   git clone --branch vX.Y.Z --depth 1 \
     https://github.com/WealthVisionAI-Source/autooptimise \
     ~/.openclaw/workspace/skills/autooptimise
   

6. Document verification of the checked-out commit or release signature before the installed Skill is loaded.

7. Run installation with the least-privileged account required and avoid executing package installers with administrative privileges.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 16)May include surrounding context.

text

node_modules/

# Environment
.env
.env.*

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · README.md (reported line 217)May include surrounding context.

md

**Tool availability check (v0.2):** Before running benchmarks, autooptimise will verify that the skill's required tools are installed (e.g. `gh` CLI for the GitHub skill). Running benchmarks for a tool that isn't installed produces meaningless scores — this pre-flight check prevents that.

**Skill safety auditing (v0.2):** A planned audit mode will scan skills for suspicious patterns before optimising them — unexpected external URLs, instructions that attempt to override system prompts, or tool requests inconsistent with the skill's stated purpose. This is particularly important when optimising skills downloaded from unknown sources.

---

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The installation command uses npx clawhub@latest, which pulls whatever version is current at execution time. That creates a supply-chain risk: a compromised or breaking future release could be executed by users directly from the README with no version pinning or integrity check.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger phrases are broad natural-language examples like 'optimise my news skill' and 'benchmark my ... skill', which may match casual conversation or unrelated requests in systems that auto-dispatch skills from text. That can cause unintended invocation of a skill that performs benchmarking, tool use, and modification proposals against installed skills.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README repeatedly promises that changes are never auto-applied, but the heartbeat scheduling example instructs the agent to run autooptimise automatically without restating the approval gate. In an agentic environment, that ambiguity can lead operators to assume unattended optimization is safe, increasing the chance of autonomous modifications or risky benchmark activity without explicit human review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The heartbeat rule 'If so, run autooptimise on the oldest one' is open-ended and lacks scope, approval, and exclusion constraints. In periodic agent execution, this can trigger optimization on sensitive, untrusted, or poorly understood skills automatically, causing unintended tool execution, benchmark traffic, or modification proposals without clear operator intent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 235)May include surrounding context.

md

| Regression testing | ❌ | ✅ |
| Human approval gate | ❌ some | ✅ always |

Other approaches either log errors reactively (no measurement), audit config/cost (not skill quality), or run autonomous code changes with no scoring and no approval gate. autooptimise is the only one that asks: *how good is this skill, measured objectively, before and after a change?*

---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrase "improve my skill overnight" is broad, natural-language phrasing that could be invoked unintentionally during ordinary conversation about improving a skill, causing the agent to enter an autonomous optimization workflow without sufficiently explicit user intent. In this skill's context, accidental activation is more dangerous because the workflow benchmarks another skill, reads additional files, and proposes modifications, which expands scope and may consume resources or expose sensitive project context.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · runner/run_experiment.md (reported line 11)May include surrounding context.

md

Before starting, confirm:

- [ ] **Target skill identified** — which skill file are we optimising? (e.g. `~/.openclaw/skills/weather/SKILL.md`)
- [ ] **Skill file readable** — read the full current skill file into context
- [ ] **Benchmark loaded** — read `benchmark/tasks.json` (10 tasks)
- [ ] **Scorer loaded** — read `benchmark/scorer.md`

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document first frames changes as requiring human approval before proceeding, then explicitly instructs the agent to apply the diff itself once approval is given. That conflicts with the later safety wording 'Never auto-apply changes,' which suggests the agent should not directly perform file modifications as part of the autonomous loop.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This JSON task file hard-codes all example user prompts in English and provides no indication that other languages are supported or that English-only behavior is intentional. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.