skill-doctor
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The
doctor.pyscript reads and parses metadata from all skills located in the extension directories to identify loading failures. A malicious skill could potentially include deceptive instructions within itsSKILL.mdfrontmatter orSTATE_SCHEMA.yamlthat might be surfaced to the agent during a diagnostic report.\n - Ingestion points: The tool reads
SKILL.mdandSTATE_SCHEMA.yamlfrom subdirectories of~/.openclaw/extensions/superpowers/skills/usingPath.read_text().\n - Boundary markers: The output report does not include specific boundary delimiters (like XML tags or clear separators) to isolate the data read from external skills from the tool's own report structure.\n
- Capability inventory: The script performs local file reads and writes scan results to a state file (
~/.openclaw/skill-state/skill-doctor/state.yaml). It does not contain network request functionality or the ability to execute arbitrary system commands.\n - Sanitization: The script correctly uses
yaml.safe_load()to parse YAML content, which prevents common YAML-based attacks such as object instantiation or arbitrary code execution during the parsing phase.
Audit Metadata