Interview

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:53 AM UTC
• Version: 3.0.0

Overview

This interview-prep skill is coherent and disclosed, with the main caveat that it stores sensitive interview notes locally in plaintext without hardened file permissions.

Before installing, be comfortable with interview stories, target companies, and role information being saved as local plaintext files under ~/.openclaw/workspace/memory/interview. Avoid entering confidential employer details unless your local machine and backups are trusted, and review or delete those files when they are no longer needed. If you ask the agent to do live company or salary research, assume external search tools may be used unless you explicitly limit that behavior.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/build_story.py:37

Finding

Interview stories are stored without enforced access restrictions

Content

View full analysis

Vulnerability Details

File Location: scripts/build_story.py, lines 37-48
Vulnerability Type: Plaintext sensitive-data storage with permissions dependent on the process umask
Risk Level: Medium

Vulnerable Code

python

stories_file = os.path.join(INTERVIEW_DIR, "stories.json")
data = {"stories": []}
if os.path.exists(stories_file):
    with open(stories_file, 'r') as f:
        data = json.load(f)

data['stories'].append(story)

ensure_dir()
with open(stories_file, 'w') as f:
    json.dump(data, f, indent=2)

The storage directory is created without an explicit restrictive mode:

python

INTERVIEW_DIR = os.path.expanduser("~/.openclaw/workspace/memory/interview")

def ensure_dir():
    os.makedirs(INTERVIEW_DIR, exist_ok=True)

Technical Analysis

The script persists user-supplied interview narratives—including situations, actions, results, lessons, and potentially confidential employer information—as unencrypted JSON. Neither the directory nor the file is explicitly restricted to the owning user.

os.makedirs() uses a default requested mode modified by the process umask, while open(..., 'w') creates a file with permissions similarly governed by the umask. Under a permissive runtime configuration, the resulting directory or file may be readable by other local users. Existing files with overly broad permissions are also reused without permission validation or correction.

This weakens the Skill's stated guarantee that interview content is not shared. The issue is limited to local filesystem confidentiality; the audited script contains no network requests or remote exfiltration behavior.

Attack Path

1. A user invokes build_story.py and supplies confidential interview or employment history.
2. The script creates memory/interview/stories.json under a process environment with a permissive umask, or reuses an existing file with broad permissions.
3. The story i ...[truncated 680 chars]

Remediation

View remediation

Remediation Suggestions

• Create the interview directory with owner-only permissions, such as mode 0700, and verify the mode even when the directory already exists.
• Create new data files atomically with mode 0600, for example through os.open() using O_CREAT | O_EXCL and an explicit mode.
• Apply os.chmod(stories_file, 0o600) after securely opening an existing file, subject to appropriate error handling.
• Write updates to a securely created temporary file in the same directory, flush and synchronize it, and atomically replace the destination to avoid partial writes.
• Consider optional encryption at rest if the operating environment includes untrusted administrators, backups, or shared storage.
• Implement and document retention and deletion controls consistent with the privacy claims in SKILL.md.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/research_company.py:61

Finding

Company research records are stored without enforced access restrictions

Content

View full analysis

Vulnerability Details

File Location: scripts/research_company.py, lines 61-72
Vulnerability Type: Plaintext personal-data storage with permissions dependent on the process umask
Risk Level: Medium

Vulnerable Code

python

research_file = os.path.join(INTERVIEW_DIR, "research.json")
data = {"research": []}
if os.path.exists(research_file):
    with open(research_file, 'r') as f:
        data = json.load(f)

data['research'].append(research)

ensure_dir()
with open(research_file, 'w') as f:
    json.dump(data, f, indent=2)

The storage directory is created without an explicit restrictive mode:

python

INTERVIEW_DIR = os.path.expanduser("~/.openclaw/workspace/memory/interview")

def ensure_dir():
    os.makedirs(INTERVIEW_DIR, exist_ok=True)

Technical Analysis

The script stores company names, target roles, identifiers, timestamps, and research status in a plaintext JSON file. It does not enforce owner-only permissions on the containing directory or destination file.

File accessibility therefore depends on the process umask and any pre-existing permissions. A permissive umask can result in locally readable records, while an existing broadly accessible file remains broadly accessible because the script does not inspect or repair its mode.

The audited implementation does not transmit this information over a network. The risk is restricted to unintended local disclosure.

Attack Path

1. A user executes research_company.py with the name of a prospective employer and target role.
2. The script creates or reuses research.json without enforcing restrictive permissions.
3. The company and role information is stored in plaintext.
4. Another local user or process with sufficient filesystem access reads the user's employment-search records.

Exploitation is conditional on local access and permissive directory or file permissions.

Impact Assessment

Success ...[truncated 279 chars]

Remediation

View remediation

Remediation Suggestions

• Create memory/interview with mode 0700 and correct insecure permissions on an existing directory.
• Create research.json with owner-read/write mode 0600 rather than relying on the process umask.
• Validate the ownership and permissions of existing files before reading or overwriting them.
• Use a securely created temporary file and atomic replacement for updates.
• Provide retention and secure-deletion controls for stored job-search records.
• Consider encryption at rest where local storage, backups, or host administrators are not fully trusted.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents file read/write behavior by storing multiple artifacts under memory/interview/, but it does not declare any corresponding tool scope such as permissions or allowed-tools. This creates a governance gap: the runtime may permit file operations without an explicit least-privilege declaration, making review, enforcement, and user consent weaker.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill claims interview data is stored 'locally only' and that no external platforms are connected, yet it instructs company and salary research workflows that typically require external sources. This mismatch can mislead users about privacy boundaries and data flow, increasing the risk that sensitive interview context is sent to external services without informed consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L08 says 'Preparation that wins offers,' which reads as a success guarantee or near-guarantee. This conflicts with both the manifest description at L03 and the safety boundary at L24 that explicitly say the skill must never guarantee job offers.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.