Security audit

Her Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it gives an autonomous agent broad command, file-writing, self-modification, and sub-agent powers without enough containment or user-control rules.

Install only after reviewing the scripts and only in a sandboxed OpenClaw workspace. Keep permission_level limited or disabled, do not enable full command execution unless you trust every command before it runs, and avoid storing secrets or sensitive files where this agent can read or modify them.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises concrete file read/write capabilities but does not declare permissions or user-consent boundaries. In an agent framework, hidden or undocumented capability elevation increases the chance of unauthorized file access, unsafe assumptions by operators, and accidental exposure or modification of local data.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose presents the skill as a cognitive/self-improvement agent, but the described behavior includes shell execution, filesystem modification, external note creation, and self-updating state. That mismatch is dangerous because reviewers or users may grant trust based on the benign description while the skill can materially alter the host environment and execute commands.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The script provides a generic shell-command execution primitive that exceeds the stated skill purpose of reasoning, memory, and knowledge management. In full-permission mode it directly `exec`s arbitrary user-supplied arguments, turning the skill into a general command runner and materially increasing the attack surface for destructive local actions, data access, or persistence.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The comments describe the script as enabling 'safe' shell execution, but the implementation permits unrestricted command execution whenever `permission_level` is set to `full`. This mismatch can mislead reviewers or users into trusting a control that does not exist, making risky execution more likely and reducing effective oversight.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly promotes file writing, shell execution, self-modification, and installation of new skills without any user-facing warning, approval flow, or change-control requirement. In context, these are high-risk actions that could alter the system, persist unwanted state, or expand capabilities further, making the lack of guardrails a real security issue.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: In full-permission mode the script executes arbitrary subprocesses via `exec "$@"` with no confirmation, warning, or contextual risk disclosure. In an agent skill, this is especially dangerous because upstream prompts, memory, or tool inputs may influence command selection, enabling unintended filesystem access, code execution, or destructive system changes.

Static analysis

No suspicious patterns detected.