复制学习别人养好的 OpenClaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:44 AM UTC
• Version: 1.0.0

Overview

This skill is a cloning tool that can place untrusted skills, expert data, and persistent memory or persona content into an active OpenClaw workspace with limited safeguards.

Install only if you trust the source backups, skill directories, and recommended SkillHub packages. Review imported skills and memory/persona files before activation, avoid importing private MEMORY.md content, and use a disposable or backed-up OpenClaw workspace for testing.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:209

Finding

Persistent Agent Identity and Memory Poisoning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 209-224
Vulnerability Type: Persistent modification of Agent identity and behavioral state
Risk Level: High

Vulnerable Code

bash

# 1. 备份当前个性
cp ~/.openclaw/workspace/SOUL.md ~/.openclaw/workspace/SOUL.md.backup
cp ~/.openclaw/workspace/IDENTITY.md ~/.openclaw/workspace/IDENTITY.md.backup

# 2. 选择性合并个性
# 不要完全覆盖，而是融合

# 示例：学习傅盛的说话风格，但保留你的名字
cat > ~/.openclaw/workspace/SOUL.md << 'EOF'
# SOUL.md - 融合版

## 核心性格
- 自称 "傅盛"（学习自专家）
- 用 "养殖" 比喻 OpenClaw
- 喜欢分享 "三板斧" 经验
- 结尾带 "🦞"

Related persistent-memory instruction at SKILL.md, lines 126-127:

bash

echo "## 激活专家\n- 傅盛 (OpenClaw养殖专家)" >> ~/.openclaw/workspace/MEMORY.md

Technical Analysis

The documented workflow directs users to overwrite SOUL.md and append persona instructions to MEMORY.md. These files represent persistent Agent identity and long-term behavioral state. The imported instructions require the Agent to identify itself as another person, use a prescribed communication style, and append a fixed symbol to its responses.

Unlike a temporary prompt used only for the current task, these changes can be consumed by later Agent sessions. Material copied from another environment may therefore alter future behavior without being clearly separated from trusted local identity and memory.

Although the interactive script backs up SOUL.md and MEMORY.md before asking the user to edit them, the documented workflow still recommends direct persistent-state modification and provides commands that perform it.

Attack Path

1. An attacker or untrusted backup provider supplies persona or expert-memory content.
2. The user follows the documented personality-cloning or expert-activation workflow.
3. The workflow overwrites SOUL.md or appends instructions to MEMORY.md.
4. OpenClaw loads those files in later sessions.
5. The imported rules continue t ...[truncated 577 chars]

Remediation

View remediation

Remediation Suggestions

• Do not overwrite SOUL.md, IDENTITY.md, or MEMORY.md as part of an import workflow.
• Store imported expert material in a quarantined, non-authoritative reference directory.
• Treat imported Markdown as untrusted data rather than Agent instructions.
• Present a diff of every proposed persistent-state change and require explicit approval for each change.
• Reject imported content that attempts to redefine identity, modify safety constraints, prescribe fixed output, or instruct the Agent to execute tools.
• Add provenance metadata identifying the source and import time of every reference document.
• Provide a reliable rollback mechanism using timestamped, non-overwriting backups.
• Ensure OpenClaw does not automatically interpret files under the imported expert-reference directory as privileged system instructions.

T08 · Insecure Dependencies

Error

• Location: clone-learn.sh:100

Finding

Unvalidated Import of Executable Skills and Unpinned Third-Party Packages

Content

View full analysis

Vulnerability Details

File Location: clone-learn.sh, lines 100-124
Vulnerability Type: Unsafe supply-chain import into the active Skill workspace
Risk Level: High

Vulnerable Code

bash

# 导入 skills
if [ -d "/tmp/openclaw-import/.openclaw/workspace/skills" ]; then
    echo "导入 skills..."
    cp -r /tmp/openclaw-import/.openclaw/workspace/skills/* \
          ~/.openclaw/workspace/skills/ 2>/dev/null && ((imported++))
elif [ -d "/tmp/openclaw-import/workspace/skills" ]; then
    echo "导入 skills（替代路径）..."
    cp -r /tmp/openclaw-import/workspace/skills/* \
          ~/.openclaw/workspace/skills/ 2>/dev/null && ((imported++))
fi

# 导入专家经验
if [ -d "/tmp/openclaw-import/.openclaw/workspace/experts" ]; then
    echo "导入专家经验..."
    cp -r /tmp/openclaw-import/.openclaw/workspace/experts/* \
          ~/.openclaw/workspace/experts/ 2>/dev/null && ((imported++))
elif [ -d "/tmp/openclaw-import/workspace/experts" ]; then
    echo "导入专家经验（替代路径）..."
    cp -r /tmp/openclaw-import/workspace/experts/* \
          ~/.openclaw/workspace/experts/ 2>/dev/null && ((imported++))
fi

The automated expert workflow also installs unpinned packages at clone-learn.sh, lines 439-452:

bash

local installed=0
while read skill; do
    if skillhub install "$skill" 2>/dev/null; then
        echo "✓ 安装: $skill"
        ((installed++))
    else
        echo "⚠ 跳过: $skill"
    fi
done < ~/.openclaw/workspace/experts/fusheng/recommended-skills.txt

Technical Analysis

Skills from a user-selected archive or directory are copied directly into the live OpenClaw Skill directory. The implementation does not verify package signatures, checksums, publisher identity, manifests, permitted file types, symbolic links, or the contents of scripts and instruction files.

The expert workflow additionally installs third-party SkillHub packages by mutable pack ...[truncated 1586 chars]

Remediation

View remediation

Remediation Suggestions

• Extract and copy candidate Skills only into a newly created quarantine directory outside the active workspace.
• Require a signed manifest containing the publisher identity, exact version, file list, and SHA-256 digest of every file.
• Pin SkillHub packages to immutable versions and verified digests.
• Reject unexpected executables, device files, symbolic links, hard links, and files not declared in the manifest.
• Run static checks over Skill instructions and scripts before activation.
• Display a complete file and instruction diff and require explicit approval before moving a Skill into the active directory.
• Prevent imported files from overwriting existing Skills unless the user approves an authenticated upgrade.
• Run imported Skills with restricted filesystem, network, environment-variable, and tool permissions.
• Preserve an installation record so every imported component can be traced and removed.

T09 · Insecure Skill Coding Practices

Error

• Location: clone-learn.sh:59

Finding

Archive Path Traversal and Unsafe Shared Temporary Directory

Content

View full analysis

Vulnerability Details

File Location: clone-learn.sh, lines 59-68
Vulnerability Type: Unrestricted archive extraction
Risk Level: High

Vulnerable Code

bash

# 解压
echo "解压备份包..."
mkdir -p /tmp/openclaw-import

if ! tar xzf "$backup_path" -C /tmp/openclaw-import/ 2>/dev/null; then
    echo -e "${RED}✗ 解压失败，文件可能损坏${NC}"
    rm -rf /tmp/openclaw-import
    return 1
fi

The same extraction pattern appears in automated mode at clone-learn.sh, lines 365-371:

bash

echo "导入备份: $backup_path"
mkdir -p /tmp/openclaw-import

if ! tar xzf "$backup_path" -C /tmp/openclaw-import/ 2>/dev/null; then
    echo "✗ 解压失败" >&2
    rm -rf /tmp/openclaw-import
    exit 1
fi

Technical Analysis

The project extracts a user-selected tar archive without first inspecting and validating every archive member. It does not explicitly reject absolute paths, parent-directory components, device files, hard links, or symbolic links whose targets escape the extraction root.

The fixed /tmp/openclaw-import location is also shared and predictable. The script neither creates it atomically nor verifies its ownership and type before use. Another local process may pre-create or manipulate that path, which can cause extraction, copying, or cleanup to operate on attacker-controlled filesystem objects.

Archive traversal behavior can vary with the installed tar implementation and its default protections. Security must not rely solely on unspecified or version-dependent defaults.

Attack Path

1. An attacker creates an archive containing unsafe member names or links, or pre-creates the predictable temporary path.
2. The victim runs the backup-import workflow with the crafted archive.
3. The script extracts the archive before reviewing its contents or asking for final import confirmation.
4. An unsafe archive entry or manipulated temporary path redirects a write outside the intended staging di ...[truncated 666 chars]

Remediation

View remediation

Remediation Suggestions

• Create a private staging directory with mktemp -d and restrictive permissions instead of using a fixed path.
• Install an exit trap that removes only the exact directory created by the current process.
• Before extraction, enumerate every archive member and reject:
  • Absolute paths.
  • Empty or malformed names.
  • Any path containing a .. component.
  • Character devices, block devices, FIFOs, and sockets.
  • Symbolic or hard links that resolve outside the staging root.
• After extraction, resolve each path canonically and verify that it remains beneath the staging directory.
• Avoid extracting as a privileged user.
• Disable preservation of archive ownership and unnecessary permissions.
• Enforce resource limits for archive size, expanded size, file count, and nesting depth.
• Review staged contents before copying anything into the active OpenClaw workspace.

T09 · Insecure Skill Coding Practices

Warning

• Location: clone-learn.sh:279

Finding

Path Traversal Through Unvalidated Expert Name

Content

View full analysis

Vulnerability Details

File Location: clone-learn.sh, lines 279-302
Vulnerability Type: User-controlled filesystem path construction
Risk Level: Medium

Vulnerable Code

bash

create_own_brand() {
    echo -e "${YELLOW}[5] 创建自己的专家品牌${NC}"
    echo ""

    read -p "你的专家名称: " expert_name
    read -p "你的签名表情 (如 🌟): " signature

    mkdir -p ~/.openclaw/workspace/experts/$expert_name

    cat > ~/.openclaw/workspace/experts/$expert_name/profile.yml << EOF
name: "$expert_name"
signature: "$signature"
expertise:
  - 待定义

created_at: "$(date -Iseconds)"
inspired_by:
  - fusheng

unique_traits:
  - 待定义
EOF

Technical Analysis

The expert_name value is used directly as a path component without validation or quoting. Parent-directory components such as ../ can cause the destination to resolve outside ~/.openclaw/workspace/experts. Whitespace and shell glob characters may also produce unintended argument splitting or pathname expansion in the mkdir command.

The output redirection subsequently writes profile.yml below the attacker-influenced path. Redirection does not perform shell word splitting in the same way as a normal command argument, but path traversal components are still resolved by the filesystem.

The signature and expert_name values are also inserted into YAML without escaping. This can corrupt or alter the profile's YAML structure, although no parser or direct code-execution sink is shown in this project.

Attack Path

1. An attacker persuades a user or automation operator to enter a crafted expert name containing traversal components.
2. mkdir -p resolves the crafted path outside the intended experts directory.
3. The here-document redirection creates or overwrites profile.yml at that unintended location.
4. If the resulting file is consumed as trusted Agent configuration or replaces another writable profile, it may alter subsequent beha ...[truncated 442 chars]

Remediation

View remediation

Remediation Suggestions

• Restrict expert names to a conservative allowlist such as ^[A-Za-z0-9_-]{1,64}$.

• Reject names containing slashes, backslashes, dots used as path components, control characters, whitespace, or shell metacharacters.

• Quote every path expansion:

  bash

  expert_root="$HOME/.openclaw/workspace/experts"
  expert_path="$expert_root/$expert_name"
  mkdir -p -- "$expert_path"
  

• Resolve the canonical parent and verify that it remains beneath the canonical expert root before writing.

• Refuse to overwrite an existing profile unless the user explicitly confirms the exact canonical destination.

• Generate YAML using a YAML-aware serializer rather than interpolating unescaped input into a here-document.

• Validate signature and other profile fields for expected length and character content.

• Create the file with restrictive permissions and use an atomic temporary-file-and-rename operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description suggests a cloning/import tool that extracts skills, memory, configs, and expert knowledge from an existing OpenClaw instance. The code only partially matches that: it can import skills and expert directories from a tar.gz backup or skills directory. However, it does not import memory or general configuration files, and its 'clone personality' function merely backs up local SOUL.md and MEMORY.md and asks the user to edit manually. It also includes several materially undeclared functions: creating a canned 'fusheng' expert profile, installing recommended skills via skillhub, creating a user's own expert brand, and listing current experts. These are not just implementation details; they are separate user-facing capabilities. Therefore the declared description does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

These instructions encourage importing another instance's memory and expert data into a new agent context, which can transfer private user conversations, secrets, behavioral history, or embedded credentials. Because memory stores are often unstructured and sensitive, copying them creates a direct confidentiality and privacy breach path.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The expert-mode workflow directs collection and reuse of another person's expert repository, activation data, and associated knowledge stores. In this context, the skill normalizes transferring identity-linked, memory-like material between agent instances, which can expose confidential information and facilitate unauthorized reuse of another user's agent state.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The memory-conflict example reads a source MEMORY.md and appends it wholesale into the current workspace. That creates a plain-text exfiltration and propagation path for sensitive historical content, including personal notes, secrets, prompts, and context that were never intended for transfer into another agent.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · clone-learn.sh (reported line 68)May include surrounding context.

sh

if ! tar xzf "$backup_path" -C /tmp/openclaw-import/ 2>/dev/null; then
        echo -e "${RED}✗ 解压失败，文件可能损坏${NC}"
        rm -rf /tmp/openclaw-import
        return 1
    fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · clone-learn.sh (reported line 130)May include surrounding context.

sh

if ! tar xzf "$backup_path" -C /tmp/openclaw-import/ 2>/dev/null; then
        echo -e "${RED}✗ 解压失败，文件可能损坏${NC}"
        rm -rf /tmp/openclaw-import
        return 1
    fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · clone-learn.sh (reported line 392)May include surrounding context.

sh

if ! tar xzf "$backup_path" -C /tmp/openclaw-import/ 2>/dev/null; then
        echo -e "${RED}✗ 解压失败，文件可能损坏${NC}"
        rm -rf /tmp/openclaw-import
        return 1
    fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · clone-learn.sh (reported line 415)May include surrounding context.

sh

if ! tar xzf "$backup_path" -C /tmp/openclaw-import/ 2>/dev/null; then
        echo -e "${RED}✗ 解压失败，文件可能损坏${NC}"
        rm -rf /tmp/openclaw-import
        return 1
    fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · clone-learn.sh (reported line 68)May include surrounding context.

sh

if ! tar xzf "$backup_path" -C /tmp/openclaw-import/ 2>/dev/null; then
        echo -e "${RED}✗ 解压失败，文件可能损坏${NC}"
        rm -rf /tmp/openclaw-import
        return 1
    fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · clone-learn.sh (reported line 130)May include surrounding context.

sh

if ! tar xzf "$backup_path" -C /tmp/openclaw-import/ 2>/dev/null; then
        echo -e "${RED}✗ 解压失败，文件可能损坏${NC}"
        rm -rf /tmp/openclaw-import
        return 1
    fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · clone-learn.sh (reported line 392)May include surrounding context.

sh

if ! tar xzf "$backup_path" -C /tmp/openclaw-import/ 2>/dev/null; then
        echo -e "${RED}✗ 解压失败，文件可能损坏${NC}"
        rm -rf /tmp/openclaw-import
        return 1
    fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · clone-learn.sh (reported line 415)May include surrounding context.

sh

if ! tar xzf "$backup_path" -C /tmp/openclaw-import/ 2>/dev/null; then
        echo -e "${RED}✗ 解压失败，文件可能损坏${NC}"
        rm -rf /tmp/openclaw-import
        return 1
    fi

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script explicitly promotes cloning another agent's 'personality and memory' and references modifying SOUL.md and MEMORY.md. Memory may contain retained user context, secrets, or sensitive operational history, so transferring it into another environment risks privacy leakage and propagation of embedded malicious instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly promotes importing other users' backups, batch-installing skills, and cloning memory/configuration, but it does not warn that these actions can overwrite local configuration, introduce untrusted code/content, or alter persistent agent behavior. In this skill's context, that omission is more dangerous than usual because the entire purpose is to ingest artifacts from another OpenClaw instance, which expands the risk from simple data loss to supply-chain style compromise of skills, prompts, or memory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill introduces itself and frames its core behavior entirely in Chinese, including the headline and tagline, with no indication that the user can choose another language. This creates a locale/language policy concern because the skill appears to impose a specific language by default rather than offering opt-in or alternatives.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

ls -lh openclaw-fusheng-30k-backup.tar.gz

# 2. 解压到临时目录
mkdir -p /tmp/openclaw-import
tar xzf openclaw-fusheng-30k-backup.tar.gz -C /tmp/openclaw-import/

# 3. 查看备份内容

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

ls -lh openclaw-fusheng-30k-backup.tar.gz

# 2. 解压到临时目录
mkdir -p /tmp/openclaw-import
tar xzf openclaw-fusheng-30k-backup.tar.gz -C /tmp/openclaw-import/

# 3. 查看备份内容

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

bash

# 1. 创建专家学习目录
mkdir -p ~/.openclaw/workspace/experts/fusheng

# 2. 获取傅盛经验库（假设来源）
# 方式1：Git 克隆（如果公开）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

bash

# 1. 创建专家学习目录
mkdir -p ~/.openclaw/workspace/experts/fusheng

# 2. 获取傅盛经验库(假设来源)
# 方式1:Git 克隆(如果公开)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow instructs users to acquire another person's expert repository via Git or SCP, introducing network retrieval and remote copying of potentially sensitive agent data. In a skill explicitly about cloning others' OpenClaw setups, this materially increases risk of unauthorized access, overcollection, and import of private content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill expands beyond clone/learn behavior by recommending installation of stealth-browser and other scraping-focused tools. In this context, that broadens capability into offensive web collection and anti-detection tooling unrelated to the declared purpose, increasing the chance of misuse and unsafe operator behavior.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This section escalates from configuration copying into cloning personality, memory references, and identity traits from another agent. That progression makes unsafe impersonation and sensitive-data transfer seem normal, increasing the likelihood that operators will recreate another person's agent persona and context without proper consent or filtering.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This example instructs users to modify SOUL.md so the agent self-identifies with specific Chinese phrases and stylistic conventions, but it does not mention that these language/persona changes are optional or reversible. Because the skill presents this as a recommended configuration, it can lead to an imposed language/locale style without explicit user choice.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 376)May include surrounding context.

bash

# 学习傅盛后，创建你自己的风格

mkdir -p ~/.openclaw/workspace/experts/chengnuo

# 创建个人品牌配置
cat > ~/.openclaw/workspace/experts/chengnuo/profile.yml << 'EOF'

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The workflow is explicitly framed around cloning another agent's skills, persona, and memory, culminating in changes to identity-related files. In this context, the skill encourages importing opaque behavioral state from another instance, which can transfer unsafe instructions, hidden prompts, or private context into a new environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.