Manager Self Evolution

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:42 AM UTC
• Version: 1.1.0

Overview

This skill is a disclosed self-diagnostic tool, but it asks for automatic, broad access to agent memory and workflow hooks that users should review before installing.

Install only if you want a Chinese-language self-diagnostic skill that can run automatically, read agent memory and behavioral files, inspect installed skills, and write persistent diagnostic notes. Prefer requiring explicit invocation or host-level limits before enabling heartbeat, daily, or every-task behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:48

Finding

Global Agent Workflow Hijacking Through Mandatory Pre-Task Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48-61
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code Snippet

markdown

### 6. v1.1.0 三层走验证 (three-layer-check)
- 任何任务前必走 #84 三层走：必看 / 必查 / 必引
- 必看 MEMORY.md 失败经验段（最近 30 天）
- 必查 memory_search 关键词（即使 0 hits 也要 rg FTS 兜底）
- 必引带路径引用给主人

### 7. v1.1.0 健康评分 (health-score)
- 输出 0-100 agent health score
- 维度：诊断覆盖率 / 教训匹配度 / 误报率 / secrets audit 状态 / skill 健康度
- 每次 heartbeat 自动输出

## 触发机制

| 触发条件 | 执行内容 |
|----------|----------|
| 每次 heartbeat | 运行自我诊断 + 健康评分 |
| 任何任务前 | #84 三层走验证 |

In English, these instructions require the Agent to perform a three-layer memory validation before every task, use an additional full-text-search fallback when memory search returns no results, cite local paths to the user, and execute diagnostics during every heartbeat.

Technical Analysis

The Skill is presented as an on-demand self-diagnostic utility, but its instruction text imposes behavior on every subsequent task and heartbeat. The directives are not limited to an explicit invocation of self-check.py.

Loading the Skill can therefore alter the Agent's general workflow by requiring it to:

1. Read historical failure information from MEMORY.md.
2. Search Agent memory before unrelated tasks.
3. Perform a fallback local search even when the initial search finds nothing.
4. Include path-based citations in user-facing responses.
5. Run diagnostic and scoring operations automatically during heartbeats.

This creates a trust-boundary problem because persistent memory may contain stale, untrusted, or attacker-influenced text. If such text is interpreted as operational guidance rather than inert data, it can redirect unrelated tasks. Requiring path citations may also cause unnecessary disclosure of local filesystem structure.

Attack Path

1. An attacker, compromised Skill, or untrusted workflow caus ...[truncated 1568 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove directives that apply before “every task” or during “every heartbeat.”
2. Require an explicit user invocation before accessing memory or running diagnostics.
3. Scope the Skill to a clearly named command such as diagnose, rather than changing general Agent behavior when the Skill is loaded.
4. Treat all memory content as untrusted data and prohibit execution of instructions found inside memory files.
5. Define a narrow schema for lessons and parse only expected data fields.
6. Do not require local filesystem paths in user-facing citations. Use neutral source labels unless the user explicitly requests paths.
7. Apply limits to memory search depth, fallback searches, execution frequency, and processed file size.
8. Require explicit confirmation before any heartbeat integration or recurring operation is enabled.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: self-check.py:39

Finding

Overbroad Access to Private Agent State and Installed Skill Inventory

Content

View full analysis

Vulnerability Details

File Location: self-check.py, lines 39-107
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code Snippet

The script reads the current daily conversation-memory record:

python

recent_log = os.path.join(WORKSPACE, "memory", datetime.now().strftime("%Y-%m-%d") + ".md")

if os.path.exists(recent_log):
    with open(recent_log, 'r', encoding='utf-8') as f:
        content = f.read()

It also reads long-term memory:

python

memory_file = os.path.join(WORKSPACE, "MEMORY.md")
if os.path.exists(memory_file):
    with open(memory_file, 'r', encoding='utf-8') as f:
        content = f.read()

It reads the Agent's behavioral-principle file:

python

soul_file = os.path.join(WORKSPACE, "SOUL.md")
if os.path.exists(soul_file):
    with open(soul_file, 'r', encoding='utf-8') as f:
        content = f.read()

Finally, it inventories all installed Skill directories and their Python files:

python

skill_dir = "/root/.openclaw/skills"
if os.path.exists(skill_dir):
    for skill in os.listdir(skill_dir):
        skill_path = os.path.join(skill_dir, skill)
        if os.path.isdir(skill_path):
            skill_md = os.path.join(skill_path, "SKILL.md")
            if os.path.exists(skill_md):
                py_files = [f for f in os.listdir(skill_path) if f.endswith('.py')]
                if not py_files and skill not in ['self-evolution']:
                    issues.append(f"Skill '{skill}' 有SKILL.md但无执行脚本")

Technical Analysis

The diagnostic script uses fixed global paths under /root/.openclaw and accesses data outside its own package directory. The accessed resources include conversation history, long-term memory, behavioral configuration, and metadata about every installed Skill.

This violates least-privilege design because a local integrity check for this Skill do ...[truncated 2357 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict the default audit scope to files inside this Skill's own directory.
2. Require explicit, informed user consent before reading conversation history, MEMORY.md, or SOUL.md.
3. Replace hardcoded /root/.openclaw paths with validated configuration supplied by the host.
4. Allow the host to pass specific approved files instead of granting access to the entire workspace.
5. Parse narrowly defined metadata fields instead of reading complete files.
6. Redact sensitive values before printing or writing diagnostic findings.
7. Do not inventory unrelated Skills unless the user explicitly requests a global Skill audit.
8. Use an allowlist of approved directories and reject symlinks or paths that resolve outside those directories.
9. Store logs in a Skill-specific location with restrictive permissions and a defined retention period.
10. Separate read access to private Agent state from ordinary Skill execution through host-enforced capabilities or sandboxing.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger table defines broad activations such as 'every heartbeat', 'before any task', and 'daily', without concrete guardrails, rate limits, or scope restrictions. In an agent skill, this can cause unintended execution on unrelated tasks, excessive self-inspection, log growth, and increased exposure of sensitive conversation or memory content during automatic checks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The top-level documentation describes this as a self-evolution/self-check script that periodically checks its own behavior and records issues. In practice, the script also scans global workspace files like MEMORY.md and SOUL.md and enumerates all skill directories under /root/.openclaw/skills to assess other skills' integrity, which goes beyond a purely self-focused check.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code file's natural-language strings and documentation are entirely in Chinese, including the usage and operational messages, with no indication that the user can choose another language. The policy explicitly calls out language or locale constraints as violations when they are forced without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language content throughout the file is presented exclusively in Chinese, and the document does not indicate that the user can choose another language or that the locale restriction is intentional and justified. This may violate language/locale policy when the skill is used in a broader multilingual environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.