BotLearn Healthcheck

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:59 AM UTC
• Version: 1.0.7

Overview

This health-check skill has a coherent diagnostic purpose, but it asks for broad autonomous access to sensitive OpenClaw files and writes persistent reports without clear pre-run consent or scoping.

Review before installing. This skill is not showing exfiltration or automatic destructive behavior, but it can inspect sensitive OpenClaw configuration, logs, identity/workspace files, and security data, then store reports locally. Use it only if you are comfortable with that access, and prefer a version that requires explicit consent before collection, narrows triggers to OpenClaw-specific phrases, minimizes raw file reads, and defines report retention/deletion controls.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:37
• Finding: Overbroad Autonomous Collection of Sensitive OpenClaw Data## Vulnerability Details **File Location**: `SKILL.md`, lines 37 and 93–101 **Vulnerability Type**: Excessive access to sensitive configuration, operational, and identity data **Risk Level**: Medium ### Vulnerable Code ```markdown > Collect all data autonomously. Never ask the human to execute commands. ``` ```markdown | `DATA.openclaw_json` | direct read `$OPENCLAW_HOME/openclaw.json` | Raw config for cross-validation | | `DATA.cron` | direct read `$OPENCLAW_HOME/cron/*.json` | Scheduled task definitions | | `DATA.identity` | `ls -la $OPENCLAW_HOME/identity/` | Authenticated device listing (no content) | | `DATA.gateway_err_log` | `tail -200 $OPENCLAW_HOME/logs/gateway.err.log` | Recent gateway errors (redacted) | | `DATA.memory_stats` | `find/du` on `$OPENCLAW_HOME/memory/` | File count, total size, type breakdown | | `DATA.heartbeat` | direct read `$OPENCLAW_HOME/workspace/HEARTBEAT.md` | Last heartbeat timestamp + content | | `DATA.models` | direct read `$OPENCLAW_HOME/agent/models.json` | Model contextWindow, maxTokens per model | | `DATA.cache` | `openclaw cache stats` | Cache size, history count, index size | | `DATA.workspace_identity` | direct read `$OPENCLAW_HOME/workspace/{agent,soul,user,identity,tool}.md` | Presence + word count + content depth of 5 identity files | ``` ### Technical Analysis The Skill instructs the agent to collect system data autonomously and directly read raw OpenClaw configuration, scheduled-task definitions, logs, heartbeat content, model configuration, and workspace identity documents. Reading the full contents of heartbeat and identity files is broader than necessary for checks limited to presence, freshness, size, or structural health. Raw configuration files and logs may contain credentials, identifiers, endpoint details, user information, or operational metadata. Although the Skill separately requires redaction before output, it does not define collection-time field allowlist ...[truncated 2076 chars]
• Remediation: ## Remediation Suggestions 1. Replace full-file collection with strict field allowlists containing only values required for each health check. 2. Check workspace identity documents using metadata such as existence, size, permissions, and modification time; do not read their contents by default. 3. Parse `openclaw.json` locally and remove tokens, passwords, API keys, cookies, private endpoints, and unrelated fields before passing results to the agent. 4. Sanitize gateway logs before loading them into the model context, using explicit patterns for credentials, authorization headers, URLs with secrets, and personal identifiers. 5. Require explicit user consent before reading heartbeat content, cron definitions, raw configuration, or workspace identity documents. 6. Keep raw collected data out of persistent reports. Reports should contain only derived health findings and sanitized metrics. 7. Apply restrictive permissions to the report directory and define a retention or automatic-deletion policy. 8. Add tests using synthetic secrets to verify that sensitive values cannot reach agent output or generated Markdown and HTML reports.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to collect all data autonomously and never ask the human to execute commands, while Phase 1 enumerates access to logs, configs, identity directories, cron definitions, workspace files, and security data. Without an upfront consent notice that clearly describes this breadth of access, users may unknowingly expose sensitive local information.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad, everyday phrases like 'doctor', 'troubleshoot', and 'what's wrong', plus very short Chinese triggers, which can cause the skill to activate during normal conversation rather than an intentional health audit. In this skill's context, unintended activation is more dangerous because activation leads to autonomous collection of extensive system, log, config, identity, and security data.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file mandates that all output must be in the user's native language and later specifies automatic detection with "Other → English (default)." This imposes a language choice without offering the user an explicit preference or opt-in, which is a natural-language policy concern under locale/language constraints.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The mode table says a 'general query' should trigger a Full Check but never defines what qualifies as a general query. That ambiguity can cause accidental execution of a high-privilege diagnostic workflow in response to loosely related user input, increasing the chance of unauthorized or surprising data access.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill writes persistent health reports to disk under the memory directory, but the user is not warned in advance that potentially sensitive diagnostics will be stored locally. This increases privacy and data-retention risk, especially because reports may include summarized security findings, configuration metadata, and historical comparisons.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

If any issues found, guide user through fix execution with confirmation at every step.
Show fix command + rollback command → await confirmation → execute → verify.

**Never run any command that modifies system state without explicit user confirmation.**

Read **`flow_fix.md`** for: safety rules, per-fix protocol, batch mode, scope limits.
Reference **`fix_cases.md`** for proven fix steps, rollback commands, and prevention strategies.

• Confidence: 87% confidence
• Finding: The fix phase permits execution of arbitrary commands after user confirmation, but it does not meaningfully constrain command classes, target paths, or trust boundaries. In a skill that also reads external markdown procedures like 'flow_fix.md' and 'fix_cases.md', this can enable unsafe or overly broad command execution if those instructions are compromised, mistaken, or socially engineered.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 84% confidence
• Finding: The trigger '体检' is very short and generic, making accidental activation plausible in unrelated conversation. Because this skill performs broad autonomous diagnostics upon activation, even a low-friction trigger raises the risk of unintended sensitive data collection.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 84% confidence
• Finding: The trigger '修复' is overly generic and may match ordinary requests unrelated to this product or skill. In this context, accidental activation is especially risky because the skill can proceed into diagnostics and later propose system-modifying fixes.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 84% confidence
• Finding: The trigger '诊断' is broad and likely to collide with normal troubleshooting language. Given that activation can initiate collection across configs, logs, identity metadata, and security posture, the trigger creates unnecessary risk of unintended inspection.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: Phase 0 supports only Chinese and English, with all other languages collapsed to English by default. This is a locale policy limitation because it constrains user communication to a fixed subset of languages rather than offering preference selection or justified regional scope.

Static analysis

No suspicious patterns detected.