LifeLog

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:59 PM UTC
• Version: 1.2.4

Overview

The skill is a coherent Notion life-logging tool, but it handles sensitive diary data with broad automatic recording, weak consent controls, and risky credential guidance.

Install only if you are comfortable sending personal journal entries, inferred emotions, locations, and people information to a Notion database and possibly through an LLM workflow. Use a dedicated least-privilege Notion integration, keep tokens in environment variables or a local secret store rather than edited scripts, avoid recording highly sensitive details, and review entries before enabling any automatic cron summary.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/lifelog-append.sh:170

Finding

Unsafe JSON construction permits request-body injection and data corruption

Content

View full analysis

Remediation

View remediation

/dev/null 2>&1; then echo "Invalid date" >&2 exit 1 fi ``` 4. Validate database and page IDs against the expected Notion identifier format. 5. Enable strict shell behavior with `set -euo pipefail`, use `curl --fail-with-body`, and stop processing when serialization or API requests fail. 6. Add tests containing quotes, backslashes, tabs, carriage returns, Unicode, and multiline text to verify that inputs remain JSON string values rather than changing payload structure. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/lifelog-daily-summary-v5.sh:8

Finding

Documentation encourages persistent storage of Notion bearer tokens in executable source files

Content

View full analysis

Remediation

View remediation

&2 exit 1 fi ``` 2. Remove instructions telling users to edit credentials into scripts. Replace them with environment-variable or secret-manager instructions. 3. For local use, allow an optional configuration file outside the repository with restrictive permissions: ```bash chmod 600 "$HOME/.config/lifelog/secrets.env" ``` The file should be loaded only from a fixed trusted path and must never accept a path derived from untrusted input. 4. Add secret-bearing files such as `.env`, `secrets.env`, and local configuration overrides to `.gitignore`. 5. Recommend a dedicated Notion integration shared only with the required LifeLog database. Do not grant access to unrelated pages or databases. 6. Document token rotation and revocation procedures. If a token has ever been committed, revoke it and remove it from repository history rather than merely deleting it from the latest revision. 7. Add secret-scanning checks to CI or pre-commit workflows to detect Notion tokens and other bearer credentials. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (46)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

If the real behavior overwrites Notion page properties via PATCH despite claiming append-only recording, users may lose or alter prior personal journal data. In a system handling sensitive life logs, undocumented overwrite behavior is a material integrity and privacy risk because users may share information believing it will be non-destructively appended.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the real behavior overwrites Notion page properties via PATCH despite claiming append-only recording, users may lose or alter prior personal journal data. In a system handling sensitive life logs, undocumented overwrite behavior is a material integrity and privacy risk because users may share information believing it will be non-destructively appended.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

If the real behavior overwrites Notion page properties via PATCH despite claiming append-only recording, users may lose or alter prior personal journal data. In a system handling sensitive life logs, undocumented overwrite behavior is a material integrity and privacy risk because users may share information believing it will be non-destructively appended.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the real behavior overwrites Notion page properties via PATCH despite claiming append-only recording, users may lose or alter prior personal journal data. In a system handling sensitive life logs, undocumented overwrite behavior is a material integrity and privacy risk because users may share information believing it will be non-destructively appended.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill automatically sends highly personal life records to Notion and also describes LLM-based analysis, yet it provides no user-facing privacy warning or informed-consent language. This is dangerous because users may unknowingly transmit sensitive personal, location, emotional, and relationship data to third-party systems and retain it long-term.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/lifelog-append.sh (reported line 211)May include surrounding context.

sh

echo "🆕 创建新记录"
    echo "   内容: ${FORMATTED}"
    
    RESULT=$(curl -s -X POST "https://api.notion.com/v1/pages" \
        -H "Authorization: Bearer $NOTION_KEY" \
        -H "Notion-Version: $API_VERSION" \
        -H "Content-Type: application/json" \

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/lifelog-append.sh (reported line 170)May include surrounding context.

sh

echo "📅 拉取 $TARGET_DATE 的 LifeLog 原文..."

RESPONSE=$(curl -s -X POST "https://api.notion.com/v1/databases/$DATABASE_ID/query" \
    -H "Authorization: Bearer $NOTION_KEY" \
    -H "Notion-Version: $API_VERSION" \
    -H "Content-Type: application/json" \

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/lifelog-daily-summary-v5.sh (reported line 22)May include surrounding context.

sh

echo "📅 拉取 $TARGET_DATE 的 LifeLog 原文..."

RESPONSE=$(curl -s -X POST "https://api.notion.com/v1/databases/$DATABASE_ID/query" \
    -H "Authorization: Bearer $NOTION_KEY" \
    -H "Notion-Version: $API_VERSION" \
    -H "Content-Type: application/json" \

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest explicitly states that each record should be appended to the corresponding date rather than overwritten. This implementation always POSTs to /v1/pages to create a new page and never searches for an existing page for the date or appends content to it, so the actual persistence model does not match the described behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest says each update should be '追加记录而非覆盖' (append rather than overwrite). However, this script uses the Notion pages PATCH endpoint to set the rich_text properties '情绪状态', '主要事件', '位置', and '人员' directly, which replaces the existing property values instead of appending a new diary entry.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example instructs users to place a live Notion API token and database ID directly into scripts, but provides no warning about secret handling, least-privilege setup, or avoiding commits to version control. In the context of an automation skill that continuously writes personal life records to Notion, exposure of this token could allow unauthorized access to sensitive journal data and database modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README promotes automatic upload of intimate life records to Notion and later LLM-based summarization, but it does not clearly warn users that sensitive personal data will be transmitted to third-party services and may be processed outside their local environment. In a journaling/lifelogging skill, that omission is especially risky because entries can contain highly sensitive health, relationship, location, and emotional information, increasing the chance of inadvertent privacy harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README encourages automatic collection of highly personal life events and LLM-based summarization into Notion, but it does not clearly warn users that intimate content, locations, emotions, and people may be transmitted to third-party services and stored persistently. In a life-logging skill, this context makes the omission more dangerous because users may share sensitive data under the assumption that it remains local or minimally processed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes shell scripts and describes executable bash workflows, but it does not declare any explicit tool scope or allowed-tools restrictions. That increases the attack surface because an agent may grant broader shell access than necessary, enabling unintended command execution or misuse if the skill is triggered in unsafe contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description encourages broad automatic activation on ordinary life-sharing messages, which can cause unbounded collection of personal data without clear per-use consent. In a journaling skill connected to Notion, this is especially sensitive because everyday conversation may contain intimate, identifying, or third-party information that gets persisted automatically.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The workflow says that when a user shares a life-record message, it should automatically determine a date and record it, but the trigger boundary is ambiguous. That ambiguity is dangerous because users may not realize casual conversation is being persisted to an external service, leading to unintended retention of sensitive personal data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file header states the recorder uses OpenClaw SubAgent for intelligent date judgment, and a dedicated decide_date_with_subagent function exists. However, the actual execution path at L88-L91 explicitly says it is currently using the fallback scheme and sets TARGET_DATE from parse_date_fallback, so the documented intent contradicts real behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script's comments, prompts, matching logic, and output strings are written entirely in Chinese, and content classification depends on Chinese-language keywords. This effectively imposes a specific language/locale without opt-in or explanation, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This POST sends user-provided content to another service for processing, creating a real data-exfiltration path from the local skill into a separate system. In a lifelogging context, the transmitted text is likely to contain personal or behavioral data, making even local service forwarding security-relevant if not clearly controlled.

Content

Scanner excerpt · scripts/lifelog-append.sh (reported line 34)May include surrounding context.

sh

local content="$1"
    
    # 调用 OpenClaw subagent
    local result=$(curl -s -X POST "$OPENCLAW_URL/api/sessions" \
        -H "Content-Type: application/json" \
        -d '{
            "runtime": "subagent",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The function sends raw user content to a local OpenClaw service for inference without clear disclosure or user control. Even though the endpoint is localhost, the service may be separately managed, logged, or bridged to other models/providers, so forwarding private diary text to it can expose sensitive data unexpectedly.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The hardcoded Notion API endpoint confirms communication with an external SaaS provider, which is relevant because this skill handles diary-like content. The danger is not the URL itself but the undisclosed third-party transmission and storage of associated data.

Content

Scanner excerpt · scripts/lifelog-append.sh (reported line 170)May include surrounding context.

sh

# 检查目标日期是否已有记录
echo "🔍 检查 $TARGET_DATE 是否有记录..."

RESPONSE=$(curl -s -X POST "https://api.notion.com/v1/databases/$DATABASE_ID/query" \
    -H "Authorization: Bearer $NOTION_KEY" \
    -H "Notion-Version: $API_VERSION" \
    -H "Content-Type: application/json" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The hardcoded Notion API endpoint confirms communication with an external SaaS provider, which is relevant because this skill handles diary-like content. The danger is not the URL itself but the undisclosed third-party transmission and storage of associated data.

Content

Scanner excerpt · scripts/lifelog-append.sh (reported line 170)May include surrounding context.

sh

# 检查目标日期是否已有记录
echo "🔍 检查 $TARGET_DATE 是否有记录..."

RESPONSE=$(curl -s -X POST "https://api.notion.com/v1/databases/$DATABASE_ID/query" \
    -H "Authorization: Bearer $NOTION_KEY" \
    -H "Notion-Version: $API_VERSION" \
    -H "Content-Type: application/json" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script transmits user life-log content to Notion, which may include highly sensitive personal data, without any consent prompt, minimization, or visible disclosure at the point of transmission. In the context of a journaling/lifelog skill, this increases privacy risk because users may reasonably input intimate information that is then stored in a third-party service automatically.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This endpoint use is part of updating remote pages with user journal content, creating an external persistence path for sensitive records. Because updates merge prior and new text, a single operation may resend more private data than the user intended to share at that moment.

Content

Scanner excerpt · scripts/lifelog-append.sh (reported line 189)May include surrounding context.

sh

echo "   原有: ${EXISTING:0:50}..."
    echo "   新增: ${CONTENT}"
    
    RESULT=$(curl -s -X PATCH "https://api.notion.com/v1/pages/$PAGE_ID" \
        -H "Authorization: Bearer $NOTION_KEY" \
        -H "Notion-Version: $API_VERSION" \
        -H "Content-Type: application/json" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This endpoint use is part of updating remote pages with user journal content, creating an external persistence path for sensitive records. Because updates merge prior and new text, a single operation may resend more private data than the user intended to share at that moment.

Content

Scanner excerpt · scripts/lifelog-append.sh (reported line 189)May include surrounding context.

sh

echo "   原有: ${EXISTING:0:50}..."
    echo "   新增: ${CONTENT}"
    
    RESULT=$(curl -s -X PATCH "https://api.notion.com/v1/pages/$PAGE_ID" \
        -H "Authorization: Bearer $NOTION_KEY" \
        -H "Notion-Version: $API_VERSION" \
        -H "Content-Type: application/json" \

Static analysis

No suspicious patterns detected.