Security audit

kb-search

Security checks for vulnerabilities and agentic risk

Overview

This skill searches a fixed local OpenClaw documentation folder and does not show evidence of network access, persistence, credential access, writes, or destructive behavior.

Install this if you want local OpenClaw documentation search. Before use, make sure the configured docs folder does not contain private notes or secrets, because matching snippets and file paths may be shown in the chat output.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill describes access to a local knowledge-base path under ~/.openclaw/workspace/docs.openclaw.ai/ and its core behavior implies reading files, but it declares no explicit tool scope or permissions. That mismatch can let an agent invoke broader file-read capability than users or the platform expect, weakening least-privilege controls and making unintended local file access harder to govern.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger condition '遇到报错时自动触发' ('automatically trigger when encountering an error') is overly broad and context-free, so the skill may activate on many unrelated failures and perform file searches without clear user intent. Broad automatic activation increases the chance of unnecessary data access, prompt-routing abuse, or accidental invocation loops when error text contains sensitive information.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The module docstring presents the skill description and usage entirely in Chinese, which indicates a fixed language expectation for interacting with the skill. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not documented here.