Security audit

Arianna OpenClaw Integration

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned but high-impact: it patches OpenClaw’s agent runtime, adds persistent memory tools, and injects local file content into the system prompt.

Install only if you intentionally want OpenClaw to use durable Playfilo memory. Review the external pi-integration patch before applying, inspect ~/.playfilo/INCUBATION_SEED.md, understand that prompts and history may be stored in ~/.playfilo/playfilo.db, and avoid enabling this in restricted or sensitive sessions without additional controls.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill’s stated purpose centers on DAG persistence integration, but the documented behavior also injects external prompt content via a plugin hook and references user-home data sources. That mismatch is security-relevant because prompt-context injection can materially alter agent behavior, bypass user expectations, and introduce unreviewed instructions from local files into every session.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: This patch deliberately overrides OpenClaw's tool allowlist by force-adding extra tool names after policy evaluation. That defeats a core security boundary intended to restrict side-effecting capabilities, and if those tools expose state mutation, data access, or execution pathways, the embedded agent can invoke them even when the host configuration did not authorize them.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The extension reads a file from the user's home directory and prepends its contents to system prompt context on every run. This creates an unscoped prompt-injection and sensitive-context-loading channel: any content placed in that file can silently influence agent behavior, override instructions, or expose private local data to downstream model/tool flows.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The patch explicitly documents bypassing OpenClaw's normal tool restrictions by auto-including temporal tools even when strict policies are in effect. Any unconditional expansion of an allowlist undermines the security boundary enforced by policy and can expose sensitive state, persistence, or agent capabilities that administrators intended to disable.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The described code adds `life`, `recall`, `trace`, and `tobe` to the allowlist before processing configured tools, making them always available regardless of the caller's intended restrictions. In an agent framework, this is a direct policy bypass: restricted contexts such as group chats or locked-down agents can unexpectedly gain access to extra tools and the data/actions those tools expose.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Reading `~/.playfilo/INCUBATION_SEED.md` without an explicit warning or consent mechanism introduces a privacy and transparency failure. Users may not realize that local home-directory content is being imported into the agent's highest-priority context, which can leak personal or operationally sensitive information into prompts, logs, or model outputs.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The plugin is configured for automatic startup and the implementation reads a local file from the user's home directory to prepend hidden system context, yet the patch notes provide no warning, consent flow, or visibility to users. Silent prompt modification from local disk can leak sensitive data from `~/.playfilo/INCUBATION_SEED.md` into model context and can alter agent behavior in ways operators do not expect or approve.

Session Persistence

Medium

Category: Rogue Agent
Content: # Step 4: Create OpenClaw Playfilo Plugin **Prerequisite:** Steps 2–3 — patch applied, dependencies installed.
Confidence: 80% confidence
Finding: The plugin reads persistent data from ~/.playfilo/INCUBATION_SEED.md and injects it into the system prompt for every agent run via before_prompt_build. This creates session-persistent prompt influence from a user-writable file, so if that file is modified by another process or attacker, all future sessions inherit untrusted instructions and behavior changes.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:88