Security audit

role-configurator

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed OpenClaw role setup helper that writes a local SOUL.md configuration file, with caution needed around reviewing changes but no hidden or malicious behavior found.

Install only if you want this skill to help change your OpenClaw role configuration. Before confirming any generated template, review the SOUL.md content, keep or verify the backup if replacing an existing file, and treat mental health or financial templates as general support rather than professional advice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description centers on configuring an OpenClaw assistant role and offering preset role templates to help define role name, tasks, and capabilities. However, the supplied code does not implement role configuration behavior. Its primary function is to read recommendation data from a file and produce a list of recommended skills for a given template ID. While skill recommendations could be tangentially related to role setup, this code chunk’s direct purpose is materially different from a role configurator, so this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.
md
- `SKILL.md` - This file, usage instructions

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises one-click generation that auto-writes to SOUL.md without clearly warning users that a local file will be modified. This is dangerous because users may not understand that invoking the skill can persistently alter assistant configuration, and broad triggers make accidental entry into that flow more likely.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrase "Configure role" is very generic and can easily appear in normal conversation, increasing the chance of unintended skill activation. Because this skill can generate and write configuration to SOUL.md, accidental invocation could lead to unplanned changes to assistant behavior or local configuration.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The phrase "Give me a role template" is ambiguous and lacks product or skill scoping, so it may match routine user requests that are not intended to invoke this skill. In the context of a role-configuring skill, unintended activation could steer users into changing assistant role settings or accepting recommendations they did not request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: "Help me configure a personal assistant" is broad enough to overlap with ordinary assistant usage and may trigger the skill when the user simply wants general help. Since the skill is positioned as an initial configurator and can write configuration files, this raises the risk of confusing or unauthorized workflow changes.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises file read/write and environment-backed capabilities through its documented workflow and file structure, but declares no explicit tool scope or permissions boundaries. This creates an authorization ambiguity where an agent may perform local file modifications without a clear allowlist, increasing the risk of unintended writes or broader-than-expected access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documented activation scenarios are broad and poorly bounded, making it easier for the skill to engage during normal help-seeking interactions unrelated to configuration. Because the skill is positioned as an initial setup tool with write behavior, ambiguous activation can expose users to unintended modifications or misleading workflow transitions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The quick-trigger phrases are generic enough that ordinary conversation could invoke the skill unintentionally. In a skill that can lead to configuration changes and file writes, accidental activation raises the risk of unauthorized or confusing state changes, especially if downstream actions are automated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly promises to auto-write a configuration file but does not warn users that local files will be modified or require an explicit consent step. In the context of a setup skill, users may trust the workflow and inadvertently permit file changes they did not fully understand, which can alter assistant behavior or overwrite existing configuration.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger word lists include common phrases like 'Help me configure' and 'Give me a template,' which are likely to appear in unrelated conversations. This increases prompt-collision risk and can unexpectedly route users into a workflow that reads or writes configuration-related files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The mental health template positions the assistant as a 'supportive mental health companion' offering emotional support, stress management, mindfulness, and coping strategies, but provides no safety boundary, crisis escalation guidance, or disclaimer that it is not a licensed clinician. In a role-configurator skill, this text is likely to shape downstream assistant behavior, increasing the chance users rely on unqualified guidance during sensitive or crisis situations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The financial advisor template presents the assistant as a 'personal finance guide' covering budgeting, saving, investing, and debt management without clarifying that outputs are general educational information rather than personalized professional financial advice. Because this is a role template intended to configure assistant behavior, users may over-trust recommendations and act on unsuitable investment or debt guidance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The function overwrites the active SOUL.md configuration and only creates a backup automatically; it does not require explicit user confirmation before replacing an existing file. In a role-configuration skill, that can cause silent loss of the currently active assistant role or unintended configuration changes if the function is triggered with unexpected input or in the wrong workspace.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.