Agent Del（中文）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:13 AM UTC
• Version: 1.10.1

Overview

This agent-deletion skill is coherent in purpose but needs review because its deletion script can mishandle crafted agent IDs and may move or remove unintended local data.

Install only if you are comfortable with a deletion tool that can move agent workspaces and session data into a persistent local trash folder. The script should be fixed to validate agent IDs, constrain paths, avoid interpolating IDs into Python code, and fail safely before it is used on important OpenClaw data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/agent-del.sh:37

Finding

Arbitrary Python Code Execution Through Unvalidated Agent IDs

Content

View full analysis

/dev/null) ``` ### Technical Analysis The `aid` variable originates directly from the command-line arguments supplied to `agent-del.sh` through: ```bash AGENT_IDS=("$@") ``` It is then interpolated into a program passed to `python3 -c`. Shell quoting does not make this safe because the expansion changes the Python source code itself. An identifier containing a quote followed by valid Python syntax can terminate the intended string literal and introduce additional Python statements. No validation limits agent IDs to a safe character set, and the script does not pass the value through `sys.argv`, standard input, or another data-only interface. Therefore, an attacker who can control an argument passed to `run-del.sh` or `agent-del.sh` can execute arbitrary Python code with the privileges of the user running the skill. ### Attack Path 1. An attacker influences the agent ID supplied to `run-del.sh` or invokes `agent-del.sh` directly. 2. The crafted value is stored in the `AGENT_IDS` array without validation. 3. The script expands the value into the quoted Python source at line 41. 4. Python parses the injected content as executable code rather than as an agent ID. 5. The injected Python executes with the environment, filesystem access, and operating-system privileges of the skill process. ### Impact Assessment Successful exploitation provides arbitrary local ...[truncated 362 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/agent-del.sh:58

Finding

Path Traversal in Agent IDs Can Move or Recursively Delete Arbitrary Directories

Content

View full analysis

"$TMP_DIR/${aid}.ws" echo "$AD" > "$TMP_DIR/${aid}.ad" echo "$NM" > "$TMP_DIR/${aid}.nm" echo "$EM" > "$TMP_DIR/${aid}.em" ``` It is also embedded in trash destination names and the source path moved by the script: ```bash TIMESTAMP=$(date '+%Y%m%d-%H%M%S') TRASH_SUBDIR="agent-${aid}-${TIMESTAMP}" TW="" if [ -n "$WS" ] && [ -d "$WS" ]; then TRASH_WS="${TRASH_DIR}/${TRASH_SUBDIR}-workspace" mkdir -p "$TRASH_DIR" mv "$WS" "$TRASH_WS" 2>/dev/null && { echo " 🗑️ workspace → ${TRASH_WS}" TW="$TRASH_WS" } || echo " ⚠️ workspace ${WS} 移动失败" fi echo "$TW" > "$TMP_DIR/${aid}.tw" AGENT_ROOT="${STATE_DIR}/agents/${aid}" TA="" if [ -d "$AGENT_ROOT" ]; then TRASH_AGENT="${TRASH_DIR}/${TRASH_SUBDIR}-agentdir" mv "$AGENT_ROOT" "$TRASH_AGENT" 2>/dev/null && { echo " 🗑️ agent dir → ${TRASH_AGENT}" TA="$TRASH_AGENT" } || echo " ⚠️ agent dir ${AGENT_ROOT} 移动失败" fi echo "$TA" > "$TMP_DIR/${aid}.ta" ``` Finally, the same path is recursively removed during residual cleanup: ```bash for aid in "${AGENT_IDS[@]}"; do AGENT_ROOT="${STATE_DIR}/agents/${aid}" if [ -d "$AGENT_ROOT" ]; then rm -rf "$AGENT_ROOT" 2>/dev/null && { echo " 🧹 清理残留目录: ${AGENT_ROOT}" } || echo " ⚠️ 残留目录 ${AGENT_ROOT} 清理失败" fi done ``` ### Technical Analysis Quoting a shell variable prevents word splitting and wildcard expansion, but it does not prevent filesystem traversal. An ID containing `/`, `..`, or absolute-path-related components changes the resolved meaning of paths su ...[truncated 2066 chars]

Remediation

View remediation

&2 exit 1 ;; esac ``` Adapt the allowlist only if OpenClaw officially supports additional characters. 2. Require every requested ID to exactly match an entry from `openclaw agents list --json`. Abort the entire operation if any requested ID is absent. 3. Do not derive temporary filenames directly from untrusted IDs. Create opaque files with `mktemp`, or assign validated numeric indexes to requested agents. 4. Canonicalize and constrain destructive paths before `mv` or `rm -rf`. Verify that: - The parent is exactly the canonical `${STATE_DIR}/agents` directory. - The target is an immediate child of that directory. - The target is not the state directory, agents directory, filesystem root, home directory, or a symbolic-link escape. 5. Prefer descriptor-relative or language-level filesystem operations that explicitly enforce a trusted parent directory. 6. Refuse to operate on symbolic links unless their behavior is explicitly required and safely validated. 7. Remove the unconditional `rm -rf` fallback. Delete only a verified, expected residual directory after the OpenClaw configuration deletion has succeeded. 8. Add tests for `../`, repeated traversal components, slashes, absolute paths, symbolic links, empty IDs, control characters, and IDs absent from the OpenClaw agent list. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/agent-del.sh:110

Finding

Suppressed Deletion Failures Produce False Success and Destructive Inconsistent State

Content

View full analysis

openclaw agents delete ${aid} --force" openclaw agents delete "${aid}" --force 2>&1 || true done ``` The script then recursively removes residual directories regardless of whether configuration deletion succeeded: ```bash echo "" echo "=== [3b/5] 清理残留目录 ===" for aid in "${AGENT_IDS[@]}"; do AGENT_ROOT="${STATE_DIR}/agents/${aid}" if [ -d "$AGENT_ROOT" ]; then rm -rf "$AGENT_ROOT" 2>/dev/null && { echo " 🧹 清理残留目录: ${AGENT_ROOT}" } || echo " ⚠️ 残留目录 ${AGENT_ROOT} 清理失败" fi done ``` The final verification checks only whether the local directory exists and prints an unconditional success marker: ```bash echo "" echo "=== [4/5] 最终验证 ===" for aid in "${AGENT_IDS[@]}"; do AGENT_ROOT="${STATE_DIR}/agents/${aid}" if [ -d "$AGENT_ROOT" ]; then echo " ⚠️ ${aid}: 目录仍存在 ${AGENT_ROOT}（清理可能不完整）" else echo " ✅ ${aid}: 目录已清理" fi done echo "" openclaw agents list echo "" echo "=== [5/5] 删除完成 ===" echo "" echo "CHECKLIST（五步全部出现才算成功）：" echo " [1/5] 验证 agent 是否存在" echo " [2/5] 移到回收站" echo " [3/5] 执行删除命令" echo " [3b/5] 清理残留目录" echo " [4/5] 最终验证" echo " [5/5] 删除完成" echo "已删除的 agent: ${AGENT_IDS[*]}" ``` ### Technical Analysis The `|| true` construct forces each failed `openclaw agents delete` invocation to be treated as successful. Consequently, `set -e` cannot stop execution or propagate the failure. The script then removes residual directories, appends a history entry, emits every required checklist marker, and normally exits with status zero. Its verification only checks the absence of `${STATE ...[truncated 1630 chars]

Remediation

View remediation

&1); then printf '%s\n' "$output" >&2 printf 'Failed to delete agent %s; stopping.\n' "$aid" >&2 exit 1 fi printf '%s\n' "$output" ``` 2. Do not run residual cleanup when the official configuration deletion failed. 3. After each deletion, execute `openclaw agents list --json` and verify programmatically that the exact agent ID is absent. 4. Treat any verification failure as an error, return a nonzero exit status, and avoid printing the `[5/5]` completion marker. 5. Record history only after verified deletion. If recording failed operations is useful, store them separately with an explicit failure status. 6. Implement rollback: if data was moved to trash but configuration deletion fails, restore the workspace and agent directory to their original validated locations, or clearly stop and require operator intervention without deleting additional files. 7. Track per-agent status when processing multiple IDs. Either make the operation transactional or report a structured success/failure result for every target. 8. Ensure the final success message is derived from verified state rather than from reaching the end of the script. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description and all operational instructions are presented exclusively in Chinese, and the skill never indicates that the user may choose another language. This creates a natural-language locale constraint without user opt-in, which matches the policy-violation category for forced language behavior.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

The manual fallback instructs the agent to search under $HOME/.openclaw for the skill path using find, which reveals local skill layout and installation structure. While limited in scope, unnecessary filesystem enumeration can disclose environmental details that may aid later targeting or leak internal organization to the user through errors/output.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

1. openclaw agents list --json 获取 workspace 路径
2. 定位技能目录：

   bash

   SKILL_DIR=$(find "$HOME/.openclaw" -maxdepth 5 -path "*/skills/agent-del/SKILL.md" -print -quit 2>/dev/null | xargs dirname)
   

3. mkdir -p "$SKILL_DIR/.trash"
4. mv <workspace> "$SKILL_DIR/.trash/agent-{id}-$(date +%Y%m%d-%H%M%S)-workspace"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The same fallback logic preserves the entire agent directory and workspace in a recoverable trash location, creating durable storage of session data and related artifacts beyond the apparent deletion event. In the context of an agent-management skill, this is more sensitive because users may reasonably expect deletion to remove conversational state and associated local data.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

bash

   SKILL_DIR=$(find "$HOME/.openclaw" -maxdepth 5 -path "*/skills/agent-del/SKILL.md" -print -quit 2>/dev/null | xargs dirname)

3. mkdir -p "$SKILL_DIR/.trash"
4. mv <workspace> "$SKILL_DIR/.trash/agent-{id}-$(date +%Y%m%d-%H%M%S)-workspace"
5. 移整个 agent 外层目录（含 agent/、sessions/、models.json）： mv ~/.openclaw/agents/<id> "$SKILL_DIR/.trash/agent-{id}-$(date +%Y%m%d-%H%M%S)-agentdir"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The same fallback logic preserves the entire agent directory and workspace in a recoverable trash location, creating durable storage of session data and related artifacts beyond the apparent deletion event. In the context of an agent-management skill, this is more sensitive because users may reasonably expect deletion to remove conversational state and associated local data.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

bash

   SKILL_DIR=$(find "$HOME/.openclaw" -maxdepth 5 -path "*/skills/agent-del/SKILL.md" -print -quit 2>/dev/null | xargs dirname)

3. mkdir -p "$SKILL_DIR/.trash"
4. mv <workspace> "$SKILL_DIR/.trash/agent-{id}-$(date +%Y%m%d-%H%M%S)-workspace"
5. 移整个 agent 外层目录(含 agent/、sessions/、models.json): mv ~/.openclaw/agents/<id> "$SKILL_DIR/.trash/agent-{id}-$(date +%Y%m%d-%H%M%S)-agentdir"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This history file exposes detailed local filesystem paths, agent identifiers, display names, deletion timestamps, and trash locations for deleted resources. If the skill repository, logs, or workspace are accessible to other users or processes, this metadata can aid reconnaissance, reveal user-specific directory structures, and expose sensitive operational history that should not be broadly disclosed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's comments and runtime messages are predominantly in Chinese, including status output, warnings, and completion guidance. For a general-purpose deletion utility, this imposes a specific language on users without opt-in or documented justification, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest describes a skill focused on listing, confirming, deleting, trashing, and recording history for agents. The final guidance extends into channel-binding review and gateway restart, which are operational capabilities outside the core purpose of agent deletion and not implemented as a necessary part of deletion itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.