ClawHub
Back to skill

Security audit

ErgoCare Coach

Security checks for vulnerabilities and agentic risk

Overview

This is a transparent desk-break reminder skill, but users should review any generated scripts before running them or enabling startup.

Install only if you want a skill that may generate local executable reminder scripts. Before running any generated script, review it, keep startup disabled unless you explicitly choose it, avoid shell or PowerShell profile autostart, run it as a normal user, use absolute paths in a dedicated directory, and keep clear stop and uninstall steps.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Warning
Location
README.md:215
Finding

Overbroad and insufficiently hardened autostart persistence guidance

Content
View full analysis

Vulnerability Details

File Location: README.md:215-218, README.md:242-246, SKILL.md:559-563, and SKILL.md:579-582
Vulnerability Type: System persistence through cron, systemd, shell profiles, PowerShell profiles, and Windows Task Scheduler
Risk Level: Medium

Vulnerable Code Snippets

README.md:215-218:

text
**Startup Options:**
- Crontab: `@reboot /path/to/ergocare.sh`
- systemd service (optional)
- .bashrc / .zshrc autostart

README.md:242-246:

text
**Startup Options:**
- Task Scheduler (GUI setup included)
- PowerShell profile autostart
- System tray minimize

SKILL.md:559-563:

text
**Features:**
- Run in background (`./ergocare.sh &`)
- Add to startup (`crontab @reboot`)
- Stop script (`pkill -f ergocare.sh`)
- Logs breaks to file (optional)

SKILL.md:579-582:

text
**Features:**
- Run on startup (Task Scheduler)
- Minimize to system tray
- Pause/resume functionality

Technical Analysis

The Skill explicitly instructs the agent to generate scripts that can survive reboots or execute whenever a user opens a shell. Persistent execution is related to the declared automatic-reminder functionality and is presented as optional, so the reviewed material does not establish a covert backdoor. Nevertheless, some recommended mechanisms exceed the minimum persistence scope required for desktop reminders.

In particular, modifying .bashrc, .zshrc, or a PowerShell profile causes the script to be invoked in interactive shell sessions rather than only during an authenticated desktop session. Cron and Task Scheduler instructions also do not specify:

  • A fixed, trusted, absolute executable path
  • Correct quoting of paths and arguments
  • Restrictive ownership and file permissions
  • Execution as a non-administrative user
  • Integrity verification before execution
  • A complete disable and uninstall procedure
  • Service ...[truncated 1694 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prefer narrowly scoped, user-level scheduling:
    • Linux: a hardened systemd --user timer or desktop autostart entry
    • macOS: a per-user LaunchAgent
    • Windows: a non-elevated Task Scheduler task triggered only at user login
  2. Do not recommend .bashrc, .zshrc, or PowerShell profile modification for a desktop reminder.
  3. Make persistence opt-in and display the exact startup entry before installation.
  4. Use an absolute, quoted path to a dedicated installation directory.
  5. Require the script and parent directory to be owned by the user and not writable by other accounts.
  6. Configure tasks to run without administrative privileges and only in the intended interactive user session.
  7. Avoid executing files from temporary, download, shared, or broadly writable directories.
  8. Provide status, disable, and complete uninstall commands for every supported mechanism.
  9. Document how users can inspect and verify the installed startup entry.
  10. Where practical, verify the target file's ownership and permissions before every launch.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:562
Finding

Overbroad process termination using command-line pattern matching

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:562
Vulnerability Type: Unsafe process selection and termination
Risk Level: Low

Vulnerable Code Snippet

text
- Stop script (`pkill -f ergocare.sh`)

Technical Analysis

The -f option instructs pkill to match against the complete process command line rather than a unique process identifier. Consequently, every process whose command line contains ergocare.sh may be terminated, including unrelated scripts, wrapper processes, editors, monitoring commands, or another user's processes where operating-system permissions permit signaling them.

The command does not verify that a matched process is the intended ErgoCare reminder instance. Name-based termination is therefore less precise than maintaining and validating the process identifier created when the reminder starts.

Attack Path

  1. The reminder script and another process run concurrently.
  2. The unrelated process has the text ergocare.sh somewhere in its complete command line.
  3. The user follows the documented stop instruction and executes pkill -f ergocare.sh.
  4. pkill matches both the intended reminder and the unrelated process.
  5. Every matched process that the user is authorized to signal is terminated.

A malicious local process could also deliberately include the matching string in another command line, although the practical result remains limited to process termination under the invoking user's existing permissions.

Impact Assessment

The primary impact is accidental denial of service or loss of unsaved work in unrelated processes owned by the invoking user. The command does not grant additional privileges and normally cannot terminate processes that the user lacks permission to signal. Its scope is therefore confined by the caller's existing process-control permissions.

Remediation
View remediation

Remediation Suggestions

  1. Record the reminder process identifier in a user-owned PID file when starting it.
  2. Create the PID file in a private runtime directory with restrictive permissions.
  3. Before sending a signal, verify that:
    • The PID still exists
    • The process belongs to the current user
    • Its executable or script path matches the expected absolute path
  4. Send a graceful termination signal only to the validated PID.
  5. Remove stale PID files safely after shutdown.
  6. If using systemd, LaunchAgent, or Task Scheduler, use the platform's native stop operation rather than process-name matching.
  7. If a PID file cannot be used, employ an exact and uniquely assigned process identity instead of unrestricted full-command-line matching.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly promotes generation of executable background scripts and startup configuration, but it does not clearly warn users that these scripts will persist, run automatically, and may modify login/startup behavior. In an LLM skill context, this is risky because users may copy and run generated code without understanding the security implications of persistent execution or reviewing OS-specific autostart steps.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 67)May include surrounding context.

clawhub install ergocare-coach

Manual

mkdir -p ~/.openclaw/skills/ergocare-coach cp SKILL.md ~/.openclaw/skills/ergocare-coach/ openclaw reload-skills

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The team deployment example encourages organization-wide deployment of generated scripts without emphasizing code review, change control, endpoint policy approval, or administrative safeguards. In a multi-user environment, this increases the blast radius of any unsafe generated script or misconfiguration and can normalize unreviewed automation across many systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly promotes generating scripts that run as background processes and optionally persist at startup, but it does not prominently warn that these are system-affecting behaviors with operational and security implications. In an agent setting, this can normalize creation of persistence-enabled scripts without sufficient user consent, review, or safety guardrails, increasing the chance of unwanted long-running processes or abuse of the generated automation pattern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file describes when to use the skill with generic phrases such as "help!", "what do I do?", and "Generate my custom reminder script" without defining explicit activation constraints or negative examples. Those phrases overlap with common everyday requests and could cause unintended invocation in general wellness or support conversations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.