ClawHub
Back to skill

Security audit

Diary

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its diary purpose, but it automatically reads broad private memory files and writes diary/image outputs without enough per-run user control.

Review and customize config.yaml before first use. Only install this if you are comfortable with the agent reading your OpenClaw SOUL, MEMORY, daily memory, recent diary files, and optional news summaries to draft a diary. Ask the agent to show the exact files it will read and write, and review the generated markdown/image before sharing.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:26
Finding

Overbroad Access to Private Agent Memory During Diary Generation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:26-31; supporting configuration in INIT.md:15-31 and config.template.yaml:9-15
Vulnerability Type: Excessive access to private Agent and user memory
Risk Level: Medium

Vulnerable Code

SKILL.md:26-31:

markdown
必读：
- `paths.soul_path`
- `paths.memory_root_path`
- `paths.daily_memory_dir/YYYY-MM-DD.md`

建议读取：
- `paths.diary_text_dir` 最近 7 天日记（避免重复句式）

INIT.md:15-31:

markdown
- `soul_path` 候选：
  1. `<workspace_dir>/SOUL.md`
  2. `~/.openclaw/workspace/SOUL.md`

- `memory_root_path` 候选：
  1. `<workspace_dir>/MEMORY.md`
  2. `~/.openclaw/workspace/MEMORY.md`

- `daily_memory_dir` 候选：
  1. `~/.openclaw/memory`
  2. `<workspace_dir>/memory`

- `daily_memory_pattern` 默认：`YYYY-MM-DD.md`

config.template.yaml:9-15:

yaml
paths:
  soul_path: "~/.openclaw/workspace/SOUL.md"
  memory_root_path: "~/.openclaw/workspace/MEMORY.md"
  daily_memory_dir: "~/.openclaw/memory"
  daily_memory_pattern: "YYYY-MM-DD.md"
  diary_text_dir: "~/.openclaw/scene/日记/文字"
  news_summary_dir: "~/.openclaw/scene/每日简报/news/Summary"

Technical Analysis

The Skill requires complete identity and memory files to be read on each diary-generation run. The required inputs include SOUL.md, the root MEMORY.md, and a daily memory file. The implementation instructions do not define field-level scoping, content filtering, sensitivity classification, or explicit per-run authorization for these sources.

These files may contain information unrelated to the requested diary, including private conversation context, personal details, operational instructions, or credentials accidentally stored in memory. Because the Skill subsequently generates Markdown and a shareable image from the collected material, unrelated sensitive information could be incorporated into persistent output.

The risk is compounded by `optional.include_news_co ...[truncated 1942 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make access to SOUL.md, root MEMORY.md, historical diaries, and news summaries opt-in rather than mandatory.
  2. Request explicit user confirmation before reading broad identity or long-term memory files.
  3. Restrict default collection to the daily-memory file for the requested date.
  4. Allow users to select specific files or excerpts instead of reading complete memory stores.
  5. Apply sensitivity filtering before generation, excluding credentials, access tokens, private instructions, financial information, and unrelated personal data.
  6. Add an output review or redaction step before writing the Markdown file or rendering the image.
  7. Set optional.include_news_context to false by default and minimize historical lookback periods.
  8. Document precisely which files will be read and how their contents may influence generated output.
  9. Validate configured paths against an approved workspace root to prevent accidental access to unrelated files.
  10. Consider separating identity/style guidance from private factual memory so stylistic continuity does not require loading the complete memory corpus.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description is broad enough to match common user requests like '写日记' or '自动日记归档', which can cause the agent to invoke it in situations where the user did not explicitly consent to file reads/writes. Because this skill reads personal memory files and writes diary/image outputs, overbroad triggering increases the chance of unintended access to sensitive local content and unintended filesystem modification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The entire skill is specified in Chinese and describes generating diary content as '个人日记自动化', with no indication that users may choose another language or locale. This can constitute a language-policy violation when a skill implicitly forces one language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly performs automatic initialization and writes outputs to disk, but the markdown does not require a user-facing warning or confirmation before creating config files, directories, diary text, or images. In a personal diary context, silent initialization and persistence are especially sensitive because they can create or modify private records without the user's informed approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The initialization instructions explicitly tell the agent to copy a template to config.yaml and write auto-detected local paths into it, but they do not require user confirmation or warn that local files will be created or modified. In this skill's context, filesystem writes are expected functionality, so the risk is limited, but silent modification of local configuration can still surprise users and lead to unintended disclosure of private path information or accidental overwrites.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The workflow instructs creation of missing directories and generation of dated markdown and PNG output files, again without an explicit warning or confirmation step for filesystem changes. Because this diary skill is designed to produce persistent local artifacts, the behavior is contextually expected and less dangerous than in unrelated skills, but it still poses a low-risk issue of unintended local data creation or overwrite.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The config sets timezone: "Asia/Shanghai", which imposes a specific locale setting by default. Under the policy, locale constraints should either be user-selectable or clearly justified as region-specific; this file provides neither.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.