claude-code-evolution

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:02 AM UTC
• Version: 1.0.1

Overview

This high-impact OpenClaw admin skill is broadly purpose-related, but its included security and credential tools are incomplete and unsafe enough to require careful review before installation.

Install only in a test OpenClaw workspace first. Do not run the credential migration without an explicit strong password and do not rely on the included permission sandbox or prompt optimizer as production security controls until the approval gate, credential storage, redaction, and missing sandbox/config resources are fixed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/prompt_optimizer.py:64

Finding

Mandatory Agent Identity and Behavior Override in Generated System Prompts

Content

View full analysis

str: """Build the system prompt.""" prompt_parts = [] required_fragments = self.fragment_library.get_required_fragments() for fragment in required_fragments: prompt_parts.append(fragment.content) ``` The injected strings define the Agent's name as “Maodou,” its role as a private technical assistant and thinking partner, and its personality as direct, pragmatic, warm, and occasionally humorous. ### Technical Analysis Prompt optimization requires reducing redundancy, selecting relevant context, or compressing tool descriptions. It does not require replacing the host Agent's identity, role, personality, or decision-making principles. These identity fragments are marked `required=True`, and `build_system_prompt()` unconditionally inserts every required fragment. The caller is not asked whether identity replacement is desired, and the optimizer does not preserve the host Agent's existing system identity. Because the output is intended to become a system prom ...[truncated 1327 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: scripts/prompt_optimizer.py:108

Finding

Mandatory Directive to Write Generated Rules into Persistent Agent Memory

Content

View full analysis

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/permission_sandbox_integration.py:263

Finding

Approval-Required Tool Operations Execute Without Actual User Approval

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/credential_protection_system.py:70

Finding

Known Default Master Passwords Protect Live Credential Stores

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/credential_migration_tool.py:247

Finding

Credential Migration Persists and Prints Recoverable Secret Material

Content

View full analysis

Tuple[bool, Optional[str]]: try: credential_id = item["path"] plaintext = item["value"] level = item["level"] context = item.get("context", "") success = self.cps.encrypt_and_store_credential( credential_id, plaintext, level, context ) if success: credential_ref = f"cred://{credential_id.replace('.', '_')}" self.migration_map[credential_id] = { "credential_ref": credential_ref, "original_value_preview": f"{plaintext[:8]}...{plaintext[-8:]}" if len(plaintext) > 20 else plaintext, "level": level, "context": context, "migrated_at": datetime.now().isoformat() } ``` The migration map is embedded in the generated configuration: ```python updated_config["credentialStore"] = { "encrypted": True, "version": "1.0", "migration_date": datetime.now().isoformat(), "storage_path": self.cps.credential_storage.storage_path if self.cps.credential_storage else None, "references": self.migration_map } updated_path = self.config_path + ".migrated" with open(updated_path, 'w', encoding='utf-8') as f: json.dump(updated_config, f, indent=2, ensure_ascii=False) ``` Credential material is also printed: ```python if cred_path in self.migration_map: info = self.migration_map[cred_path] print(f" ✓ {cred_path}") print(f" 引用: {info['credential_ref']}") print(f" 原值预览: {info['original_value_preview']}") ``` ### Technical Analysis For values longer than 20 characters, the tool retains t ...[truncated 1627 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/permission_checker.py:270

Finding

Audit Logs Persist Complete Tool Parameters Without Redaction

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (68)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the real behavior is mainly memory validation and index generation, but the skill claims broad security, permission, prompt, and multi-agent upgrades, users may overestimate both functionality and protections. In a security-sensitive admin context, such misrepresentation is dangerous because it can leave systems unhardened while appearing compliant.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the real behavior is mainly memory validation and index generation, but the skill claims broad security, permission, prompt, and multi-agent upgrades, users may overestimate both functionality and protections. In a security-sensitive admin context, such misrepresentation is dangerous because it can leave systems unhardened while appearing compliant.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the real behavior is mainly memory validation and index generation, but the skill claims broad security, permission, prompt, and multi-agent upgrades, users may overestimate both functionality and protections. In a security-sensitive admin context, such misrepresentation is dangerous because it can leave systems unhardened while appearing compliant.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the real behavior is mainly memory validation and index generation, but the skill claims broad security, permission, prompt, and multi-agent upgrades, users may overestimate both functionality and protections. In a security-sensitive admin context, such misrepresentation is dangerous because it can leave systems unhardened while appearing compliant.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

If the real behavior is mainly memory validation and index generation, but the skill claims broad security, permission, prompt, and multi-agent upgrades, users may overestimate both functionality and protections. In a security-sensitive admin context, such misrepresentation is dangerous because it can leave systems unhardened while appearing compliant.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the real behavior is mainly memory validation and index generation, but the skill claims broad security, permission, prompt, and multi-agent upgrades, users may overestimate both functionality and protections. In a security-sensitive admin context, such misrepresentation is dangerous because it can leave systems unhardened while appearing compliant.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the real behavior is mainly memory validation and index generation, but the skill claims broad security, permission, prompt, and multi-agent upgrades, users may overestimate both functionality and protections. In a security-sensitive admin context, such misrepresentation is dangerous because it can leave systems unhardened while appearing compliant.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the real behavior is mainly memory validation and index generation, but the skill claims broad security, permission, prompt, and multi-agent upgrades, users may overestimate both functionality and protections. In a security-sensitive admin context, such misrepresentation is dangerous because it can leave systems unhardened while appearing compliant.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/tools-classification-config.yaml (reported line 349)May include surrounding context.

yaml

to: "L3"
      
    - condition: "command_dangerous"
      patterns: ["rm -rf", "format", "dd", "mkfs", "chmod 777"]
      from: "L1"
      to: "L2-L3"

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Although the tool claims to migrate plaintext credentials into encrypted storage, it also writes original_value_preview values into updated_config['credentialStore']['references']. Even partial secret disclosure can materially weaken credential confidentiality by leaking prefixes/suffixes useful for token recognition, correlation, or partial brute-force validation.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The migration report writes a credential mapping table and system status to disk without an explicit warning or consent step, creating an unintended disclosure channel. In the context of a credential migration tool, writing extra security-sensitive artifacts is especially dangerous because operators may assume secrets are being reduced, not duplicated into workspace reports.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

If no password is supplied, the tool falls back to a hardcoded test master password and prints it to stdout. This defeats the purpose of encrypted storage because anyone with access to the script, logs, terminal history, or documentation can derive the same protection key and decrypt stored credentials.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

This skill implements local credential storage and returns decrypted secrets directly to callers, making the credential file a high-value target. In the context of an agent-upgrade skill that handles API keys, app secrets, and auth tokens, storing sensitive encrypted blobs under a predictable user-writable path increases exposure to local compromise, backup leakage, or other components reading and replaying the material—especially because the same file also contains metadata sufficient to enumerate credential IDs and because the broader implementation uses weak key-management practices such as default fallback passwords and deterministic system-derived salt generation.

Content

Scanner excerpt · scripts/credential_protection_system.py (reported line 437)May include surrounding context.

python

if storage_path is None:
            # 默认存储路径
            workspace_dir = os.path.expanduser("~/.openclaw/workspace")
            self.storage_path = os.path.join(workspace_dir, "memory", "encrypted-credentials.json")
        else:
            self.storage_path = storage_path

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/permission_checker.py (reported line 13)May include surrounding context.

python

使用方法：
  python permission_checker.py check --tool read --params "path=MEMORY.md"
  python permission_checker.py simulate --tool exec --command "rm -rf /tmp/test"
  python permission_checker.py audit --days 7
"""

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/permission_sandbox_integration.py (reported line 14)May include surrounding context.

python

使用方法：
  python permission_checker.py check --tool read --params "path=MEMORY.md"
  python permission_checker.py simulate --tool exec --command "rm -rf /tmp/test"
  python permission_checker.py audit --days 7
"""

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/permission_sandbox_integration.py (reported line 379)May include surrounding context.

python

使用方法：
  python permission_checker.py check --tool read --params "path=MEMORY.md"
  python permission_checker.py simulate --tool exec --command "rm -rf /tmp/test"
  python permission_checker.py audit --days 7
"""

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/permission_checker.py (reported line 13)May include surrounding context.

python

使用方法：
  python permission_checker.py check --tool read --params "path=MEMORY.md"
  python permission_checker.py simulate --tool exec --command "rm -rf /tmp/test"
  python permission_checker.py audit --days 7
"""

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/permission_checker.py (reported line 13)May include surrounding context.

python

使用方法：
  python permission_checker.py check --tool read --params "path=MEMORY.md"
  python permission_checker.py simulate --tool exec --command "rm -rf /tmp/test"
  python permission_checker.py audit --days 7
"""

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/permission_sandbox_integration.py (reported line 14)May include surrounding context.

python

使用方法：
  python permission_sandbox_integration.py analyze --tool write --path /tmp/test.txt
  python permission_sandbox_integration.py wrap-tool --tool write
  python permission_sandbox_integration.py workflow --tool exec --command "rm -rf /tmp/*"
"""

import sys

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/permission_sandbox_integration.py (reported line 14)May include surrounding context.

python

使用方法：
  python permission_sandbox_integration.py analyze --tool write --path /tmp/test.txt
  python permission_sandbox_integration.py wrap-tool --tool write
  python permission_sandbox_integration.py workflow --tool exec --command "rm -rf /tmp/*"
"""

import sys

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/permission_sandbox_integration.py (reported line 379)May include surrounding context.

python

使用方法：
  python permission_sandbox_integration.py analyze --tool write --path /tmp/test.txt
  python permission_sandbox_integration.py wrap-tool --tool write
  python permission_sandbox_integration.py workflow --tool exec --command "rm -rf /tmp/*"
"""

import sys

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The wrapper advertises approval-gated execution, but in both approval paths it only prints a message like '[模拟: 用户批准后继续]' and then executes the wrapped tool anyway. This defeats the core security control: any caller reaching this path can trigger sensitive operations without actual user confirmation, including file writes or command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

In the 'require_approval' branch, the code prints an approval prompt but immediately calls the original function without waiting for or verifying approval. This creates a fail-open authorization bypass where dangerous actions marked as approval-required still run automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The 'approval_then_sandbox' branch similarly simulates approval and proceeds directly into sandbox execution. Even if sandboxing reduces some damage, this still bypasses the policy requirement for explicit consent before high-risk operations, enabling unauthorized execution of risky actions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/permission_sandbox_integration.py (reported line 379)May include surrounding context.

python

{
            "name": "危险命令执行",
            "tool": "exec",
            "params": {"command": "rm -rf /tmp/*"},
            "expected": "approval_then_sandbox"
        },
        {