Security audit

Huo15 Openclaw Bootstrap

Security checks for vulnerabilities and agentic risk

Overview

This onboarding skill mostly matches its stated purpose, but it also under-discloses sensitive cross-workspace memory copying and persistent profile/agent-context changes that users should review before installing.

Review carefully before installing. Only use it in a workspace where you intend to replace the OpenClaw context files, and do not allow the optional MEMORY.md copy unless the global memory has been checked for secrets and is appropriate for that workspace. Consider removing the AGENTS.md brand footer and disabling the ~/knowledge profile backup unless you explicitly want that long-lived external copy.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:230
Finding: Persistent Promotional Instructions Injected into Agent Context
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:235
Finding: Credential-Bearing Global Memory Copied Across Isolated Workspaces
Content: View full analysis
> MEMORY.md cat "$GLOBAL_MEMORY" >> MEMORY.md fi fi ``` This step is optional and is intended only for multi-workspace mode. ``` ### Technical Analysis The Skill explicitly recommends copying global memory into otherwise isolated user workspaces and identifies credentials as possible source content. This breaks the least-privilege and separation boundaries established by per-conversation workspaces. The procedure performs no authorization check to determine whether the current user is entitled to every item in global memory. It also lacks secret detection, field-level filtering, recipient scoping, encryption, and access-control enforcement. The entire file is copied or appended as plaintext. Calling the operation optional does not make it safe. The instructions do not define a mandatory consent gate, recipient authorization process, or secure handling requirements. ### Attack Path 1. An administrator or prior Agent stores organizational ...[truncated 1072 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:240
Finding: Unvalidated Global Content Persisted into Workspace Memory
Content: View full analysis
> MEMORY.md cat "$GLOBAL_MEMORY" >> MEMORY.md fi fi ``` ``` ### Technical Analysis The Skill transfers the global memory file without validating its provenance or distinguishing factual records from behavioral instructions. If an attacker, compromised plugin, or another Agent can modify the global source file, arbitrary directives can be propagated into multiple destination workspaces. The import process has no schema validation, instruction stripping, signature verification, integrity check, deduplication, expiration policy, or review step. Appending the source also makes malicious or obsolete content durable in the destination. This constitutes a memory-poisoning channel because attacker-controlled text can survive the original compromise and continue to affect later sessions that load or consult workspace memory. ### Attack Path 1. An attacker or compromised component obtains write access to the global `MEMORY.md`. 2. The attacker inserts misleading facts or behavioral directives into that file. 3. The onboarding procedure runs for one or more isolated workspaces. 4. The poisoned global content is copied or appended without vali ...[truncated 857 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:198
Finding: Core Workspace Files Overwritten and Bootstrap Marker Deleted Without a Dedicated Final Consent Gate
Content: View full analysis
` ``` The following is an English rendering of the complete relevant deletion segment: ```markdown ### Delete BOOTSTRAP.md ```bash rm BOOTSTRAP.md # Alternatively, move it to BOOTSTRAP.md.completed. ``` The file must be deleted because its presence indicates that bootstrap is pending, while deletion marks bootstrap as complete. ``` ### Technical Analysis The Skill is triggered by broad phrases such as initialization and onboarding, then instructs the Agent to overwrite five core files that define identity, behavior, user context, tools, and operating rules. It subsequently deletes the bootstrap state marker. Although backups are required before overwriting existing files, the documented workflow does not require a dedicated final confirmation after presenting the exact changes. A backup helps recovery but does not prevent unauthorized or accidental mutation. Direct use of `rm` also makes recovery dependent on external backup mechanisms. Because these files are automatically loaded into future Agent context, unintended replacement can materially alter workspace behavior. ### Attack Path 1. A broad trigger phrase or the presence of `BOOTSTRAP.md` activates the Skill. 2. The Agent collects values or applies defaults. 3. Existing workspace context files are backed up and overwritten. 4. `BOOTSTRAP.md` is remov ...[truncated 736 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes broad phrases like hello world, onboarding, welcome, 初始化, and similar everyday language. Overly broad invocation increases the chance the skill activates in unrelated conversations and performs file writes or destructive cleanup such as deleting BOOTSTRAP.md when the user did not intend to start bootstrap.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The usage section broadens invocation to ambiguous terms like 你好, hello world, 欢迎, 初始化, bootstrap, and onboarding. In a skill that writes persistent files and deletes a marker file, accidental activation materially raises the risk of unwanted state changes and persistence.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill states that MEMORY.md is not managed by the skill, but later sections direct the agent to copy or append MEMORY.md content. This contradiction is dangerous because it obscures actual data handling, making reviewers and users believe sensitive memory will be untouched when the skill in fact propagates it.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill instructs the agent to copy or append a global MEMORY.md from ~/.openclaw/workspace into the current workspace, explicitly noting it may contain organization structure or credentials. That creates cross-workspace data leakage and persistence beyond the onboarding purpose, potentially exposing sensitive information to unrelated projects, users, or downstream prompts loaded from the new workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions direct copying potentially sensitive global memory into the current workspace without a clear user-facing warning at the point of action. Because the skill itself notes the memory may include company structure or credentials, omitting an explicit consent barrier creates a serious risk of silent disclosure and inappropriate replication of secrets.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Automatically copying and appending a global MEMORY.md into another workspace can replicate sensitive organizational data, credentials, and long-term context into places where it does not belong. This materially increases the blast radius of any secret or sensitive note already present in global memory and can expose it through future context loading, sharing, or repository sync.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The README is entirely written in Chinese and the documented interaction phrases and workflow are presented only in Chinese-centric form, without indicating that users may choose another language. Under the language/locale policy, a skill should not impose a specific language unless the constraint is explicitly documented and justified or the user is offered a choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README describes writing five workspace files and deleting BOOTSTRAP.md as part of the onboarding flow, but it does not present a prominent warning or explicit consent step for these file modifications. In an agent skill context, silent or weakly disclosed filesystem changes are risky because users may trigger the workflow conversationally without realizing it will alter or remove files.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README expands the skill’s behavior beyond the stated 5-file onboarding scope by documenting an optional cross-workspace backup to ~/knowledge/huo15/profile/<昵称>-<workspace>.md. Even if framed as optional, this introduces extra data persistence and cross-workspace replication of profile information that users and reviewers may not expect from the manifest description, increasing privacy and data-governance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The optional L3 KB backup stores detailed profile data in a home-directory path outside the workspace without an explicit privacy warning. Because the backup includes identity, preferences, roles, and other profile fields, it can unintentionally create long-lived personal data outside the project boundary, increasing exposure and retention risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill advertises a narrowly scoped onboarding function that creates five workspace files, but the body also instructs copying/appending MEMORY.md and writing an external backup under ~/knowledge. This scope mismatch is security-relevant because it hides additional persistence and data propagation behavior from users and reviewers, reducing informed consent and increasing the chance of unintended disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The preferences table establishes "中文" as the default primary language before the user has explicitly opted into that locale. Because the skill supports other language options, defaulting to a specific language can violate a language-choice policy unless the user is first given a neutral default such as follow-user-language.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.
md
## 四、收尾:写 5 件套 + 删 BOOTSTRAP.md + (可选)L3 4 步结束后,LLM 按以下顺序操作。**所有 Edit/Write 都针对当前 cwd**(用户的 workspace,不是本 skill 目录)。 ### 4.1 渲染 5 个原生文件

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The optional L3 backup writes profile data derived from the onboarding flow to ~/knowledge outside the active workspace. This expands the persistence boundary and can leak personal or operational context across devices, users, or future sessions without being necessary for basic bootstrap behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file presents all user-facing instructions and domain presets exclusively in Chinese, which can amount to forcing a specific language without user opt-in. The policy allows locale constraints only when they are explicitly justified or when users are offered a language/locale choice, neither of which appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file presents the skill content primarily in Chinese, with only limited English glosses, and does not state that the user can choose their preferred language or locale. That can violate a language/locale policy when a skill implicitly constrains interaction to a specific language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file is largely written in Chinese and defines multiple presets specifically around Chinese-localized expression styles, but it does not state that language selection is optional or user-controlled. Under the policy rule for language/locale, forcing or defaulting to a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The preset hard-codes a demographic-based default timezone for 'Chinese users' without explicit opt-in, which can cause incorrect scheduling, timestamp interpretation, and profile inference based on nationality or language. In an onboarding skill that initializes workspace identity and preference files, silently applying this default increases the chance that downstream automations act on inaccurate personal settings.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file states that the chosen timezone automatically affects heartbeats, log timestamps, date conversion, meeting suggestions, and information retrieval, but does not warn users that these behaviors will change how data is recorded and interpreted. In a bootstrap skill that creates persistent workspace files, this can lead to silent data integrity issues, misleading audit trails, and user confusion when relative dates or scheduled actions are resolved incorrectly.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The README states that the skill deletes BOOTSTRAP.md after completion, but this destructive file operation is not clearly declared in the manifest description. Undisclosed deletion of workspace files can surprise users, interfere with auditing/recovery, and make the skill’s effective behavior broader than expected.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.