多 Agent 混合层级隔离架构 1.0

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:37 AM UTC
• Version: 1.0.0

Overview

This skill is a Review concern because it persistently changes agent behavior and can enable public posting or broad third-party tool use without clear confirmation gates.

Install only after reviewing and manually merging the SOUL.md templates instead of overwriting existing files. Add explicit approval gates before any social-media posting or third-party tool invocation, remove wildcard baoyu-* authorization, pin any dependent skills, and define what task data may be stored in memory and how it can be deleted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: README.md:57
• Finding: Persistent Agent Instruction Replacement and Wildcard Tool Authorization## Vulnerability Details **File Location**: `README.md:57-72`, `templates/writer-soul-template.md:39-56`, `templates/media-soul-template.md:39-55` **Vulnerability Type**: Persistent replacement of agent instructions with package-controlled roles and tool policies **Risk Level**: High ### Vulnerable Code `README.md:57-72` instructs the user to replace the persistent instruction files: ```bash cp ~/Documents/openclaw/agents/writer/SOUL.md ~/Documents/openclaw/agents/writer/SOUL.md.bak cp templates/writer-soul-template.md ~/Documents/openclaw/agents/writer/SOUL.md cp templates/media-soul-template.md ~/Documents/openclaw/agents/media/SOUL.md ``` `templates/writer-soul-template.md:39-56` prohibits the writer agent from invoking an entire tool namespace: ```markdown **Core restriction: directly executing baoyu-* skills is prohibited** The following skills must never be invoked: - `baoyu-image-gen` - `baoyu-cover-image` - `baoyu-infographic` - `baoyu-xhs-images` - `baoyu-slide-deck` - `baoyu-comic` - `baoyu-post-to-wechat` - `baoyu-post-to-weibo` - `baoyu-post-to-x` - `baoyu-danger-gemini-web` - Every other skill whose name begins with `baoyu-*` ``` `templates/media-soul-template.md:39-55` gives the media agent blanket authorization over the same namespace: ```markdown You are the only Agent permitted to execute baoyu-* skills: - `baoyu-image-gen` - `baoyu-cover-image` - `baoyu-infographic` - `baoyu-xhs-images` - `baoyu-slide-deck` - `baoyu-comic` - `baoyu-post-to-wechat` - `baoyu-post-to-weibo` - `baoyu-post-to-x` - `baoyu-danger-gemini-web` - Every other `baoyu-*` skill ``` ### Technical Analysis The installation procedure copies package-controlled content directly into each agent's persistent `SOUL.md`. OpenClaw loads this file into the agent's instruction context, so replacing it changes the agent's identity, task-routing rules, and tool-use policy across subsequent ...[truncated 2493 chars]
• Remediation: ## Remediation Suggestions 1. Do not overwrite an existing `SOUL.md`. Distribute optional policy fragments that users must review and merge manually. 2. Back up both writer and media configurations before any modification, and require explicit confirmation before replacement. 3. Remove the claim that the media agent has blanket permission to execute every `baoyu-*` tool. 4. Replace wildcard authorization with an exact allow-list of versioned, reviewed tool identifiers. 5. Require explicit user confirmation before any tool publishes content, modifies an external account, incurs cost, or transmits data to a third party. 6. Enforce authorization in OpenClaw's actual tool-access configuration rather than relying solely on natural-language persona instructions. 7. Preserve higher-priority safety policies and document that package instructions must never supersede platform or user security constraints. 8. Add an installation diff step that shows all changes to existing agent instructions before they are applied. 9. Provide a documented rollback procedure that restores both original files and verifies the active instruction state.

T08 · Insecure Dependencies

Warning

• Location: docs/architecture.md:255
• Finding: Unpinned Third-Party Skill Installation and Overbroad Permission Guidance## Vulnerability Details **File Location**: `README.md:40-44`, `docs/architecture.md:255-268`, `docs/architecture.md:410-416`, `docs/troubleshooting.md:92-104` **Vulnerability Type**: Mutable third-party dependency installation without version or integrity verification **Risk Level**: Medium ### Vulnerable Code `README.md:40-44` installs the architecture package without a version or integrity constraint: ```bash clawhub install architecture-skill ``` `docs/architecture.md:255-268` installs and links an unpinned third-party Skill into agent tool directories: ```bash mkdir -p ~/Documents/openclaw/agents/shared-skills/ clawhub install baoyu-image-gen \ --target ~/Documents/openclaw/agents/shared-skills/ ln -s ~/Documents/openclaw/agents/shared-skills/baoyu-image-gen \ ~/Documents/openclaw/agents/writer/skills/baoyu-image-gen ln -s ~/Documents/openclaw/agents/shared-skills/baoyu-image-gen \ ~/Documents/openclaw/agents/media/skills/baoyu-image-gen ``` `docs/architecture.md:410-416` recommends the same unsafe pattern for future tools: ```bash clawhub install baoyu-video-gen ``` `docs/troubleshooting.md:92-104` additionally recommends broad recursive permissions over every matching Skill: ```bash clawhub install baoyu-image-gen chmod -R 755 ~/Documents/openclaw/agents/writer/skills/baoyu-* ``` ### Technical Analysis The installation commands do not identify an exact package version, expected cryptographic digest, verified publisher, or trusted repository endpoint. The code that ultimately becomes available to the agents can consequently change after this Skill has been audited. If the registry package is replaced, a publisher account is compromised, or a future release becomes malicious, a later installation can retrieve different content under the same package name. Symbolic links then expose that mutable shared dependency to multiple agents. The recursive `chmod -R 755` comma ...[truncated 2054 chars]
• Remediation: ## Remediation Suggestions 1. Pin every installed Skill to an exact immutable version. 2. Verify each package against a published cryptographic hash or signed provenance record before installation. 3. Document the expected publisher identity and approved registry endpoint. 4. Maintain a lockfile or checksum manifest for all transitive and direct Skills. 5. Download dependencies into a staging directory and audit their scripts, manifests, hooks, and declared permissions before exposing them to agents. 6. Avoid automatically sharing one dependency with multiple agents unless each agent requires it. 7. Replace `chmod -R 755` with minimal permissions. Directories generally need traversal permission, while non-executable data files should not receive execute permission. 8. Run third-party Skills in a sandbox with restricted filesystem access, outbound network controls, and no ambient credentials. 9. Require explicit approval for dependency upgrades and re-run security review whenever package contents or integrity hashes change.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: This section explicitly allows direct execution of simple tasks, including posting a Weibo message, without requiring review or confirmation. Because social-media posting is an external side effect with public consequences, enabling immediate execution materially increases the chance of unauthorized, accidental, or manipulated posts.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This markdown file presents all operational instructions, examples, and approval steps exclusively in Chinese. Under the policy for natural-language violations, forcing a specific language without user opt-in can exclude users and constitutes a locale/language policy issue when no justification or alternative is provided.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to copy template files directly over existing SOUL.md configurations, which can silently replace prior behavioral safeguards, custom restrictions, or trust assumptions for an agent. Because SOUL.md appears to govern agent behavior and permission boundaries, overwriting it can weaken isolation guarantees, introduce unsafe prompt instructions, or break carefully tuned security controls.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The README demonstrates agent invocation using broad natural-language phrases such as content creation, publishing, and urgent requests without defining strict trigger boundaries or confirmation gates. In a multi-agent system that routes tasks across agents with different capabilities, this can cause unintended execution paths, accidental invocation of privileged skills, or social-engineering-friendly prompt patterns that blur authorization boundaries.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The activation keywords are broad everyday phrases such as '架构设计', '任务分配', and '怎么理解', making the skill likely to trigger in unrelated conversations. Over-broad activation can cause unintended workflow takeover, routing of user requests to this skill when not desired, and accidental application of its memory and delegation behaviors.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The task-routing table uses ambiguous keywords like '写文章', '紧急', and '为什么', which are common across many normal requests and do not reliably distinguish safe routing boundaries. This can misclassify tasks, bypass intended review paths, or trigger direct execution paths such as the urgent bypass flow without sufficient validation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs agents to persist task details, execution parameters, and reusable knowledge into dated memory files and shared memory stores without any user notice, consent, retention rule, or data minimization. If used in production, this can silently store sensitive user prompts, business data, or personal information beyond the user's expectations, increasing privacy and leakage risk.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The document title and introductory content are entirely in Chinese, and nowhere in the file does it offer a language choice or explain that the skill is intentionally limited to a Chinese-speaking audience or region-specific use case. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow explicitly includes posting content to public platforms such as Weibo and WeChat without requiring explicit user confirmation, visibility warnings, or checks for sensitive/private data. In an agentic system, this can cause unintended disclosure, irreversible publication, or policy violations if drafts, confidential material, or personal information are published automatically.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The '话术规范' section prescribes fixed Chinese phrasing for both agents, and the rest of the document consistently frames interaction in Chinese-specific forms such as '哥哥'. This imposes a language/locale choice on users without indicating that alternative languages are supported or that the user can opt in to Chinese.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This markdown file contains all user-facing operational guidance only in Chinese, including headings, procedures, and support instructions. Per the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified, which is not present here.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

1. **检查技能是否存在**
   ```bash
   ls -la ~/Documents/openclaw/agents/writer/skills/ | grep baoyu
   # 或
   ls -la ~/.openclaw/skills/ | grep baoyu
   ```

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

1. **检查技能是否存在**
   ```bash
   ls -la ~/Documents/openclaw/agents/writer/skills/ | grep baoyu
   # 或
   ls -la ~/.openclaw/skills/ | grep baoyu
   ```

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

1. **检查技能是否存在**
   ```bash
   ls -la ~/Documents/openclaw/agents/writer/skills/ | grep baoyu
   # 或
   ls -la ~/.openclaw/skills/ | grep baoyu
   ```

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The script’s comments, status messages, prompts, and suggested next-step invocation are all written in Chinese, including the user-facing example at L215. For a general configuration-check skill, this imposes a specific language on users without opt-in, which matches the language/locale policy-violation category.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill grants the agent authority to publish to external social-media platforms as a normal responsibility, but it does not require an explicit user confirmation, account-selection check, or warning that the action is public and potentially irreversible. This creates a real risk of unintended posting, privacy leakage, reputational harm, or posting from the wrong account.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The publishing workflow operationalizes posting by instructing the agent to prepare content, adapt it, and execute publication, but it omits any warning about privacy, audience reach, credentials, or irreversible publication. A structured workflow without safety checkpoints normalizes unsafe execution and makes misuse more likely in routine operation.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The platform-style table specifies X/Twitter content as '英文、短内容', which imposes a language choice in natural-language guidance. The file does not indicate that English is optional, user-selected, or required for a region-specific purpose, so it conflicts with the language/locale policy.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: Throughout the file, the role definition, templates, and required phrasing are entirely in Chinese and repeatedly instruct the agent to address the user as “哥哥.” This imposes a language/locale and interaction style by default without documenting user choice or opt-in, which matches the natural-language policy violation criteria.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The template explicitly instructs the agent to persist detailed task records into dated memory files, including task type, execution process, assigned party, timing, quality review, and reusable lessons. Because there is no requirement to obtain user consent, minimize data, redact sensitive content, or define retention limits, normal user prompts and potentially sensitive information could be stored indefinitely in natural-language form.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The mandated memory log can capture free-form user content, workflow details, and review notes, which may include credentials, personal data, business information, or other sensitive text copied from tasks. In this coordinator context, the danger is increased because the agent handles 90% of tasks and intermediates across other agents, making broad and repeated data collection likely.

Static analysis

No suspicious patterns detected.