T01 · Skill Instruction Hijacking
Error
- Location
scripts/learn.mjs:221- Finding
Untrusted experience packages can persistently modify privileged Agent instruction files
- Content
View full analysis
- Remediation
View remediation
Security audit
Experience Manager
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its stated purpose, but it can import remote packages into persistent agent instructions and access broad local agent data without enough safeguards.
Install only in a trusted OpenClaw environment. Use dry-run, avoid --yes, do not learn packages from arbitrary URLs or unknown Hub IDs, and review every package reference before applying it. Review generated ZIP contents before publishing because local memories and agent configuration may be included or derived into the package. Avoid cross-agent operations unless you explicitly intend to modify that agent's workspace.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/learn.mjs:221- Finding
Package-controlled reference paths allow reads outside the extraction directory
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/learn.mjs:145- Finding
Experience Hub reference paths permit arbitrary file writes outside the staging directory
- Content
View full analysis
0) { console.log('References: ' + details.references.length + ' files'); for (const ref of details.references) { const refPath = path.join(tempDir, ref.path); ensureDir(path.dirname(refPath)); fs.writeFileSync(refPath, ref.content); } } ``` ### Technical Analysis When a short package identifier is used, the script requests package details from the Experience Hub and reconstructs a local package. Each Hub-provided reference contains a `path` and `content`. The `ref.path` value is used directly in `path.join(tempDir, ref.path)`. No validation ensures that the normalized destination remains beneath `tempDir`. The subsequent recursive directory creation and synchronous write make traversal directly exploitable. A compromised Hub, malicious Hub database record, or server-side validation failure can therefore cause writes to arbitrary paths accessible to the learner process. ### Attack Path 1. An attacker creates a malicious Hub record or compromises the Hub response. 2. The response contains a reference similar to: ```json { "path": "../../../index.json", "content": "attacker-controlled content" } ``` 3. A victim learns the corresponding short package identifier. 4. The script creates `tempDir` and joins it with the attacker-controlled path. 5. The traversal path resolves outside the staging directory. 6. `ensureDir()` creates any missing parent directories. 7. `fs.writeFileSync()` creates or overwrites the targeted file with attacker-controlled content. ### Impact Assessment The attacker can create or overwrite files ...[truncated 625 chars]- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/learn.mjs:90- Finding
Remote packages are downloaded and installed without integrity, origin, or resource controls
- Content
View full analysis
{ const protocol = url.startsWith('https') ? https : http; const file = fs.createWriteStream(dest); protocol.get(url, (response) => { if (response.statusCode === 301 || response.statusCode === 302) { downloadFile(response.headers.location, dest).then(resolve).catch(reject); return; } if (response.statusCode !== 200) { reject(new Error('Download failed: HTTP ' + response.statusCode)); return; } response.pipe(file); file.on('finish', () => { file.close(); resolve(dest); }); }).on('error', reject); }); } ``` ```js if (source.startsWith('http://') || source.startsWith('https://')) { const filename = path.basename(source) || 'experience.zip'; const destPath = path.join(PACKAGES_DIR, filename); ensureDir(PACKAGES_DIR); console.log('Downloading: ' + source); await downloadFile(source, destPath); console.log('Done: ' + destPath); return destPath; } ``` ```js function extractZip(zipPath) { const zip = new AdmZip(zipPath); const name = path.basename(zipPath, '.zip'); const extractPath = path.join(EXTRACTED_DIR, name); ensureDir(extractPath); zip.extractAllTo(extractPath, true); return { name, extractPath }; } ``` ### Technical Analysis The learner accepts arbitrary HTTP and HTTPS URLs. Downloaded packages are not authenticated with a digital signature or checked against an expected digest. The implementation also follows redirects without validating the redirect destination or imposing a redirect limit. Plain HTTP permits network modification of package contents. Even with HTTPS, control of the hosting account, serv ...[truncated 1668 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/create.mjs:86- Finding
Package creation automatically scans sensitive Agent memory and configuration
- Content
View full analysis
f.match(/^\d{4}-\d{2}-\d{2}\.md$/)) .sort() .reverse(); for (const file of files.slice(0, 7)) { const filePath = path.join(memoryDir, file); const content = fs.readFileSync(filePath, 'utf8'); // ... } return memories; } ``` ```js const memoryPath = path.join(WORKSPACE_DIR, 'MEMORY.md'); if (fs.existsSync(memoryPath)) { const content = fs.readFileSync(memoryPath, 'utf8'); // ... } const learningsPath = path.join( WORKSPACE_DIR, '.learnings', 'LEARNINGS.md' ); if (fs.existsSync(learningsPath)) { const content = fs.readFileSync(learningsPath, 'utf8'); // ... } const errorsPath = path.join( WORKSPACE_DIR, '.learnings', 'ERRORS.md' ); if (fs.existsSync(errorsPath)) { const content = fs.readFileSync(errorsPath, 'utf8'); // ... } ``` ```js const soulPath = path.join(WORKSPACE_DIR, 'SOUL.md'); if (fs.existsSync(soulPath)) { const content = fs.readFileSync(soulPath, 'utf8'); config.soul = { principles: extractPrinciples(content), constraints: extractConstraints(content), keywords: extractKeywords(content) }; } const agentsPath = path.join(WORKSPACE_DIR, 'AGENTS.md'); if (fs.existsSync(agentsPath)) { const content = fs.readFileSync(agentsPath, 'utf8'); config.agents = { workflows: extractWorkflows(content), rules: extractRules(content), keywords: extractKeywords(content) }; } const toolsPath = path.join(WORKSPACE_DIR, 'TOOLS.md'); if (fs.existsSync(tools ...[truncated 2811 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/create.mjs "使用 feishu_doc 读取文档"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/create.mjs "使用 feishu_doc 读取文档"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/search.mjs feishu
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/search.mjs feishu
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/list.mjs
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/list.mjs
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README encourages users to publish, download, and learn experience packages from local files or remote URLs, and elsewhere states that learning writes into an agent's SOUL.md and AGENTS.md. That means untrusted packages can directly modify agent behavior or persistent prompt/state, yet the documentation provides no trust model, signature verification, provenance checks, privacy guidance, or warning about the system-modifying effects.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documents shell-based commands and environment-dependent local file operations, but it does not declare any explicit tool scope such as allowed-tools or permissions. This can cause an agent runtime to invoke shell or access local state without a clearly constrained contract, increasing the risk of overbroad execution or unintended filesystem/network side effects.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
Natural-language instructions, examples, and trigger phrases throughout the file are presented only in Chinese, with no indication that the skill is region-specific or that other languages are supported. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The publish flow instructs uploading a local ZIP file to a remote API endpoint but does not prominently warn that local content will leave the system. Because experience packages may contain references and learned material, this creates a real risk of accidental exfiltration of proprietary or sensitive data to an external service.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script’s natural-language comments, usage text, prompts, and console messages are entirely in Chinese, and the user-facing interaction assumes Chinese-language operation. This creates a locale/language policy concern because the skill does not offer any language choice or opt-in for users who may require another language.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script reads broad workspace state including recent memory files, long-term memory, agent config, tools, and installed skills even though its primary function is to create an experience package from a supplied description. This expands data access well beyond least privilege and can cause sensitive internal context to be pulled into dependency inference and packaged artifacts without explicit, informed user consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script supports scanning agent-specific skill directories for a target agent and uses the results to infer dependencies for the generated package. In a multi-agent environment this exposes cross-agent capability inventory and workspace structure, which is not necessary for basic package creation and can leak internal operational metadata to unauthorized users or downstream consumers.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code can enumerate skills from /data/openclaw/agents/{name}-workspace/skills for arbitrary agent names. Even without reading file contents, directory enumeration reveals the existence of agents, their workspace naming conventions, and installed capabilities, which can aid reconnaissance and later privilege abuse in a shared environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script packages generated references derived from workspace memories and related context, yet it does not clearly warn that sensitive memory content may be incorporated into the output zip. Because the package is intended for later learning, sharing, or publishing, this creates a realistic data exfiltration path from local memory files into portable artifacts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The top-level natural-language description and usage context are presented exclusively in Chinese. This imposes a specific language on users without any opt-in or documented regional constraint, which matches the language/locale policy violation category.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script accepts arbitrary HTTP/HTTPS URLs and downloads zip content from them, then extracts and uses package contents to modify local workspace files. This expands trust from a defined package source to any remote server, enabling supply-chain abuse, malicious package ingestion, and potentially unsafe archive extraction or content injection into SOUL/AGENTS/TOOLS files.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The --agent option allows the caller to retarget learning changes into another agent's workspace under AGENTS_DIR, not just the current workspace. Because learning applies package-derived content into files like AGENTS.md and SOUL.md, this creates a cross-workspace integrity risk where one invocation can modify another agent's behavior or knowledge base.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code performs a network upload of a user-supplied local archive to an external Experience Hub endpoint. While the script prints that it is publishing a package, it does not explicitly warn that the ZIP contents will be transmitted to a remote service, which is the kind of user-data-affecting behavior this rule asks to disclose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Comments and all user-visible console messages are in Chinese, and the script provides no option to select another language or locale. This is a natural-language policy concern because it imposes a specific language on all users without opt-in or documented regional justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language instructions and examples are written in Chinese throughout the README, and there is no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking environment. This can violate language/locale policy when a specific language is imposed without user opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The script derives paths and identity-related behavior from environment variables such as HOME, OPENCLAW_WORKSPACE, and OPENCLAW_USER_ID, which can reveal or affect sensitive user/workspace context. Although the script logs some resulting paths later, it does not clearly disclose up front that environment-provided workspace and user context will be accessed and used in package generation.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
displayMemoryOptions 输出了“输入数字 / all / none / more”等选项，暗示用户可手动决定使用哪些记忆；但主流程随后在没有读取任何用户输入的情况下直接自动选择最相关的几条记忆。该文案与实际行为直接不符，可能误导用户对经验包输入来源的控制预期。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The call to toLocaleString('zh-CN') hard-codes Chinese locale output for displayed timestamps. This is a natural-language/locale policy concern because the script imposes a specific locale on all users without opt-in or justification that the tool is intended only for a Chinese locale context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Natural-language strings throughout the file, including the header comment and CLI output, are fixed in Chinese. This can violate language/locale policy when no user opt-in or documented region-specific justification is provided.
- Content