Todo

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 8:01 AM UTC
• Version: 3.0.1

Overview

This is a local todo-management skill that stores task data in disclosed local JSON files and shows no evidence of network access, credential use, deception, or destructive behavior.

Install this only if you want a local todo system that keeps task, archive, and stats files under your OpenClaw workspace memory directory. Be aware that it may activate for broad task-planning language, and the publisher should harden the temporary-file write logic to reduce local corruption risk.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/lib/storage.py:24

Finding

Predictable Temporary File Enables Local Symlink-Based File Clobbering

Content

View full analysis

Vulnerability Details

File Location: scripts/lib/storage.py, lines 24–29
Vulnerability Type: Predictable and symlink-following temporary file
Risk Level: Medium

python

def _atomic_save(path, data):
    ensure_dir()
    tmp = path + ".tmp"
    with open(tmp, "w", encoding="utf-8") as f:
        json.dump(data, f, indent=2, ensure_ascii=False)
    os.replace(tmp, path)

Technical Analysis

The storage implementation derives a deterministic temporary filename by appending .tmp to the destination path. For example, writes to items.json always use items.json.tmp.

Python's open(tmp, "w") follows symbolic links and truncates the resolved target. If an attacker who can manipulate entries in ~/.openclaw/workspace/memory/todo/ creates the predictable temporary path as a symbolic link, a subsequent save can overwrite another file writable by the Skill's operating-system user.

The fixed temporary filename also creates a race between concurrent Skill processes. Two writers can open or replace the same temporary file, potentially causing failed operations, inconsistent state, or lost task data.

Attack Path

1. A local attacker obtains the ability to create or replace directory entries in ~/.openclaw/workspace/memory/todo/.
2. The attacker predicts a temporary path such as items.json.tmp, stats.json.tmp, or archive.json.tmp.
3. The attacker creates that path as a symbolic link to another file writable by the victim user.
4. The victim invokes an operation that saves task, statistics, or archive data.
5. _atomic_save() opens the predictable path in write mode.
6. The operating system follows the symbolic link and truncates the target before writing JSON content.
7. os.replace() subsequently moves the temporary directory entry to the intended JSON destination, but the target file has already been corrupted.

Impact Assessment

Exploitation requires local access suffic ...[truncated 515 chars]

Remediation

View remediation

Remediation Suggestions

• Create temporary files securely and uniquely in the destination directory with tempfile.NamedTemporaryFile(delete=False, dir=TODO_DIR) or tempfile.mkstemp().
• Write through the returned file descriptor rather than reopening a predictable pathname.
• Flush buffered data and call os.fsync() before atomically replacing the destination.
• Place cleanup in a finally block so temporary files are removed after failures.
• Configure restrictive permissions for the storage directory and files, such as owner-only access where appropriate.
• Reject or safely handle symbolic links in the storage path.
• Add inter-process file locking or another concurrency-control mechanism if simultaneous writers are supported.
• Consider validating that the destination directory is owned by the expected user and is not writable by untrusted users.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The activation language is extremely broad, covering common task-related phrases and emotional states like feeling overwhelmed or unsure what to do next. This can cause the skill to trigger in many unrelated conversations, unnecessarily granting it opportunities to read or write local state and expanding the attack surface through over-invocation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill performs local file reads and writes but does not declare any explicit tool scope or permissions boundaries. That creates an authorization gap where the agent may invoke file-capable behavior without a clearly constrained contract, increasing the chance of unintended access or modification if the skill is auto-enabled or reused in a broader environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The helper performs persistent writes by creating and replacing JSON files under ~/.openclaw/workspace/memory/todo, but the file contains no confirmation prompt, print/log statement, or explanatory comment/docstring disclosing that behavior. Because this code silently updates user-local data files, it meets the code-file missing-warning criterion for file writes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.