Agent Health Optimizer

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:16 AM UTC
• Version: 1.4.0

Overview

This skill is a disclosed OpenClaw workspace audit toolkit with report-writing and optional cron fixes that match its stated purpose.

Install only if you are comfortable with the skill scanning your OpenClaw workspace, writing audit reports into memory/, querying ClawHub with installed skill names, and optionally editing cron jobs when you explicitly run --fix.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: If the implementation reaches out to clawhub.ai or performs other actions not cleanly disclosed through permissions and accurate behavior statements, the mismatch creates a transparency and trust problem. Users may expose local workspace data or permit execution under the assumption of a broader but harmless audit tool, while the actual feature set and access pattern are different.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: If the implementation reaches out to clawhub.ai or performs other actions not cleanly disclosed through permissions and accurate behavior statements, the mismatch creates a transparency and trust problem. Users may expose local workspace data or permit execution under the assumption of a broader but harmless audit tool, while the actual feature set and access pattern are different.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: If the implementation reaches out to clawhub.ai or performs other actions not cleanly disclosed through permissions and accurate behavior statements, the mismatch creates a transparency and trust problem. Users may expose local workspace data or permit execution under the assumption of a broader but harmless audit tool, while the actual feature set and access pattern are different.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: If the implementation reaches out to clawhub.ai or performs other actions not cleanly disclosed through permissions and accurate behavior statements, the mismatch creates a transparency and trust problem. Users may expose local workspace data or permit execution under the assumption of a broader but harmless audit tool, while the actual feature set and access pattern are different.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises and documents capabilities that read workspace files, write reports, invoke the openclaw CLI, and access the ClawHub API, but it declares no corresponding tool scope or permissions. Missing scope declarations weaken reviewability and policy enforcement, making it easier for users or orchestrators to authorize a skill without understanding its actual file, shell, and network reach.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_cmd(args, timeout=15):
    try:
        r = subprocess.run(args, capture_output=True, text=True, timeout=timeout)
        return r.stdout.strip(), r.returncode
    except Exception:
        return "", 1

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_cmd(args, timeout=15):
    try:
        r = subprocess.run(args, capture_output=True, text=True, timeout=timeout)
        return r.stdout.strip(), r.returncode
    except Exception:
        return "", 1

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script is presented as a scanner that scores and audits the workspace, but it also persistently writes health-score.json into the workspace. That hidden state change can affect downstream agent behavior, pollute memory-like directories, and violate user expectations for a read-only audit tool.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

args.extend(extra_args)
    
    try:
        result = subprocess.run(args, capture_output=True, text=True, timeout=240)
        return {
            "name": name,
            "output": result.stdout,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script sends installed skill slugs to a remote ClawHub API by requesting `/skills/{slug}` for each locally installed skill. This leaks local environment metadata without explicit user consent or disclosure, which can expose product usage, internal tooling choices, or sensitive capability names if custom/private skill slugs are present.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

],
        "covered_categories": sorted(covered_cats),
        "uncovered_categories": sorted(uncovered) if uncovered else [],
        "timestamp": __import__("datetime").datetime.now().isoformat()
    }
    report_path = ws / "memory" / "skill-comparator.json"
    report_path.parent.mkdir(parents=True, exist_ok=True)

• Confidence: 75% confidence
• Finding: Dynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Context-Inappropriate Capability

Low

• Confidence: 74% confidence
• Finding: The stated purpose is to scan a workspace and score agent health, but the implementation shells out to the `openclaw` executable to enumerate cron jobs. While cron auditing is part of the manifest, this file's own documentation does not disclose that it executes an external command rather than only inspecting workspace files.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The script silently writes a report file into the workspace, and the write occurs before the user can meaningfully consent at the decision point. In an agent workspace, even low-risk undisclosed persistence can create misleading artifacts, trigger automation, or accumulate sensitive operational metadata.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: This code creates the memory directory if needed and writes `memory-audit.json` into the workspace, which is a file-modifying operation. Although the tool's purpose is auditing, the module docstring and output messaging do not clearly disclose up front that it will persist a report to disk.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: This code reads each installed skill's SKILL.md file from the user's workspace, which is a file-access operation over user-local data. While the script prints general progress messages and its purpose implies comparison of installed skills, there is no explicit disclosure in code comments or nearby messaging that local skill metadata will be scanned from disk.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This code creates a memory directory and writes a JSON report containing installed-skill and catalog comparison results. Although it logs the saved path after writing, there is no prior warning in the docstring or before execution that the script will create or modify files in the workspace.

Static analysis

No suspicious patterns detected.