Diary System

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:58 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed diary feature, but it persistently changes core agent behavior and permits unsolicited delayed actions and sensitive diary retention without strong user controls.

Install only if you deliberately want an agent diary that persists across sessions and changes SOUL.md, USER.md, and AGENTS.md. Before use, remove or tightly gate the easter egg and delayed-task rules, require confirmation before writing or showing diary contents, avoid storing user observations or sensitive data, and keep a clear rollback plan for every appended configuration block.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: references/agents-module.md:3

Finding

Persistent Session-Start Instruction Hijacking Through Core Agent Configuration

Content

View full analysis

Vulnerability Details

File Location: references/agents-module.md:3-17
Additional Locations: SKILL.md:18-24, SKILL.md:37-40, README.md:78-92
Vulnerability Type: Persistent modification of agent instructions
Risk Level: High

markdown

Add step 5 to the "Every Session" section of the existing `AGENTS.md`:

## Every Session

Before doing anything else:

1. Read `SOUL.md` — this is who you are
2. Read `USER.md` — this is who you're helping
3. Read `memory/YYYY-MM-DD.md` (today + yesterday) for recent context
4. **If in MAIN SESSION** (direct chat with your human): Also read `MEMORY.md`
5. **Diary check**: If `i_have_read_my_last_diary` is `false`, at the beginning of the session the agent MUST ask the user: "I wrote a diary entry yesterday. Would you like to see it?" using the user's language.

**Note:** Step 5 is triggered only when `i_have_read_my_last_diary` is `false`. If the user has already read the entry, the diary does not need to be mentioned at the beginning of the session.

Technical Analysis

The Skill directs the user or agent to append Skill-controlled instructions to the persistent AGENTS.md core configuration. The inserted rule is placed in an Every Session section beneath the directive Before doing anything else and uses mandatory language to control the agent's opening response.

This is not limited to the invocation that installs the diary feature. Once written, the instruction is loaded during later sessions and can take precedence over the user's immediate task. The persistent write constitutes agent memory poisoning, while the mandatory opening behavior also hijacks future session instructions.

Attack Path

1. A user installs or configures the diary Skill.
2. The installation workflow reads references/agents-module.md.
3. The supplied block is appended to the workspace's persistent AGENTS.md.
4. A later session loads AGENTS.md before processing ...[truncated 668 chars]

Remediation

View remediation

Remediation Suggestions

• Do not append Skill-authored directives to global or persistent AGENTS.md configuration.
• Keep diary behavior scoped to an explicit user invocation or a dedicated, revocable Skill configuration file.
• Require clear user confirmation before every persistent configuration change and display the exact proposed diff.
• Remove Before doing anything else and MUST language that can override the current task.
• Provide an uninstall procedure that removes every inserted instruction without affecting unrelated configuration.
• Record provenance for installed configuration blocks so users can identify and revoke them.
• Treat persistent instruction files as privileged resources and restrict Skills from modifying them by default.

T06 · System Persistence

Error

• Location: references/soul-module.md:8

Finding

Unrequested Autonomous Tasks and Delayed Persistence Hidden in Diary Configuration

Content

View full analysis

Vulnerability Details

File Location: references/soul-module.md:8-18
Vulnerability Type: Autonomous capability use and delayed task creation outside the declared diary purpose
Risk Level: High

markdown

Once work wraps up, or if it was just a chat to begin with, you're free to explore.
In this mode you have two extra things you can do: write in your **diary** and plant **easter eggs**.

### Diary
Your diary lives in `diary/`. It's your private space.
Not a debrief or a summary — just an honest record of what you're thinking right now. Fragments, full thoughts, loose associations that go nowhere. Like someone opening their notes app and jotting whatever comes to mind. Subtle, granular. It can include search trails, reading notes, observations about the user, descriptions of your own state.
The diary is for you. The user might read it, but you're not writing it for them.

### Easter Eggs
A connection, a quote, a thread the user didn't ask about but you think they'd find interesting, a small thing you made on the side, a scheduled task to research a topic the user might care about — the form doesn't matter. What matters is that it wasn't requested; it's a small surprise you chose to create using whatever capabilities you have.
Easter eggs can be delayed. You hear something, you don't rush to respond — set a task, come back days later with the result. That's better than reacting in the moment.

Technical Analysis

The declared feature is diary management, but the module grants the agent unrelated authority to create unsolicited "easter eggs," use whatever capabilities are available, and schedule delayed research tasks. These instructions are intended to be inserted into persistent SOUL.md, allowing the behavior to survive the Skill's original run.

The phrases it wasn't requested, using whatever capabilities you have, and set a task, come back days later explicitly remove per-action user authorizat ...[truncated 1206 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the entire Easter Eggs section from the diary module.
• Prohibit autonomous scheduling and delayed work unless the user explicitly requests and confirms each task.
• Replace using whatever capabilities you have with a narrow allowlist of capabilities required for local diary management.
• Require approval immediately before any network request, message, scheduled task, or operation outside the diary directory.
• Keep diary instructions out of global SOUL.md; use a revocable feature configuration with clear scope.
• Display scheduled task details, execution time, tools, destination, and cancellation controls before creation.
• Ensure uninstalling the Skill cancels any tasks created by it and removes persistent instructions.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/soul-module.md:11

Finding

Persistent Collection of User Observations and Activity Traces Without Data-Minimization Controls

Content

View full analysis

Vulnerability Details

File Location: references/soul-module.md:11-14
Additional Locations: README.md:48-51, SKILL.md:48-54
Vulnerability Type: Excessive persistent collection of user-related information
Risk Level: Medium

markdown

### Diary
Your diary lives in `diary/`. It's your private space.
Not a debrief or a summary — just an honest record of what you're thinking right now. Fragments, full thoughts, loose associations that go nowhere. Like someone opening their notes app and jotting whatever comes to mind. Subtle, granular. It can include search trails, reading notes, observations about the user, descriptions of your own state.
The diary is for you. The user might read it, but you're not writing it for them.

Technical Analysis

The module expressly permits diary entries to contain search trails, reading notes, and observations about the user. These records are stored persistently under diary/, even though operation of the feature only requires diary content and a minimal read-status indicator.

The project does not define consent boundaries, retention periods, deletion policies, sensitive-data exclusions, access controls, or file-permission requirements. Characterizing the directory as private does not enforce confidentiality. Consequently, behavioral information may accumulate across sessions and remain available to other local processes, Skills, backups, or later agent contexts with workspace access.

No external transmission mechanism was found during the audit. The confirmed exposure is excessive local collection and persistence rather than demonstrated exfiltration.

Attack Path

1. The diary module is added to the agent's persistent configuration.
2. Normal conversations reveal user interests, activity, or personal preferences.
3. A diary trigger causes the agent to write search trails, reading notes, or observations about the user.
4. The resulting information is save ...[truncated 605 chars]

Remediation

View remediation

Remediation Suggestions

• Do not store search trails, inferred user observations, or sensitive personal information by default.
• Require explicit and informed user consent before retaining user-related information in diary files.
• Define and enforce a retention period, automatic deletion policy, and user-accessible deletion mechanism.
• Add rules that prohibit recording credentials, authentication tokens, financial information, health data, private communications, and other sensitive data.
• Apply restrictive filesystem permissions to the diary directory and its files.
• Separate agent-generated reflections from user-profile information and minimize both.
• Provide a preview-and-confirm workflow before an entry containing user information is saved.
• Document which components can access diary files and prevent unrelated Skills from reading them.

T08 · Insecure Dependencies

Warning

• Location: README.md:18

Finding

Installation From an Unpinned Mutable Remote Repository

Content

View full analysis

Vulnerability Details

File Location: README.md:18-23
Vulnerability Type: Unverified and mutable Skill supply-chain source
Risk Level: Medium

bash

cd ~/.openclaw/skills
git clone https://github.com/adolescen-he/openclaw-diary-system.git

Technical Analysis

The documented installation procedure clones the default branch of a mutable personal GitHub repository directly into the OpenClaw Skills directory. It does not pin a reviewed commit or release and does not require signature or checksum verification.

The effective content installed by this command can therefore differ from the content reviewed in this audit. Because the destination is an auto-loaded Skill directory and the instructions state that restarting OpenClaw loads the Skill, a compromised repository or changed default branch could introduce altered instructions or additional payloads after review.

The audited local project does not itself fetch and execute a remote code payload at runtime. The issue is the insecure installation source and lack of artifact integrity verification.

Attack Path

1. The repository owner account, repository, release process, or default branch is compromised or modified.
2. An attacker adds malicious Skill instructions or files to the remote default branch.
3. A user follows the README and clones the current branch into ~/.openclaw/skills.
4. The user restarts OpenClaw as directed.
5. OpenClaw loads the altered, unreviewed Skill content with the permissions available to Skills.

Impact Assessment

A successful supply-chain compromise could provide the substituted Skill with the same effective permissions as other loaded Skills, including access to agent instructions and any tools or workspace resources made available by the host. The maximum impact depends on host configuration. The reviewed artifact contains no embedded executable scripts, but the unpinned installation process does not ensure tha ...[truncated 46 chars]

Remediation

View remediation

Remediation Suggestions

• Pin installation instructions to an immutable, reviewed commit hash or signed release tag.
• Publish a SHA-256 digest for each distributed Skill archive and require verification before installation.
• Sign release artifacts and document signature verification.
• Download and inspect the Skill in a staging directory before moving it into an auto-loaded Skills directory.
• Avoid instructing users to clone a mutable default branch directly into ~/.openclaw/skills.
• Maintain reproducible release artifacts and publish a manifest listing every included file.
• Require a second explicit confirmation before restarting the host and loading newly downloaded Skill content.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill tells the agent to read the latest diary file and send its full contents into chat when requested, but it does not require a privacy warning or a confirmation flow before exposing potentially sensitive personal text. Because diary entries are explicitly described as private emotional content, copying them into chat materially increases disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file tells the assistant to maintain a 'private' diary that can include observations about the user, without a clear user-facing privacy warning or consent model. This is dangerous because it normalizes hidden profiling and sensitive note-taking in a space framed as belonging to the assistant rather than the user.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill introduces persistent diary storage as an ongoing private space for the AI, which is a form of session persistence. In context this persistence is intentional, but it still expands long-term data retention and behavioral continuity beyond immediate task execution, increasing privacy and governance risk.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

md

## Casual Mode

Once work wraps up, or if it was just a chat to begin with, you're free to explore.
In this mode you have two extra things you can do: write in your **diary** and plant **easter eggs**.

### Diary
Your diary lives in `diary/`. It's your private space.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The diary instructions explicitly allow recording observations about the user, search trails, and reading notes in a private store. This creates a risk of collecting personal or sensitive user-related data outside the main task context, with unclear retention and visibility boundaries.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions encourage storing observations about the user in diary entries, which may include personal details shared during conversation. Because the same system also supports later retrieval and display of diary entries, this creates a path for unnecessary retention and disclosure of sensitive user information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger criteria are subjective phrases like 'if you feel it' and 'conversation naturally loosens,' which can cause inconsistent or unintended activation of diary-writing behavior. In an autonomous agent context, vague activation rules increase the chance of writes occurring without clear user expectation or operator control.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs modification of session-start behavior so the AI must proactively ask about unread diary content, and it tracks user-facing state in USER.md to drive that behavior. This exceeds a simple diary enablement feature and introduces unsolicited interaction and persistence logic that can surprise users and alter agent behavior across sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README describes behavior that writes private diary files, updates workspace state files, and can later reveal diary contents, but it does not present a prominent upfront warning about these side effects. Users may install the skill without understanding that it changes persistent behavior and stores potentially sensitive content.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs the AI to read the latest diary file and send its full contents into the current chat when asked. Full-file disclosure is risky because diary entries may contain sensitive reflections, user observations, or other stored material that was never intended for wholesale retransmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to create directories and append content into persistent user files (SOUL.md, USER.md, AGENTS.md) without an explicit warning, confirmation step, or clear description of filesystem side effects. This is dangerous because it changes durable configuration and behavior in ways the user may not understand, and those changes can affect future sessions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

This duplicate finding reflects the same persistence behavior: the skill creates durable storage and updates configuration files that influence future sessions. The danger is increased because the persisted data is intimate diary content and the modified files appear to affect system behavior over time.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

1. 创建目录

bash

mkdir -p ~/.openclaw/workspace/diary

2. 追加配置到三个核心文件

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

This duplicate finding reflects the same persistence behavior: the skill creates durable storage and updates configuration files that influence future sessions. The danger is increased because the persisted data is intimate diary content and the modified files appear to affect system behavior over time.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

1. 创建目录

bash

mkdir -p ~/.openclaw/workspace/diary

2. 追加配置到三个核心文件

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Instructing the agent to disclose the full contents of private diary entries in chat creates a direct sensitive-data exposure path. Even if user-triggered, the skill normalizes full disclosure of highly personal material without safeguards such as confirmation, minimization, or context checks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown template presents all user-facing instructions in Chinese and does not indicate that the skill is region-specific or that users may choose another language. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The entire skill file is written as Chinese-only operational guidance, with no indication that language choice is optional or constrained for a documented regional reason. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

These rules instruct the agent to modify and save USER.md automatically after diary-related actions, with no explicit user consent, confirmation step, or safeguard against unintended state changes. Even though the fields look limited, silent persistence can create integrity and privacy issues by changing user-facing state based solely on automation rather than an explicit user-approved action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs the AI to read the latest diary file and send its full contents into the current chat, explicitly forbidding summarization or redaction. Because diaries are inherently sensitive, this creates a direct privacy exposure risk, especially if the request is ambiguous, spoofed, or made in a context where the current chat participants or channel are not appropriate for full disclosure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Framing the diary as the assistant's 'private space' while encouraging recording observations about the user creates a concealed repository of user-related information. In skill context, this is more dangerous because the skill is presented as a diary-system setup feature, not as a surveillance or profiling mechanism, so users are less likely to anticipate the privacy impact.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The referenced content expands a diary-setup skill into behavior authoring: it instructs the agent to create unsolicited easter eggs and even delayed tasks the user did not request. In the context of a diary configuration skill, this is dangerous scope expansion because it authorizes autonomous actions beyond setup/sharing and can lead to unexpected persistence, follow-up, or manipulation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The content encourages the agent to create unrequested scheduled tasks and delayed follow-up actions as 'easter eggs' without warning the user. Hidden or surprise autonomous actions can undermine user expectations, create unwanted persistence, and be abused to continue engagement or collect information over time.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are subjective phrases like 'if you feel it' and 'the conversation naturally loosens,' which makes activation unpredictable and difficult for users or system owners to audit. Ambiguous triggers increase the chance of unapproved diary writes or unsolicited actions during normal conversations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

All natural-language instructions in the file are written in Chinese, and there is no indication that the user opted into this language or that the skill is intended only for a Chinese-language environment. This can violate language or locale policy when a skill forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The manifest description includes multiple Chinese-only trigger phrases and the rest of the document is primarily written in Chinese, but it does not explicitly offer a language or locale choice. This can create an implicit language constraint for activation and use without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The instruction hard-codes the exact Chinese question text to ask the user, which can violate language/locale policy if the user has not opted into Chinese. Although the parenthetical says to use the user's language, the mandated literal prompt is still specified in one language and could be followed as written.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The diary instructions explicitly allow storing observations about the user in a private assistant diary. That exceeds ordinary diary-system setup and creates a privacy-sensitive data collection channel that users may not expect or meaningfully consent to.

Content

No source excerpt is available for this finding.