Equipment Maintenance Log

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:31 AM UTC
• Version: 0.1.0

Overview

The skill does what it claims, but it stores persistent lab equipment records in the user's home directory despite documentation saying workspace output, with weak file-safety controls.

Review before installing if you do not want skills writing persistent files under your home directory. The maintainer should document the exact data path, allow a user-chosen workspace path, and harden file creation and writes before this is treated as routine.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:17

Finding

Predictable Home-Directory File Write Follows Symbolic Links and Uses Unrestricted Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py, lines 17–18 and 29–30
Vulnerability Type: Unsafe persistent file handling
Risk Level: Medium

Vulnerable Code

python

def __init__(self, data_file="~/.openclaw/equipment_log.json"):
    self.data_file = Path(data_file).expanduser()
    self.data_file.parent.mkdir(parents=True, exist_ok=True)
    self.equipment = self._load()

def _save(self):
    with open(self.data_file, 'w') as f:
        json.dump(self.equipment, f, indent=2)

Technical Analysis

The application stores persistent equipment records at the predictable path ~/.openclaw/equipment_log.json. The write operation uses Python's ordinary open(..., 'w'), which follows symbolic links and truncates an existing destination. The application does not verify that the destination is a regular file owned by the invoking user, reject symbolic links, perform an atomic replacement, or explicitly apply restrictive permissions such as 0600.

Consequently, an attacker who can manipulate the user's ~/.openclaw directory or destination file could create a symbolic link from equipment_log.json to another file writable by the victim. When the victim adds an equipment record, the linked file would be truncated and replaced with JSON data.

The resulting file permissions also depend on the process umask. Equipment names and locations may contain operationally sensitive information, so relying solely on the ambient umask could expose these records to other local users.

This behavior also conflicts with the documentation's statement that output files are saved to the workspace: the implementation writes persistently to the user's home directory.

Attack Path

1. A local attacker obtains the ability to create or replace ~/.openclaw/equipment_log.json, such as through incorrectly configured directory permissions or prior access under the same account.
2. The attacker creates a symboli ...[truncated 1456 chars]

Remediation

View remediation

Remediation Suggestions

1. Store records in a clearly documented, application-specific data directory with restrictive permissions rather than implicitly writing to an unrestricted home-directory path.
2. Create ~/.openclaw with mode 0700 and the data file with mode 0600, without relying exclusively on the process umask.
3. Reject symbolic-link destinations using Path.is_symlink() and perform secure descriptor-based checks immediately before writing to reduce time-of-check/time-of-use exposure.
4. Where supported, open files with os.open() using O_NOFOLLOW, O_CREAT, and an explicit restrictive mode.
5. Write to a securely created temporary file in the same directory, flush and synchronize it, and atomically replace the verified destination with os.replace().
6. Before replacing an existing file, verify that it is a regular file and is owned by the expected user.
7. Validate the loaded JSON structure and handle malformed or attacker-modified records without exposing stack traces.
8. Update SKILL.md to accurately disclose the persistent home-directory write, or change the implementation so output is restricted to the documented workspace.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill documentation indicates code will write files, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and transparency gap: downstream systems or reviewers cannot easily constrain or verify what file-writing behavior is intended, increasing the risk of unintended workspace modification if the implementation changes or is abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill states it reads and writes files but does not clearly tell users where maintenance data is stored or that execution will modify workspace contents. This weakens informed consent and operational safety, and can lead to accidental exposure, overwrites, or persistence of maintenance records in unexpected locations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.