Immigration

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:53 AM UTC
• Version: 2.0.0

Overview

This immigration helper is not malicious, but it should be reviewed because it stores sensitive immigration records in plaintext local files and its reference material sometimes crosses its own no-legal-advice boundary.

Install only if you are comfortable with immigration plans, application notes, checklists, and deadlines being saved locally in plaintext. Avoid storing passport numbers, receipt numbers, financial details, or private case facts unless necessary, and verify all visa rights, restrictions, deadlines, fees, and eligibility questions with official government sources or a licensed immigration professional.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/add_deadline.py:9

Finding

Immigration deadline records are stored with ambient filesystem permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/add_deadline.py, lines 9-24
Vulnerability Type: Plaintext sensitive-data storage with insufficient permission enforcement
Risk Level: Medium

Vulnerable Code

python

IMMIGRATION_DIR = os.path.expanduser("~/.openclaw/workspace/memory/immigration")
DEADLINES_FILE = os.path.join(IMMIGRATION_DIR, "deadlines.json")

def ensure_dir():
    os.makedirs(IMMIGRATION_DIR, exist_ok=True)

def load_deadlines():
    if os.path.exists(DEADLINES_FILE):
        with open(DEADLINES_FILE, 'r') as f:
            return json.load(f)
    return {"deadlines": []}

def save_deadlines(data):
    ensure_dir()
    with open(DEADLINES_FILE, 'w') as f:
        json.dump(data, f, indent=2)

Technical Analysis

Deadline titles, descriptions, application identifiers, and immigration-related dates are written to an unencrypted JSON file. The directory and file are created without explicit owner-only permission modes, so their effective permissions depend on the process umask and any pre-existing filesystem permissions.

On a shared system with a permissive umask or accessible home directory, the resulting file may be readable by other local users. The implementation also does not verify that the destination is a regular file owned by the current user before opening it.

Attack Path

1. A user runs add_deadline.py and records an immigration deadline.
2. The script creates the directory and deadlines.json using ambient filesystem permissions.
3. On a permissively configured shared system, another local account traverses the directory and reads the JSON file.
4. The attacker obtains deadline descriptions, dates, priorities, and linked application identifiers.

Impact Assessment

The vulnerability may disclose private immigration timelines and application-related metadata to another local user. It does not grant remote access, code execution, elevated pr ...[truncated 182 chars]

Remediation

View remediation

Remediation Suggestions

• Create memory/immigration with owner-only mode 0o700.
• Create record files with mode 0o600, using os.open() with explicit creation flags and permissions.
• Verify that existing destinations are regular files owned by the current user and reject symbolic links.
• Write updates to an owner-only temporary file in the same directory, flush and synchronize it, and atomically replace the destination with os.replace().
• Apply restrictive permissions to existing directories and files during migration.
• Document that records are stored locally in plaintext and provide a secure deletion workflow.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_checklist.py:9

Finding

Immigration document checklists are stored with ambient filesystem permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_checklist.py, lines 9-24
Vulnerability Type: Plaintext sensitive-data storage with insufficient permission enforcement
Risk Level: Medium

Vulnerable Code

python

IMMIGRATION_DIR = os.path.expanduser("~/.openclaw/workspace/memory/immigration")
CHECKLISTS_FILE = os.path.join(IMMIGRATION_DIR, "checklists.json")

def ensure_dir():
    os.makedirs(IMMIGRATION_DIR, exist_ok=True)

def load_checklists():
    if os.path.exists(CHECKLISTS_FILE):
        with open(CHECKLISTS_FILE, 'r') as f:
            return json.load(f)
    return {"checklists": []}

def save_checklists(data):
    ensure_dir()
    with open(CHECKLISTS_FILE, 'w') as f:
        json.dump(data, f, indent=2)

Technical Analysis

Generated checklists contain visa types, destination countries, applicant types, and information about required identity, financial, educational, employment, civil, and medical documents. These records are persisted as plaintext JSON.

Neither the storage directory nor the file is assigned an explicit restrictive permission mode. Their accessibility therefore depends on the ambient umask and existing parent-directory permissions. The script also does not validate the ownership or file type of an existing destination before writing to it.

Attack Path

1. A user generates a visa document checklist.
2. The script writes the checklist to checklists.json using process-default permissions.
3. If the account's home directory and generated path are traversable under a permissive local configuration, another local user reads the file.
4. The attacker learns the visa category, destination, applicant type, and documents associated with the application.

Impact Assessment

Exposure may reveal sensitive immigration plans and an inventory of identity, financial, educational, employment, medical, or civil documents. The issue does not itself p ...[truncated 146 chars]

Remediation

View remediation

Remediation Suggestions

• Create the immigration data directory with mode 0o700.
• Create checklists.json with owner-only mode 0o600.
• Correct permissions on pre-existing files before reading or updating them.
• Use no-follow file-opening semantics where supported and reject symbolic links, non-regular files, and files not owned by the current user.
• Use atomic writes to prevent partial or corrupted records.
• Consider application-level encryption if the threat model includes privileged local backup operators or unauthorized access to copied storage.
• Clearly disclose the plaintext local-storage model and implement record deletion and retention controls.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/track_application.py:9

Finding

Visa application records and notes are stored with ambient filesystem permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/track_application.py, lines 9-24
Vulnerability Type: Plaintext sensitive-data storage with insufficient permission enforcement
Risk Level: Medium

Vulnerable Code

python

IMMIGRATION_DIR = os.path.expanduser("~/.openclaw/workspace/memory/immigration")
APPLICATIONS_FILE = os.path.join(IMMIGRATION_DIR, "applications.json")

def ensure_dir():
    os.makedirs(IMMIGRATION_DIR, exist_ok=True)

def load_applications():
    if os.path.exists(APPLICATIONS_FILE):
        with open(APPLICATIONS_FILE, 'r') as f:
            return json.load(f)
    return {"applications": []}

def save_applications(data):
    ensure_dir()
    with open(APPLICATIONS_FILE, 'w') as f:
        json.dump(data, f, indent=2)

Technical Analysis

Application records include visa type, destination country, status, milestones, timestamps, and free-form user notes. Free-form notes may contain especially sensitive case details. The records are stored in plaintext without explicit owner-only directory or file permissions.

Because os.makedirs() and open() rely on ambient permission settings, a permissive umask can result in locally accessible records. The code also does not inspect existing destination ownership, permissions, or file type before reading and overwriting it.

Attack Path

1. A user adds or updates a visa application using track_application.py.
2. The script saves application metadata and notes to applications.json.
3. The file receives permissions derived from the runtime umask rather than an enforced owner-only policy.
4. Another local account with path access reads the file and obtains application details, milestones, status, and notes.

Impact Assessment

A successful attack may expose immigration history, destinations, application status, timeline information, and arbitrary sensitive content entered in notes. No remote access or elevated ...[truncated 157 chars]

Remediation

View remediation

Remediation Suggestions

• Enforce mode 0o700 on the immigration storage directory and mode 0o600 on application files.
• Open newly created files through os.open() with explicit owner-only permissions.
• Validate that the target is a regular file owned by the current user; reject links and unexpected filesystem objects.
• Use atomic replacement for updates and preserve restrictive permissions across replacements.
• Minimize sensitive content in free-form notes and warn users not to store passport numbers, credentials, or unnecessary identity information.
• Provide secure export, retention, and deletion controls.
• Add automated tests that run under multiple umask settings and verify that records remain owner-readable and owner-writable only.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill markets itself around strict privacy boundaries, but its documented behavior includes persistent storage of immigration applications, documents, interview notes, and timelines on disk. Even if storage is local, this is still retention of highly sensitive personal data, and the description does not clearly surface that the skill performs ongoing filesystem persistence, which can mislead users about privacy exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section provides jurisdiction- and visa-specific rights, restrictions, and permanent-residence pathways even though the skill manifest explicitly says it must never provide legal advice or immigration law interpretations. In an immigration context, users may rely on this as authoritative legal guidance, and the content is framed in a way that could be outdated, incomplete, or wrong for a user's exact facts, creating meaningful legal and status risks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The sample output goes beyond organization help and gives concrete H-1B legal guidance such as employer-change limits, maximum duration, grace periods, and green-card process steps. Because this is a generated output template, it increases the chance the agent will present legal interpretations directly to users despite the declared prohibition, which is especially dangerous in immigration where bad guidance can affect work authorization, travel, or lawful status.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill explicitly instructs the agent to read and write sensitive immigration records under a local memory directory, but it does not declare any tool scope or allowed-tools boundary. That creates an authorization gap: the skill can rely on implicit filesystem capabilities without transparent permissioning, which is risky given the highly sensitive personal data involved.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest says to use the skill when the user mentions moving to another country, visa applications, work permits, residency, citizenship, or immigration documents. This is a wide, open-ended activation condition without explicit exclusions or negative examples, so ordinary discussion about travel or relocation could unintentionally trigger the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The suggested usage phrase "Help me prepare my application" is broad conversational language rather than a narrowly scoped trigger. In a markdown skill description, this can cause unintended activation because it lacks clear constraints or exclusion conditions distinguishing visa-document help from general assistance.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The content coaches users on how to present facts tied to visa eligibility factors such as non-immigrant intent and ties to the home country. Even though it includes honesty disclaimers, this goes beyond neutral organization and practice support into strategy about satisfying adjudication criteria, which conflicts with the skill boundary that it should not provide legal advice or immigration law interpretations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation tells the agent to provide current pathway guidance, timelines, fees, and links to official sources, but the file only demonstrates static reference content and local script usage without any defined mechanism to fetch, validate, or date-check official information. In an immigration context, stale or fabricated 'current' guidance can mislead users into making time-sensitive decisions based on outdated eligibility rules, fees, or deadlines.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented data structure includes sensitive immigration and personal information such as application IDs, approval dates, visa type, move date, destination details, and free-form notes about employer-provided housing, but there is no explicit minimization, retention, access-control, or storage warning. In an immigration skill, this context is more sensitive than ordinary planning data because exposure could reveal legal status, travel plans, employer relationships, and other personal details that could be misused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script persistently stores sensitive immigration application data, including visa type, destination country, statuses, notes, and timestamps, in a local JSON file under the user's home directory without any warning, consent flow, or privacy notice. In the context of an immigration skill, this is especially sensitive because the stored data can reveal relocation plans and personal case details, creating privacy and safety risks if the host is shared, backed up, or otherwise accessed by others.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The post-denial section advises identifying whether reapplication is possible and addressing deficiencies, which amounts to preliminary case assessment after an immigration decision. In this skill context, that can drift from administrative tracking into individualized immigration strategy, exceeding the stated non-legal boundary.

Content

No source excerpt is available for this finding.