Security audit

Xiaoshan Journal

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent diary-generation purpose, but it reads sensitive OpenClaw memory/profile files and persists derived diary, HTML, image, and config artifacts with insufficient safeguards.

Review and narrow the configured memory/profile paths before installing. Treat generated Markdown, HTML, PNG, and config.yaml as private. Add or verify a .gitignore entry for config.yaml, preview diary content before image rendering, and only run the browser-rendering step in an environment where network access and active HTML content are controlled.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:83
Finding: Overbroad ingestion and persistent duplication of private Agent memory## Vulnerability Details **File Location**: `SKILL.md:83-96`, `INIT.md:14-34`, and `config.template.yaml:10-16` **Vulnerability Type**: Excessive access to private Agent state **Risk Level**: Medium ### Vulnerable Configuration ```yaml paths: soul_path: "~/.openclaw/workspace/SOUL.md" memory_root_path: "~/.openclaw/workspace/MEMORY.md" daily_memory_dir: "~/.openclaw/memory" daily_memory_pattern: "YYYY-MM-DD.md" diary_text_dir: "~/.openclaw/scene/小山的日记/日记历史记录/文字" news_summary_dir: "~/.openclaw/scene/每日简报/news/Summary" ``` The workflow at `SKILL.md:83-96` requires or recommends reading the Agent persona, daily memory, long-term memory, recent diaries, identity information, related daily files, and recent news summaries. The collected material is then used to create Markdown, HTML, and PNG artifacts. ### Technical Analysis The Skill performs broad discovery and ingestion of private OpenClaw state. Although some personal context is relevant to diary generation, the workflow does not enforce data minimization, restrict records to explicitly approved sources, filter credentials or sensitive values, or request confirmation before persisting derived content. This design can cause unrelated sensitive information from `SOUL.md`, `MEMORY.md`, daily memory, identity files, or historical diaries to be reproduced in several durable formats. Image output is especially difficult to search, redact, or review automatically. The issue breaks least-privilege principles because optional and potentially unrelated context is collected without a narrowly defined need for each source. The audit found no evidence that the Skill gains operating-system privileges beyond those already available to the invoking Agent. ### Attack Path 1. The Skill is invoked for daily journal generation. 2. Initialization discovers OpenClaw workspace and memory locations. 3. The workflow reads persona, daily memory, recent diaries, and potential ...[truncated 725 chars]
Remediation: ## Remediation Suggestions 1. Require explicit user approval for every memory and identity source before first use. 2. Default optional sources, including long-term memory, identity files, related daily files, and news summaries, to disabled. 3. Restrict collection to the target-date record unless the user explicitly enables historical context. 4. Add secret detection and redaction before generated content is persisted. 5. Present a preview of the diary and all extracted sensitive data before writing Markdown, HTML, or PNG files. 6. Provide a memory-free mode that accepts only user-supplied text. 7. Document retention, deletion, synchronization, and sharing risks for generated artifacts. 8. Apply restrictive permissions to all generated files and directories.

T09 · Insecure Skill Coding Practices

Error

Location: diary-template.html:42
Finding: Memory-derived diary content is rendered as HTML without mandatory escaping or sanitization## Vulnerability Details **File Location**: `SKILL.md:131-136`, `SKILL.md:150-163`, and `diary-template.html:42-44` **Vulnerability Type**: HTML injection in a local headless-browser rendering workflow **Risk Level**: High ### Vulnerable Code ```html <div class="wrap"> {{CONTENT}} </div> ``` The rendering instructions place a Markdown-derived HTML fragment into `{{CONTENT}}` and then open the generated local file in Playwright: ```js const { chromium } = require('playwright'); const browser = await chromium.launch(); const page = await browser.newPage({ viewport: { width: 1080, height: 800 }, deviceScaleFactor: 2 }); await page.goto('file:///<html_path>'); await page.waitForLoadState('networkidle'); await page.screenshot({ path: '<output_path>', fullPage: true }); await browser.close(); ``` ### Technical Analysis The workflow specifies simple Markdown-to-HTML conversion and direct substitution into the template, but it does not require HTML escaping, sanitization, a content-security policy, JavaScript disabling, or network isolation. Diary text is derived from multiple files, including daily memory and historical diaries. If attacker-controlled markup reaches the generated diary unchanged, elements such as scripts, external images, stylesheets, frames, or other active HTML can be inserted into the rendered page. Opening the result through a `file:` URL creates an active browser context. The call to `waitForLoadState('networkidle')` also indicates that network activity is permitted during rendering. Even where browser cross-origin controls block reading responses, one-way requests such as image beacons may still disclose that the crafted document was rendered and transmit data encoded into attacker-selected request URLs. ### Attack Path 1. An attacker places crafted HTML in a daily memory file, historical diary, or another source consumed by the Skill. 2. The generated diary preserves or repr ...[truncated 992 chars]
Remediation: ## Remediation Suggestions 1. HTML-escape all diary text before inserting it into the template. 2. Use a maintained Markdown renderer configured to reject or escape raw HTML. 3. Sanitize generated fragments with a strict allowlist limited to required elements such as `h1`, `p`, and approved classes. 4. Reject scripts, event-handler attributes, frames, forms, external URLs, SVG, embedded objects, and remote stylesheets. 5. Disable JavaScript in the screenshot page context. 6. Block all network requests during rendering, or permit only the local generated document. 7. Add a restrictive content-security policy, including `default-src 'none'`, with only the minimum inline styling required by the static template. 8. Validate the final HTML before browser navigation and abort if unexpected elements or attributes are present. 9. Run the browser in a dedicated low-privilege sandbox with no access to unrelated local files.

T09 · Insecure Skill Coding Practices

Warning

Location: README.md:126
Finding: Generated private configuration is not protected by the documented version-control exclusion## Vulnerability Details **File Location**: `README.md:126-130` and `SKILL.md:35-38` **Vulnerability Type**: Accidental disclosure of private configuration **Risk Level**: Medium ### Vulnerable Documentation ```markdown ## Privacy / 隐私说明 Your personal configuration (`config.yaml`) containing names, paths, and preferences is **excluded from git** via `.gitignore`. Only the template and skill logic are shared. ``` The audited project contains no `.gitignore`, despite the explicit assertion that `config.yaml` is excluded. The initialization workflow creates `config.yaml` and fills it with automatically detected private paths. ### Technical Analysis The project relies on a repository exclusion rule as its primary protection against committing generated configuration. That protection is absent. After initialization, `config.yaml` may contain names, workspace locations, and paths identifying persona, memory, diary, and news files. Because the generated file is not ignored, ordinary version-control commands can stage and commit it. The inaccurate privacy statement may also give users a false sense of security and reduce the likelihood that they inspect staged files. No hardcoded credential was found in the provided template. The vulnerability concerns private values written to the generated configuration during normal operation. ### Attack Path 1. A user installs the Skill in a version-controlled directory. 2. The first-run workflow creates `config.yaml`. 3. Environment detection writes private names and local filesystem paths into that file. 4. No `.gitignore` rule excludes the generated file. 5. The user runs a broad staging command or archives the entire project directory. 6. The generated configuration is committed, uploaded, or distributed. 7. Anyone with access to the repository or archive learns the exposed private configuration and memory-file locations. ### Impact Assessment Exposure can reveal username ...[truncated 354 chars]
Remediation: ## Remediation Suggestions 1. Add a root `.gitignore` containing an anchored `/config.yaml` rule. 2. Consider ignoring generated diary HTML and other private artifacts when they reside under the repository. 3. Create `config.yaml` with restrictive owner-only permissions where the platform supports them. 4. Remove personal names and environment-specific directory names from distributed defaults. 5. Add a pre-commit secret and privacy scan for generated configuration and diary artifacts. 6. Warn users during initialization if the Skill directory is inside a version-controlled repository. 7. Correct the README immediately if version-control exclusion cannot be guaranteed. 8. Add an automated test confirming that `config.yaml` remains untracked after initialization.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Session Persistence

Medium

Category: Rogue Agent
Content: ## Features / 功能特性 **English:** - **One-click execution**: Auto-detect config → Initialize (first run) → Write → Generate image - **Config-driven**: All private paths (soul, memory, diary location) externalized to `config.yaml` - **Auto-initialization**: Automatically detects environment paths on first use - **1080px standard**: Generates images with exact 1080px width, auto-adaptive height
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README states that the skill will automatically detect paths, create directories, and generate `config.yaml`, but it does not clearly warn users that local files and filesystem state will be modified on first run. In an automation skill that operates on personal workspace paths, silent initialization increases the risk of unintended writes, mis-detected paths, or overwriting user expectations about where sensitive diary data will be stored.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README explains that the skill reads `SOUL.md`, daily memory, and recent journals to compose diary content, but it does not prominently warn that these are sensitive personal files whose contents will be aggregated and processed. This is dangerous because users may not realize the breadth of personal data accessed, which can lead to privacy harm if the generated diary or image is exposed, stored insecurely, or shared.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly performs automatic initialization, creates directories, writes config.yaml, diary markdown, HTML, and image files, yet it does not require an explicit user confirmation before modifying the local filesystem. In an agent setting, silent writes can surprise users, overwrite expected state, or create privacy-sensitive artifacts from personal source files without clear consent.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The manifest describes an automation skill for generating diary text and a 1080px-wide image from local materials, but this file directs the agent to use Playwright, headless Chrome, and the macOS `sips` command to render and post-process screenshots. Spawning local browser processes and shell-based image manipulation are materially broader execution capabilities than simple diary composition and are not explicitly declared in the skill description.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: This markdown file instructs the skill to copy `config.template.yaml` to `config.yaml` and write detected values into it, which changes user files. The document describes the steps but does not explicitly warn the user that the initialization process will create and modify configuration files on disk.

Missing User Warnings

Low

Confidence: 75% confidence
Finding: The markdown directs that `paths.diary_text_dir` should be created if missing, which affects the user's filesystem. Although operationally reasonable, the file does not include an explicit user-facing warning that initialization may create new directories.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: The template fixes the timezone to "Asia/Shanghai", which encodes a specific locale assumption in a default configuration. Because the file does not indicate that this is optional, user-selectable, or justified as region-specific, it can conflict with a policy requiring language/locale choice or opt-in.

Static analysis

No suspicious patterns detected.