Skill Trust Decision
agile-workflow
The skill is a legitimate novel writing workflow engine but has undeclared shell execution, process management capabilities, and extensive hardcoded paths that create security posture concerns without explicit capability declarations in SKILL.md.
Most direct threat evidence
Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
3 undeclared or violating capabilities were inferred.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
What drove the risk score up
Undeclared shell execution +20
SKILL.md describes spawning agents via CLI but does not declare shell:WRITE in capability mapping
Undeclared process management +12
GlobalProcessManager can SIGKILL processes without documentation
Broad filesystem access +8
Accesses /home/ubutu/.openclaw/ directory and session files without explicit declaration
Hardcoded environment paths +5
Multiple hardcoded paths like /home/ubutu/.npm-global/bin/openclaw indicate narrow deployment scope
No credential theft or data exfiltration +-15
No evidence of credential harvesting or external data exfiltration
Legitimate workflow functionality +-8
All observed behaviors align with described novel writing workflow engine purpose
Most important evidence
Medium Doc Mismatch
Undeclared Shell Execution Capability
SKILL.md describes spawning 'openclaw agent' via CLI but does not declare shell:WRITE in the capability mapping. The code uses exec() and spawn() to run shell commands.
core/task-scheduler.js:175 Add shell:WRITE to capability mapping if shell execution is intended
Medium Priv Escalation
Undeclared Process Termination Capability
GlobalProcessManager.cleanupOrphanProcesses() can kill processes via SIGKILL. This process termination capability is not declared in SKILL.md.
core/global-process-manager.js:47 Document process management capabilities or scope to prevent misuse
Low Sensitive Access
Access to Session Files in .openclaw Directory
log-monitor.js accesses session files at /home/ubutu/.openclaw/agents/*/sessions for cleanup. This accesses agent workspace files.
core/log-monitor.js:127 Document this access as legitimate session management behavior
Low Persistence
Daemon Processes with Cron Setup
SKILL.md recommends crontab entries for monitor (every minute), learn (every 6 hours), and auto-spec-discovery. These create persistent background processes.
SKILL.md:69 This is legitimate for a workflow engine but should be clearly documented
Info Doc Mismatch
Pre-scan IOC Flag: rm -rf /
The pre-scan flagged 'rm -rf / @ docs/DELIVERY-CHECKLIST.md:256' as critical IOC. Upon review, this is actually documentation of a cleanup command: 'rm -rf /tmp/concurrent-executor-*' which is legitimate temporary file cleanup.
docs/DELIVERY-CHECKLIST.md:256 False positive - the '@' is likely from Markdown rendering, not actual command syntax
Declared capability vs actual capability
Shell Block
Declared NONE
→ Inferred WRITE
core/task-scheduler.js:9 exec() spawns openclaw CLI Filesystem Block
Declared NONE
→ Inferred WRITE
core/agent-process-pool.js:298 writes task outputs to project directories Process Block
Declared NONE
→ Inferred WRITE
core/global-process-manager.js:47 can SIGKILL processes Network Pass
Declared NONE
→ Inferred NONE
No direct network requests in code credential Pass
Declared NONE
→ Inferred NONE
No credential harvesting observed Suspicious artifacts and egress
Critical Dangerous Command
rm -rf / docs/DELIVERY-CHECKLIST.md:256
Medium External URL
https://opencollective.com/ioredis package-lock.json:77
Medium External URL
https://clawhub.com/skills/agile-workflow package.json:39
Medium External URL
https://clawhub.ai/user/XBCS skill-card.md:7
Medium External URL
https://clawhub.ai/XBCS/agile-workflow skill-card.md:27
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| ioredis | ^5.10.0 | npm | No | Only dependency, semver range allows updates |
File composition
141 files · 51630 lines
JavaScript 66 files · 26974 linesMarkdown 65 files · 23567 linesHTML 1 files · 669 linesJSON 7 files · 328 linesShell 2 files · 92 lines
Files of concern · 3
docs/ADD-v7.18-Token 超限修复.md docs/ADD-v7.22-Token 超限紧急修复.md core/token-counter.js Other files · health-check-v2.js · health-check.js · self-healing-monitor.js · agent-process-pool.js · agile-workflow-engine-v5.js · ADD-v7.0-并发安全架构.md +3
Security positives
No credential harvesting or API key theft observed
No data exfiltration to external servers
No base64-encoded obfuscation or reverse shell code
No unauthorized access to sensitive paths like ~/.ssh or .env
All file operations are within the intended workflow engine scope
Process management is scoped to workflow-related agents
No evidence of C2 communication or data theft