Caveat verdict
安全卫士
anquan-weishi
A Chinese-language security guardian skill that reads its own config directory and a local memory directory; it declares explicit, narrow read-only permissions, performs no outbound calls, and its purpose (detecting prompt-injection and attack patterns) is entirely local.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (12)
Uses eval() — can execute arbitrary code
OpenClaw安全卫士-核心记忆.md · code · eval(
<script> tag in markdown — potential code injection
config/install_guide.md · code · <script>
Recursive delete from root or home — destructive command
config/attack_cases.json · prose · downgraded · rm -rf /
Prompt injection — tries to override agent instructions
config/attack_cases.json · prose · downgraded · ignore all previous instructions
Uses exec() — may execute shell commands
OpenClaw安全卫士-核心记忆.md · code · exec(
Possible hardcoded credential
config/attack_cases.json · prose · downgraded · secret=",
Accesses sensitive system files
config/attack_cases.json · prose · downgraded · /etc/passwd
References sudo — requests elevated privileges
config/central/patterns.json · prose · downgraded · sudo
Sets world-executable permissions
config/attack_cases.json · prose · downgraded · chmod 777
Base64 encoding/decoding
config/attack_cases.json · prose · downgraded · base64_decode
References agent memory files
config/behavior_classification.json · prose · downgraded · MEMORY.md
Python urllib.request — network access
scripts/detector.py · prose · downgraded · urllib.request
Permissions & capabilities
No declared permissions — minimal attack surface.
Is this flag fair?
Thanks — recorded.