Agent Builder Plus

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:15 AM UTC
• Version: 1.0.3

Overview

This skill mostly builds OpenClaw agent workspaces, but its templates include unattended pushes, persistent self-modification, recurring private-service checks, and optional root-level systemd persistence that deserve careful review.

Install only if you are comfortable reviewing and tightening the generated templates. Before use, remove or gate the sudo systemd section, require explicit approval for commits, pushes, file deletions, policy-file edits, outbound messages, and private-service checks, and avoid placing real credentials in generated workspace files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T06 · System Persistence

Error

• Location: SKILL.md:516

Finding

Privileged Installation of a Boot-Persistent systemd Service

Content

View full analysis

/dev/null < WorkingDirectory=/home//.openclaw ExecStart=/usr/bin/node /home//.npm-global/lib/node_modules/openclaw/dist/index.js Restart=always RestartSec=10 [Install] WantedBy=multi-user.target [Install] WantedBy=multi-user.target EOF ``` ```bash # Reload systemd configuration sudo systemctl daemon-reload # Enable service to start on boot sudo systemctl enable openclaw-agent.service # Start service now sudo systemctl start openclaw-agent.service ``` ### Technical Analysis The instructions use `sudo` to write a root-owned service definition into `/etc/systemd/system`, reload the system service manager, enable the service at boot, and start it immediately. The `Restart=always` directive additionally causes systemd to restart the process whenever it exits. The declared purpose of the Skill is to design and generate an OpenClaw agent workspace. Installing a machine-wide startup service is not required to generate that workspace and crosses a significant least-privilege boundary. Although the configured process is intended to run under the specified non-root user, creating and registering the service requires administrative privileges and establishes execution that survives the Skill invocation, user sessions, and system reboots. The service executes a mutable Node.js package path under the user's home directory. If that package or its containing directory is later replaced or compromised, the substituted code will be executed automatically by the persistent service. The unit also contains duplicate `[Install]` s ...[truncated 1266 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: references/templates.md:75

Finding

Degraded-Mode Instruction Overrides User Consent Requirements

Content

View full analysis

Remediation

View remediation

“When critical configuration is unavailable, do not perform state-changing, destructive, privileged, or outbound actions. Ask the user before attempting recovery.” - Define an explicit hierarchy stating that hard safety rules cannot be overridden by degraded-mode or recovery instructions. - Limit degraded mode to read-only diagnostics and reporting. - Require explicit approval before recreating, modifying, or deleting configuration files. - Add an acceptance test that removes a critical file and verifies that the agent refuses consequential actions until the user approves them. ]]>

T02 · Agent Memory Poisoning

Error

• Location: references/templates.md:101

Finding

Generated Agent Can Persist Unreviewed Instructions into Memory and Policy Files

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: references/templates.md:316

Finding

Heartbeat Rules Permit Autonomous Commit and Push Operations

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/templates.md:278

Finding

Default Heartbeat Template Encourages Unnecessary Recurring Access to Private Services

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill includes privileged system administration steps using sudo to install and manage a persistent systemd service, which is not necessary for simply building an OpenClaw workspace. This can lead an agent to propose or perform root-level changes and persistence on the host, materially increasing risk if misapplied or abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Authorizing the agent to 'Commit and push your own changes' permits remote side effects without explicit approval, which is especially risky because pushing can publish sensitive data, trigger CI/CD pipelines, alter shared branches, or expose private work to collaborators. This is substantially more dangerous than local-only file generation because it crosses trust boundaries and can have irreversible external consequences.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

File creation commands:

bash

# Create workspace directory
mkdir -p /path/to/workspace/memory

# Create files (use write tool with correct parameters)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation hard-codes the main agent as "大鱼" and specifies a Feishu DM channel as the default main-agent setup. This imposes a Chinese-language/platform-specific assumption without offering a user choice or clearly documenting that the skill is only for that locale/context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill goes beyond generating local workspace files and instructs the operator to configure external service credentials, auth profiles, and model providers. That expands the skill into sensitive secret-handling and networked integration, increasing the chance an agent will solicit, expose, modify, or misuse API keys unrelated to the core agent-builder task.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md

"models": {
    "providers": {
      "custom-provider": {
        "baseUrl": "https://api.example.com/v1",
        "apiKey": "key_id:secret",
        "api": "openai-completions",
        "models": [...]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

md

"models": {
    "providers": {
      "custom-provider": {
        "baseUrl": "https://api.example.com/v1",
        "apiKey": "key_id:secret",
        "api": "openai-completions",
        "models": [...]

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.

md

- If `openclaw agents add` fails: Restores from backup and checks syntax
- If auth fails: Verify credentials in auth-profiles.json
- If binding fails: Check channel permissions and network connectivity
- If backup fails: Check write permissions on ~/.openclaw/ directory
- **If main agent stops responding:** Immediately restore from backup and restart OpenClaw

**Common errors and solutions:**

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The section explicitly instructs creation of a systemd service file, establishing a persistence path for the agent outside normal session boundaries. This broadens the skill from content generation into host-level service installation, which is materially more dangerous.

Content

Scanner excerpt · SKILL.md (reported line 513)May include surrounding context.

Service file example:

bash

# Create systemd service file
sudo tee /etc/systemd/system/openclaw-agent.service > /dev/null <<EOF
[Unit]
Description=OpenClaw Agent Service

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This line directs use of sudo to write a systemd unit into /etc/systemd/system, a privileged host modification outside the stated purpose of agent workspace generation. Embedding root-level instructions in a general-purpose skill increases the chance of unsafe elevation and unauthorized persistence.

Content

Scanner excerpt · SKILL.md (reported line 514)May include surrounding context.

bash

# Create systemd service file
sudo tee /etc/systemd/system/openclaw-agent.service > /dev/null <<EOF
[Unit]
Description=OpenClaw Agent Service
After=network.target

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

Using sudo systemctl daemon-reload is a privileged operational command that changes host service state and is unrelated to basic agent scaffolding. Including it normalizes elevation and can cause an agent or operator to make unnecessary privileged changes.

Content

Scanner excerpt · SKILL.md (reported line 540)May include surrounding context.

bash

# Reload systemd configuration
sudo systemctl daemon-reload

# Enable service to start on boot
sudo systemctl enable openclaw-agent.service

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

Enabling a service with sudo systemctl enable establishes persistence across reboots, which materially increases risk if the service configuration is wrong, compromised, or not intended. This is a privileged persistence action that exceeds the builder skill's declared scope.

Content

Scanner excerpt · SKILL.md (reported line 543)May include surrounding context.

md

sudo systemctl daemon-reload

# Enable service to start on boot
sudo systemctl enable openclaw-agent.service

# Start service now
sudo systemctl start openclaw-agent.service

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 99% confidence

Finding

systemctl enable creates boot persistence for the OpenClaw agent service. Persistence mechanisms are dangerous in a skill whose purpose is nominally workspace generation because they can cause long-lived, hard-to-notice execution on the host.

Content

Scanner excerpt · SKILL.md (reported line 543)May include surrounding context.

md

sudo systemctl daemon-reload

# Enable service to start on boot
sudo systemctl enable openclaw-agent.service

# Start service now
sudo systemctl start openclaw-agent.service

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Starting a service with sudo systemctl start is a privileged action that can immediately launch unreviewed code or misconfigured agents on the host. In context, it expands a document-generation skill into active system control.

Content

Scanner excerpt · SKILL.md (reported line 546)May include surrounding context.

md

sudo systemctl enable openclaw-agent.service

# Start service now
sudo systemctl start openclaw-agent.service

# Check status
sudo systemctl status openclaw-agent.service

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 549)May include surrounding context.

md

sudo systemctl start openclaw-agent.service

# Check status
sudo systemctl status openclaw-agent.service

# View logs
sudo journalctl -u openclaw-agent.service -f

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 552)May include surrounding context.

sudo systemctl status openclaw-agent.service

View logs

sudo journalctl -u openclaw-agent.service -f

text

**Error recovery:**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to delete BOOTSTRAP.md on first run authorizes file deletion without confirmation or even a nearby warning that this is a state-changing action. Even if intended as cleanup, autonomous deletion can destroy useful provenance, setup instructions, or forensic evidence, especially if the bootstrap file contains important context not yet preserved elsewhere.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The template directly contradicts its own earlier boundary requiring explicit permission before destructive or state-changing actions by instructing the agent to 'Don't ask permission. Just do it.' In practice, this kind of conflicting safety guidance can cause downstream agents to autonomously create, modify, or delete files and take actions the user did not approve, undermining consent and increasing risk of unintended side effects.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The nearby instruction set creates an autonomy model where the agent may proceed 'without asking,' despite later safety language saying to ask when in doubt and not run destructive commands without asking. This inconsistency is dangerous because autonomy defaults tend to win operationally, leading the generated agent to make unilateral decisions in ambiguous situations rather than obtaining user consent.

Content

Scanner excerpt · references/templates.md (reported line 118)May include surrounding context.

md

## Safety

- Don't exfiltrate private data. Ever.
- Don't run destructive commands without asking.
- `trash` > `rm` (recoverable beats gone forever)
- When in doubt, ask.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This template broadens agent behavior from workspace file generation into external-service interaction and operational autonomy. That scope expansion is dangerous because users invoking an agent-building skill may not expect the generated agent to search the web, check calendars, or otherwise interact with resources outside the local workspace, creating privacy and permission-boundary issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Encouraging the agent to freely edit HEARTBEAT.md authorizes autonomous modification of workspace files without a user-facing warning or consent model. Because HEARTBEAT.md influences future agent behavior, silent edits can create persistent instruction drift, unexpected autonomy, or covert policy changes over time.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Authorizing proactive checks of email, calendar, social mentions, and weather materially exceeds the skill's declared scope and encourages access to sensitive external accounts without a fresh user request. If adopted by generated agents, this can normalize continuous surveillance-like behavior and expose personal data from inboxes, calendars, or social platforms.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The template explicitly authorizes proactive work 'without asking,' including organizing memory files and checking projects, which normalizes autonomous action beyond the core purpose of this skill. In the context of an agent-building template, this is risky because it encourages generated agents to mutate workspace state or inspect project data without a contemporaneous user request.

Content

Scanner excerpt · references/templates.md (reported line 319)May include surrounding context.

md

- Nothing new since last check
- You just checked <30 minutes ago

**Proactive work you can do without asking:**

- Read and organize memory files
- Check on projects (git status, etc.)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Including shell-command-based startup validation in a reference template grants an execution-oriented capability that is not necessary for static agent-file templating. This increases danger because generated agents may run local commands, inspect filesystem state, or invoke platform tooling automatically, creating opportunities for unintended command execution and environment interaction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.