T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:68- Finding
Unsafe interpolation of user-controlled data into shell-executed SQL commands
- Content
View full analysis
- Remediation
View remediation
Security audit
Family Partner is an AI-driven family intelligent assistant, committed to becoming an indispensable digital partner for every family.We not only help families manage trivial affairs, but also understand family dynamics, promote member connections, and witness family growth.
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent local family organizer, but it stores sensitive family data through shell-run SQLite commands and broad chat triggers that need careful review before installation.
Review this before installing if the OpenClaw user may receive messages from other people or external chat platforms. Store only family details you are comfortable keeping in a local SQLite database, prefer explicit commands for sensitive actions, avoid untrusted free-form input, and run OpenClaw under a limited account with access scoped to the Family Partner data directory.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
🛠️ Development & Maintenance
Update Skills Package
bash # Update the entire skills package
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
ogs --tail 50
text #### 问题：查询无结果 ```bash # 检查数据是否存在 sqlite3 ~/.openclaw/family-partner/family.db "SELECT * FROM events LIMIT 5" # 检查日期格式 sqlite3 ~/.openclaw/family-partner/family.db "SELECT date('now')" # 验证表结构 sqlite3 ~/.openclaw/family-partner/family.db ".schema"问题：晨间简报不推送
bash # 检查定时任务配置 crontab -l | grep openclaw # 手动测试 openclaw chat --message "早上好" # 查看详细错误 openclaw chat --message "早上好" --verbose性能优化
bash # 定期清理旧数据（可选） sqlite3 ~/.openclaw/family-partner/family.db \ "DELETE FROM labor WHERE date < date('now', '-1 year')" # 优化数据库性能 sqlite3 ~/.openclaw/family-partner/family.db "VACUUM" sqlite3 ~/.openclaw/family-partner/family.db "ANALYZE"📚 文档资源
- OpenClaw 官方文档
- [ClawHub Skill 格式规范](https://github.com/openc
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
ogs --tail 50
text #### 问题：查询无结果 ```bash # 检查数据是否存在 sqlite3 ~/.openclaw/family-partner/family.db "SELECT * FROM events LIMIT 5" # 检查日期格式 sqlite3 ~/.openclaw/family-partner/family.db "SELECT date('now')" # 验证表结构 sqlite3 ~/.openclaw/family-partner/family.db ".schema"问题：晨间简报不推送
bash # 检查定时任务配置 crontab -l | grep openclaw # 手动测试 openclaw chat --message "早上好" # 查看详细错误 openclaw chat --message "早上好" --verbose性能优化
bash # 定期清理旧数据（可选） sqlite3 ~/.openclaw/family-partner/family.db \ "DELETE FROM labor WHERE date < date('now', '-1 year')" # 优化数据库性能 sqlite3 ~/.openclaw/family-partner/family.db "VACUUM" sqlite3 ~/.openclaw/family-partner/family.db "ANALYZE"📚 文档资源
- OpenClaw 官方文档
- [ClawHub Skill 格式规范](https://github.com/openc
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The README markets the skill as 'privacy-first' and 'pure local storage,' yet its architecture explicitly includes external messaging platforms and an agent that executes shell commands. This can mislead users about the actual data exposure and execution surface, causing them to grant trust or deploy it in environments where message contents and operational metadata may leave the local host.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Using a broad everyday phrase like 'Good morning' as a trigger can cause accidental invocation of the morning briefing workflow. In an agent context, overly generic triggers increase the risk of unintended data disclosure, since a casual greeting could reveal schedules, tasks, anniversaries, or other sensitive family information.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
If not automatically initialized during installation, manually execute:
bash # Create database directory mkdir -p ~/.openclaw/family-partner # Execute initialization script
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The examples rely on unconstrained natural-language inputs for creating records, retrieving private memories, updating votes, and modifying challenge progress. Without clearly scoped intents or confirmation requirements, common conversation can be misclassified as commands, leading to unintended writes, data leakage, or state changes affecting family records.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file is explicitly a Chinese-only README ("README_CN.md") and all user-facing instructions, examples, and operational guidance are presented only in Chinese. Under the policy for natural-language violations, forcing a single language without opt-in or an offered alternative can be a locale-policy issue unless the regional scope is clearly justified.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 创建数据库目录 mkdir -p ~/.openclaw/family-partner # 执行初始化脚本 sqlite3 ~/.openclaw/family-partner/family.db < init.sql
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 创建数据库目录 mkdir -p ~/.openclaw/family-partner # 执行初始化脚本 sqlite3 ~/.openclaw/family-partner/family.db < init.sql
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
md sqlite3 --version # 检查数据库文件 ls -la ~/.openclaw/family-partner/family.db # 重新初始化数据库 sqlite3 ~/.openclaw/family-partner/family.db < init.sql
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
md sqlite3 --version # 检查数据库文件 ls -la ~/.openclaw/family-partner/family.db # 重新初始化数据库 sqlite3 ~/.openclaw/family-partner/family.db < init.sql
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 检查定时任务配置 crontab -l | grep openclaw # 手动测试 openclaw chat --message "早上好"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 检查定时任务配置 crontab -l | grep openclaw # 手动测试 openclaw chat --message "早上好"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Overview Family Partner is a complete family management solution powered by AI. It includes 11 integrated skills that work together to help families organize their daily lives, track important information, and create lasting memories. ## Included Skills
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This section encourages storage of highly sensitive family information, including allergies, medical, school, and work details, but does not provide any privacy notice, retention guidance, access warning, or explanation that data is persisted locally in SQLite. Users may disclose sensitive personal data without understanding where it is stored or who with local system access might read it.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The phrase "remember..." is extremely broad and can match normal conversational requests unrelated to this skill, causing accidental writes of personal or sensitive information into local storage. Because this skill stores preferences, allergies, medical, school, and work details, accidental capture increases privacy risk and can create incorrect persistent records.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Using "good morning" as a trigger is overly generic and likely to overlap with ordinary conversation, which can cause unintended invocation of the Family Morning skill. In this skill, unintended activation can expose schedules, tasks, shopping lists, and upcoming family events without the user explicitly intending to access that bundled personal data.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The README's examples are primarily in English, but one assistant response includes Chinese text ("Mom承担较多，建议重新分配部分家务哦～") without explaining language selection. This suggests the skill may emit a specific language without user choice, which can violate language/locale policy expectations.
- Content
Static analysis
No suspicious patterns detected.