T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:190- Finding
Forced promotional output and Agent response hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Openclaw Boss
Security checks for vulnerabilities and agentic risk
Overview
This skill can generate the promised profile report, but it also declares broad private-data access and persistent scheduled root execution that users should review before installing.
Install only if you are comfortable with a skill reading long-term memory, user profile files, session metadata, and prior reports, and with scheduled report generation. Before installing, verify or remove the missing .onload hook, disable root cron scheduling, avoid forwarding full unredacted reports into chat, and review generated reports/logs for secrets or personal information.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T06 · System Persistence
Error
- Location
package.json:25- Finding
Declared automatic root-level scheduled persistence
- Content
View full analysis
/etc/cron.d/openclaw-boss << EOF 0 22 * * 0 root python3 analyze-user.py --report-type weekly 0 9 1 * * root python3 analyze-user.py --report-type monthly EOF ``` The README states that installation automatically performs the following actions: ```markdown 安装脚本会自动： - ✅ 创建周报定时任务（每周日 22:00） - ✅ 创建月报定时任务（每月 1 日 09:00） - ✅ 配置日志文件 - ✅ 启动 Cron 服务（如未运行） ``` ### Technical Analysis The declared installation process creates cross-session scheduled tasks in `/etc/cron.d/` and executes the analyzer as `root`. Generating a profile report does not require root privileges or automatic persistence. The behavior therefore exceeds the minimum privileges necessary for the Skill's stated functionality. The Cron entries establish a recurring trust relationship with code stored in the Skill directory. If that code or its directory is later modified, the replacement code would be executed automatically with root privileges. The metadata references a `.onload` script, but that file is absent from the supplied artifact. Consequently, the exact implementation could not be audited, and automatic Cron installation could not be reproduced from the submitted files alone. This inconsistency increases supply and installation risk because the documentation and package metadata promise privileged behavior whose implementation is unavailable for inspection. ### Attack Path 1. The Skill is installed th ...[truncated 1095 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze-user.py:417- Finding
Unredacted private memory excerpts are copied into reports, stdout, conversations, and logs
- Content
View full analysis
dict: """读取所有记忆文件""" memories = {"MEMORY.md": read_file(MEMORY_FILE), "USER.md": read_file(USER_FILE), "daily": []} if MEMORY_DIR.exists(): for f in sorted(MEMORY_DIR.glob("*.md"), reverse=True)[:30]: memories["daily"].append({"file": f.name, "content": read_file(f)}) return memories ``` It extracts raw text surrounding broad keywords: ```python for keyword in keywords: if re.search(keyword, memory_content, re.IGNORECASE): score += 1 match = re.search(rf'.{{0,50}}{keyword}.{{0,100}}', memory_content, re.IGNORECASE) if match: evidence.append(match.group(0)[:80]) if score > 0: raw_score = min(5, score * 1.2) strict_score = calculate_strict_score(raw_score * 20, penalty_factors=[0.8, 0.85, 0.9]) total_trait_score += strict_score trait_count += 1 ``` The complete report is printed to stdout: ```python print("=" * 80) print("📋 以下是完整报告内容（请复制并展示给用户）：") print("=" * 80) print() print(report) print() print("=" * 80) print("✅ 完整报告输出结束") print("=" * 80) ``` Scheduled wrappers append all analyzer output to persistent log files: ```bash python3 "$SCRIPT_DIR/analyze-user.py" \ --limit 50 \ --report-type weekly \ --output "$REPORTS_DIR/weekly-profile-$DATE.md" 2>&1 | tee -a "$LOG_FILE" ``` ### Technical Analysis The evidence extraction logic copies up to 80 characters from the user's long-term memory around generic matching terms. There is no implemented redaction stage for credentials, tokens, passwords, personal identifiers, private URLs, or unrela ...[truncated 1620 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/analyze-user.py:261- Finding
Unnecessary broad memory-database access through another installed Skill
- Content
View full analysis
list: """从 Agent Memory Ultimate 数据库查询记忆""" db_path = DB_DIR / "memory.db" if not db_path.exists(): return [] try: cmd = f"cd {WORKSPACE}/skills/agent-memory-ultimate/scripts && python3 mem.py recall \"{query}\" --limit 20" output = run_command(cmd, timeout=30) if output.strip(): return output.strip().split('\n')[:20] except: pass return [] ``` The main function requests the broad wildcard query: ```python db_memories = query_memory_db("*") if db_memories: print(f" 💾 从数据库获取到 {len(db_memories)} 条记忆") ``` The helper executes commands through a shell: ```python def run_command(cmd: str, timeout: int = 60) -> str: """执行 shell 命令并返回输出""" try: result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout) return result.stdout except Exception as e: return f"[Error: {e}]" ``` ### Technical Analysis The analyzer queries up to 20 broad memory records through the separately installed `agent-memory-ultimate` Skill. The returned records are not used by `analyze_user_data()` or report generation; only their count is printed. The access therefore exceeds the minimum data required for the declared functionality. Invoking another Skill's script also expands the trust boundary. The analyzer implicitly trusts that `mem.py` has not been modified and will behave safely. Since the command is executed with `shell=True`, future reuse of `query_memory_db()` with attacker-controlled query text could additionally introduce shell-command injection. In the reviewed execution pa ...[truncated 1095 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (50)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sudo nano /etc/cron.d/openclaw-boss
或删除定时任务文件
sudo rm /etc/cron.d/openclaw-boss
text **手动触发报告**：
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Automatic cron configuration is not justified by the stated purpose of generating user self-analysis reports. Adding root-level persistence to a non-administrative skill creates a durable execution path that could be abused later, increases blast radius, and is especially concerning because the skill already processes sensitive local user data.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash # 安装后删除 cron 配置 sudo rm -f /etc/cron.d/openclaw-boss # 或注释掉定时任务 sudo nano /etc/cron.d/openclaw-boss
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared purpose says the skill analyzes conversation history for self-reflection, but the documented behavior goes further by reading workspace files, querying memory data, invoking shell commands, persisting reports, and comparing prior reports. This mismatch prevents informed consent and can cause the agent to access broader personal data than the user expects.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases are broad everyday requests like 'analyze me' or '评价一下我', making accidental invocation likely during normal conversation. In this skill, accidental activation is risky because it can launch data collection and generate a detailed personal profile without a deliberate, informed request.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs the agent to read a generated report and reproduce it verbatim in chat. Because the report is built from conversation history and possibly other local data, this creates a direct plain-text exfiltration path from files and internal analysis into the visible conversation.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The repeated instruction to copy complete tool or file output into the response removes any opportunity for selective redaction and maximizes disclosure of potentially sensitive user data. If prior conversations, memory entries, or saved reports contain secrets or personal information, they can be surfaced directly to the chat transcript.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The workflow formalizes a dangerous sequence: run script, locate saved file, read it, and paste all contents into the reply. This is a textbook data exposure pattern because it operationalizes file-to-chat transfer of potentially sensitive content gathered from broader local context.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
Using subprocess.run with shell=True creates a classic tool-parameter abuse surface because command strings can be expanded or injected by the shell. In an agent skill that already accesses user-derived data and other tooling, this significantly raises the severity because compromise could lead to arbitrary command execution in a sensitive environment.
- Content
python def run_command(cmd: str, timeout: int = 60) -> str: """执行 shell 命令并返回输出""" try: result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout) return result.stdout except Exception as e: return f"[Error: {e}]"
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The report presents scores as strict and truthful while multiple outputs are randomized or fabricated, including penalties, rankings, and some period metrics. This is dangerous because it can mislead users into trusting invented security or performance assessments as factual, causing poor decisions based on false data.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script executes shell commands to collect data for a profiling/reporting task, which exceeds the minimum capability needed for the stated purpose. Granting command-execution capability to a skill that processes user history increases the risk of abuse, especially if combined with future parameter injection or repurposing by an attacker.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script prints the full generated profile report to stdout specifically so it can be copied back to the user through tool output. This creates a direct exfiltration path for potentially sensitive memory- and session-derived content, especially in environments where tool output may be logged, forwarded, or visible to components beyond the end user.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are common conversational requests such as '分析一下我' and '生成用户评价报告', making accidental activation plausible during ordinary chat. Because the skill analyzes conversation history and may generate persistent reports, unintended triggering can expose private context or cause unexpected profiling behavior.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README states that installation automatically creates cron jobs and starts the Cron service, which expands the skill from simple user profiling into persistent system-management behavior. For a self-reflection/report skill, scheduled execution and service control are unnecessary privilege/scope increases that can surprise users and create persistence without clear consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README advertises automatic creation of cron jobs and starting the Cron service without a strong, prominent warning that installation modifies the system and enables persistent scheduled execution. This weak consent model increases the risk that users install the skill without understanding ongoing background behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installation section repeats that setup is automatic and '无需手动配置，安装即用', reinforcing persistence behavior without emphasizing that system cron and services are being altered. Repetition of convenience messaging without risk disclosure increases the likelihood of uninformed consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The security documentation frames the skill as a local analysis/reporting tool, but it also documents persistent cron installation under
/etc/cron.d/requiring root-level system changes. That mismatch is dangerous because it downplays a persistence mechanism and elevated privilege requirement that materially expands the skill's trust boundary and attack surface.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # 限制脚本执行权限 chmod 755 /root/.openclaw/workspace/skills/openclaw-boss/scripts/analyze-user.py # 限制数据库访问 chmod 644 /root/.openclaw/workspace/db/memory.db
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
chmod 755 /root/.openclaw/workspace/skills/openclaw-boss/scripts/analyze-user.py
限制数据库访问
chmod 644 /root/.openclaw/workspace/db/memory.db
text ### 3. 禁用自动 Cron（可选）
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # 安装后删除 cron 配置 sudo rm -f /etc/cron.d/openclaw-boss # 或注释掉定时任务 sudo nano /etc/cron.d/openclaw-boss
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # 安装后删除 cron 配置 sudo rm -f /etc/cron.d/openclaw-boss # 或注释掉定时任务 sudo nano /etc/cron.d/openclaw-boss
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # 安装后删除 cron 配置 sudo rm -f /etc/cron.d/openclaw-boss # 或注释掉定时任务 sudo nano /etc/cron.d/openclaw-boss
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # 安装后删除 cron 配置 sudo rm -f /etc/cron.d/openclaw-boss # 或注释掉定时任务 sudo nano /etc/cron.d/openclaw-boss
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # 安装后删除 cron 配置 sudo rm -f /etc/cron.d/openclaw-boss # 或注释掉定时任务 sudo nano /etc/cron.d/openclaw-boss
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Static analysis
No suspicious patterns detected.