add-openclaw-agent

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:11 AM UTC
• Version: 1.0.0

Overview

The skill appears purpose-aligned, but it creates persistent agents through shell commands without tight enough argument-safety instructions.

Install only if you are comfortable with a skill that can create persistent OpenClaw agents and write their operating rules. Review the final agent name, workspace path, optional flags, and exact IDENTITY.md/AGENTS.md content before allowing execution or file edits, and avoid storing secrets in those files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31
• Finding: Shell Command Injection Through Unvalidated CLI Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 31–56 **Vulnerability Type**: Command injection through unvalidated, user-influenced shell arguments **Risk Level**: Medium ### Vulnerable Code ```md Then pick an `agent-name` based on the purpose. Prefer short, stable ids like: - `beauty`, `coding`, `support`, `ops`, `research`, `personal` Notes: - OpenClaw normalizes names to an agent id (lowercase; invalid characters collapse to `-`). The id cannot be `main` (reserved). - Use the normalized id in the workspace directory: `~/.openclaw/workspace-<agent-id>`. ### 1. Create the agent with exec (non-interactive, JSON) Use the **exec** tool to run the OpenClaw CLI. Non-interactive creation **requires** `--workspace` and `--non-interactive`. Before creating, check whether it already exists: ```bash openclaw agents list --json ``` Before running creation, explicitly ask for confirmation, for example: - `I am ready to run: openclaw agents add <agent-name> --workspace ~/.openclaw/workspace-<agent-id> --non-interactive --json. Run it now?` Only execute the command after the user confirms. Create the agent: ```bash openclaw agents add <agent-name> --workspace ~/.openclaw/workspace-<agent-id> --non-interactive --json ``` Optional flags you can add when needed: - `--model <id>` – default model for this agent. - `--agent-dir <dir>` – agent state dir (default: `~/.openclaw/agents/<id>/agent`). - `--bind <channel[:accountId]>` – route a channel to this agent (repeatable). ``` ### Technical Analysis The Skill directs the agent to construct and execute a shell command using an agent name, normalized agent ID, model ID, directory, and channel binding that may originate from user input. It recommends simple names but does not impose a mandatory allowlist, reject shell metacharacters, require shell-safe quoting, or require an execution interface that passes arguments without invoking a shell. The statement that OpenClaw normalizes agent name ...[truncated 1995 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require the final normalized agent ID to match a strict allowlist such as: ```regex ^[a-z0-9][a-z0-9-]{0,62}$ ``` Explicitly reject the reserved ID `main`, leading hyphens, empty values, path separators, whitespace, control characters, and shell metacharacters. 2. Validate each optional parameter independently: - Permit only known or strictly formatted model identifiers. - Resolve `--agent-dir` and `--workspace` to approved base directories and reject path traversal. - Define an allowlisted grammar for channel and account identifiers used by `--bind`. 3. Use an execution API that accepts an executable and argument array without invoking a shell, conceptually: ```text executable: openclaw arguments: - agents - add - <validated-agent-name> - --workspace - <validated-workspace-path> - --non-interactive - --json ``` 4. If shell execution is unavoidable, apply robust platform-appropriate quoting to every dynamic argument after validation. Do not rely on manual interpolation or user confirmation as the primary defense. 5. Build the workspace path from the validated normalized ID rather than accepting an arbitrary path. Resolve the resulting path and verify that it remains beneath the intended OpenClaw workspace directory. 6. Update the Skill instructions to require displaying the validated executable and each argument separately before confirmation, and abort when validation fails. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: add-openclaw-agent
description: Create a new OpenClaw agent via exec (openclaw agents add) and configure its identity + operating rules by editing the new workspace files (IDENTITY.md, AGENTS.md). Use when the user wants a new agent and can describe what they want it to do; this skill asks for the purpose first, chooses an agent-name, runs the non-interactive CLI with --json, then writes the role/task instructions into the workspace.
---

# Add OpenClaw Agent

• Confidence: 84% confidence
• Finding: This skill creates a persistent new agent workspace and writes long-lived identity and operating rules into files, which establishes session-like state beyond the current interaction. If misused, sensitive instructions, unsafe policies, or user-derived content could persist and affect future actions by that agent without fresh review.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The example appended content at L089 is written in Chinese, and a second Chinese-only example appears later in the file. Because this skill is not documented as China-specific and does not explicitly make language selection optional, the natural-language guidance can steer agents toward a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The sample operating-rules section is entirely in Chinese, which can signal that generated agent instructions should default to that language. Under the policy, forcing or implying a specific language is a violation unless the skill offers explicit user choice or clearly documents a justified locale constraint.

Static analysis

No suspicious patterns detected.