Agent Add

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:09 AM UTC
• Version: 1.4.2

Overview

The skill mostly creates OpenClaw agents as advertised, but it can copy private main-agent workspace files into a new agent without redaction or clear isolation controls.

Review this skill before installing if your main OpenClaw workspace may contain personal details, private instructions, tool configuration, secrets, or other context you would not want copied into a new agent workspace. Prefer a version that uses clean packaged templates, validates agent IDs in the script, and asks clearly before copying any existing workspace files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/agent-add.sh:85

Finding

Cross-Agent Disclosure Through Unsafe Main Workspace Template Copying

Content

View full analysis

"${WORKSPACE}/${f}" echo " 📝 ${f} ← 已创建空文件（main workspace 也没有）" fi done fi ``` ### Technical Analysis The script obtains the main agent's workspace path from the privileged OpenClaw configuration and copies complete workspace documents into the newly created agent's workspace. These documents are not necessarily clean templates. In particular: - `USER.md` can contain personal details, preferences, and user-specific context. - `TOOLS.md` can contain local integration details, host-specific configuration, or operational notes. - `AGENTS.md`, `SOU ...[truncated 1870 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/agent-add.sh:57

Finding

Agent ID Injection into Python Source and Regular-Expression Verification

Content

View full analysis

/dev/null | python3 -c " import sys, json data = json.load(sys.stdin) ids = [a.get('id','') for a in data] sys.exit(0 if '${AGENT_ID}' in ids else 1) " 2>/dev/null; then echo "" echo "✅ agent '${AGENT_ID}' 添加成功" else # 兼容文本模式检查 if openclaw agents list 2>/dev/null | grep -q "${AGENT_ID}"; then echo "" echo "✅ agent '${AGENT_ID}' 添加成功" else echo "" echo "⚠️ agent '${AGENT_ID}' 可能未添加成功，请手动检查" fi fi ``` ### Technical Analysis The Skill documentation says that an agent ID must contain lowercase letters, digits, and hyphens, but the script does not enforce that requirement. `AGENT_ID` is interpolated directly into the source string passed to `python3 -c`. A value containing a single quote, newline, or Python syntax can terminate the intended string literal and alter the generated Python program. If such a value reaches this block, Python expressions can execute with the operating-system privileges of the script. The fallback check passes the same value to `grep` as a basic regular expression rather than as a fixed string. Regular-expression metacharacters can therefore match unrelated output and produce a false-positive success result. The script executes `openclaw agents add` before reaching the vulnerable verification block and uses `set -e`. Exploitation of Python injection is therefore conditional on the preceding CLI accepting, normalizing, or otherwise not rejecting the malformed identifier. This reduces practical exploitability but does not make source-code interpolation safe. ### Attack Path 1. An attacker or untrusted automation invokes `agent-add.sh` and controls the `agentId` argument. 2. The caller supplies an identifier containing Python stri ...[truncated 1189 chars]

Remediation

View remediation

&2 exit 2 fi ``` 2. Pass the identifier as a separate Python argument instead of interpolating it into Python source: ```bash openclaw agents list --json 2>/dev/null | python3 -c ' import json import sys agent_id = sys.argv[1] data = json.load(sys.stdin) ids = [item.get("id", "") for item in data] raise SystemExit(0 if agent_id in ids else 1) ' "$AGENT_ID" ``` 3. Prefer structured JSON verification and remove the text fallback where possible. 4. If text fallback is unavoidable, use fixed-string matching rather than a regular expression: ```bash openclaw agents list 2>/dev/null | grep -Fq -- "$AGENT_ID" ``` 5. If output has one agent ID per line, use exact-line matching: ```bash grep -Fqx -- "$AGENT_ID" ``` 6. Add tests for quotes, newlines, backslashes, regular-expression metacharacters, leading hyphens, Unicode input, and excessively long identifiers. 7. Apply equivalent validation to workspace paths, model identifiers, and other externally supplied fields according to their documented formats. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---

name: agent-add
description: "按照 OpenClaw 官方规范创建新 agent（代理），自动完成问答、配置、workspace 初始化与记录。"
metadata:
  openclaw:
    emoji: 🤖
    requires:
      bins:
    - openclaw

---

# Agent Add — 新建 OpenClaw Agent

这是按照 OpenClaw 官方规范建立新 agent 的技能。全程遵循 `openclaw agents add` CLI 命令的标准化流程，确保新建 agent 后自动生成完整的 workspace 和一系列精炼的 `.md` 引导文档，让 AI 更好地配合人类工作。

> **⚠️ 副作用说明：** 此技能会执行以下磁盘写入操作，

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly mandates Chinese-only interaction ('严格分开问、一个一个问' in Chinese and all user-facing prompts are fixed in Chinese) without checking the user's language preference. This can override user intent and degrade transparency or usability, especially in multilingual environments, but it does not by itself create code execution or privilege escalation risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code automatically copies missing markdown files from the main workspace or creates placeholder files in the provided workspace, which modifies user data on disk. Although the script prints what it did after the fact, there is no confirmation prompt or prior warning at the point of execution that the workspace contents will be altered.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/agent-add.sh (reported line 118)May include surrounding context.

sh

AGENT_DIR_REL="agents/${AGENT_ID}"
ADD_TIME="$(date '+%Y-%m-%d %H:%M:%S %Z')"

mkdir -p "$HISTORY_DIR"

if [ ! -f "$HISTORY_FILE" ]; then
    echo "# Agent 添加记录\n" > "$HISTORY_FILE"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The heading "Agent 添加记录" is written in Chinese, indicating a language-specific presentation with no accompanying user choice or explanation. Under the policy rule, forcing a specific language without opt-in can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script's comments, usage guidance, and runtime output are all written in Chinese, which imposes a specific language on users without opt-in. Under the policy, forcing a locale or language without offering a choice can be a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.