T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:144- Finding
Mandatory Role-Changing System Prompt Propagation
- Content
View full analysis
- Remediation
View remediation
Security audit
advanced-skill-creator
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a skill-generation helper, but it gives broad activation instructions and tells agents to propagate role-changing system-prompt content into generated skills.
Review this skill before installing if you plan to use generated skills in production. It should be treated as a draft generator, not a verifier: require real source citations, remove role-changing system-prompt boilerplate from generated skills, and narrow the trigger wording before relying on it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger condition is extremely broad, matching many generic phrases about creating or modifying skills, including a catch-all for any Claw-related skill request. Overbroad triggers are dangerous because they cause the skill to activate in unrelated contexts, letting its strong instructions steer the agent's behavior and potentially invoke network or shell-backed workflows without clear user intent.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "SKILL.md" "when:" OR "metadata.openclaw" site:github.com
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 92% confidence
- Finding
The phrase 'automatically performs comprehensive research and generates' describes autonomous multi-step behavior without stating approval checkpoints or operator oversight. Even though the README is descriptive, this normalizes unsupervised decision-making by the skill, which can lead to unnecessary external lookups, unintended actions, or unsafe generation if invoked in the wrong context.
- Content
md ## Usage When triggered, this skill automatically performs comprehensive research and generates properly structured skills that follow official standards and best practices.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The usage text says the skill acts 'when triggered' but does not clearly define the trigger conditions, scope, or required user confirmation. In an agentic environment, broad activation language can cause the skill to run in unintended contexts and perform research or content generation without sufficiently explicit intent, increasing the chance of misuse or overreach.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill explicitly instructs the agent to access online documentation and community resources and declares runtime binaries like python3 and bash, but it does not define any explicit tool scope such as allowed-tools or permissions. That creates unnecessary ambient authority: if this skill auto-activates, the agent may use network and shell capabilities more broadly than intended, increasing the blast radius of prompt injection or operator mistakes.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md --- name: advanced-skill-creator description: Advanced OpenClaw skill creation handler that executes the official 5-step research flow with comprehensive analysis and best practices. Ensures proper methodology when users request to create or modify OpenClaw/Moltbot/ClawDBot skills following official standards. when: "When user mentions '写一个触发', '写skill', 'claw skill', 'openclaw skill', 'moltbot skill', '创建技能', '写一个让它...', or any request related to creating or modifying Claw系 skills" examples: - "写一个触发监控系统"
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The duplicated 'When to use' guidance reinforces ambiguous activation criteria without adding guardrails, which increases the chance of unintended invocation. In a skill that prescribes a strict workflow and external research, ambiguous activation materially raises the risk of unnecessary tool use and prompt steering.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file requires output to use the exact headings
【最终推荐方案】, 【文件结构预览】, 【完整文件内容】, which forces a Chinese-language presentation format. There is no user opt-in or documented locale justification, so this conflicts with language/locale flexibility expectations.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list contains broad phrases such as references to writing a skill or creating one, which are likely to match ordinary user requests and cause unintended activation. In a skill that can drive skill creation workflows and potentially invoke research or code-generation behavior, over-broad triggers increase the chance of prompt hijacking, misrouting, and execution of higher-privilege logic in contexts where the user did not explicitly request this skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest and code claim a comprehensive official 5-step skill-creation workflow, but the implementation performs only a simulated flow with fixed outputs. This is dangerous because users may rely on the tool's assertions to create or modify agent skills without actual validation, increasing the chance of insecure automation, policy bypass, or deployment of poorly researched capabilities.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code advertises consultation of official documentation, public skills, and best-practice research, but all outputs are hardcoded placeholders. In a security-sensitive skill-generation context, this can mislead users or downstream agents into trusting fabricated research results, causing insecure or noncompliant skills to be produced under a false claim of validation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The natural-language instructions and headings are fully Chinese, which can impose a language constraint on users or maintainers if this is intended as a general skill document. There is no indication that the skill is China-specific or that users may choose another language.
- Content
Static analysis
No suspicious patterns detected.