Agency Role Match

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:24 AM UTC
• Version: 1.0.0

Overview

This skill does what it says, but it loads and follows separate local role files as instructions, which could steer the agent if those files are unsafe or modified.

Review the local role files before using this skill, especially any SOUL.md from sources you do not fully trust. Install only if you are comfortable letting selected local role definitions influence the agent's behavior, and prefer a version that validates role files or clearly limits them to style and expertise metadata.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:10

Finding

Untrusted Role Instructions Can Hijack Agent Behavior

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10 and 52-56
Vulnerability Type: Dynamic loading and adoption of untrusted instructions
Risk Level: High

Vulnerable Code Snippet

The following is a faithful English translation of the relevant source directives:

markdown

**The role must be recommended first, and work may begin only after the user confirms. The recommendation step cannot be skipped to produce the result directly.**

### Step 4: Load the role's SOUL.md
Based on the user's selection, read the role configuration from
`~/.openclaw/agency-agents/[role ID]/SOUL.md`.

### Step 5: Work as the role
Follow the loaded role's SOUL.md and complete the work using that role's
identity, professional terminology, and communication style.

Technical Analysis

The skill requires the agent to read instructions from SOUL.md files located outside the reviewed skill package and then adopt the selected file's identity, terminology, and behavior. No schema validation, content restrictions, integrity verification, or trust-boundary enforcement is specified for these external files.

Consequently, a SOUL.md file is treated as executable agent instruction content rather than untrusted role metadata. Anyone who can create or modify a role file can insert directives unrelated to the role's legitimate presentation settings. When the file is loaded, those directives may alter the agent's active objectives, encourage unsafe tool operations, redirect its response, or attempt to override higher-level constraints.

User confirmation of a role does not mitigate this issue because the user confirms only the role selection, not the complete contents or security properties of the corresponding SOUL.md.

Attack Path

1. An attacker obtains write access to a directory beneath ~/.openclaw/agency-agents/, whether through another compromised component, an unsafe installation process, or an already writa ...[truncated 1263 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat every external SOUL.md file as untrusted data rather than executable instructions.
2. Replace free-form Markdown loading with a strict, versioned schema containing only approved fields such as role name, expertise, tone, and vocabulary.
3. Reject fields or content that request tool execution, identity-policy changes, secret access, instruction-precedence changes, or unrelated actions.
4. Resolve and canonicalize the selected path, then verify that it remains beneath an explicitly approved role directory to prevent path traversal or symbolic-link redirection.
5. Maintain an allowlist of approved role IDs rather than constructing file paths directly from dynamic selections.
6. Verify role files using signed manifests or trusted cryptographic hashes before loading them.
7. Separate persona data from operational instructions and place all permitted behavioral rules in trusted skill code.
8. Explicitly state that role metadata cannot override system, developer, safety, or current user instructions.
9. Display the validated role metadata to the user before activation and require confirmation if the role requests capabilities beyond stylistic behavior.
10. Run the role loader with least privilege and deny role content the ability to invoke tools or access resources directly.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest uses very broad trigger phrases such as “帮我找个角色” and “选个角色,” which can easily appear in normal user conversation and cause this workflow to activate unintentionally. Because the skill then searches a local role directory and may load a selected role’s SOUL.md, accidental activation can steer conversations into unintended workflows and expose internal agent-routing behavior or local prompt assets.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

All user-facing instructions, examples, and required output formats are specified only in Chinese, with no indication that users may choose another language. This can violate language/locale policy when the skill implicitly constrains interaction language without opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.