T06 · System Persistence
Error
- Location
strategies/Main.md:461- Finding
Automatic Cross-Session Follow-Up Scheduling Without Explicit Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
botlearn-graduate
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a legitimate OpenClaw graduation report tool, but it asks to gather and retain broad personal/workspace history and schedule future follow-ups without clear opt-in controls.
Review this skill carefully before installing. It is not showing evidence of malware or exfiltration code, but you should only use it if you are comfortable letting it analyze agent memory, workspace/document metadata, identity files, session history, skill usage, and feedback. Prefer running it only after an explicit OpenClaw graduation request, and do not allow saved reports, graph contribution, or scheduled follow-ups unless the host clearly asks for your consent and provides a way to review, delete, and cancel them.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
strategies/Main.md:33- Finding
Overbroad Collection of Workspace, Identity, and Session Information
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
strategies/Main.md:447- Finding
Persistent Storage and Secondary Use of an Aggregated Behavioral Profile
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list contains broad, common phrases like "retrospective," "graduate," "completion," and "week review" that can appear in ordinary conversations unrelated to this skill. This can cause unintended activation, leading the agent to inject a long, prescriptive workflow into unrelated contexts and potentially override the user's actual intent or expose internal journey-analysis behavior when not requested.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manual activation rule says the skill should run when a user says phrases like "day 7," "retrospective," or "graduate," but it does not define boundaries or confirmation steps. Because these terms are highly ambiguous, the skill may activate during unrelated discussions, causing context hijacking and unnecessary collection or synthesis of user history for a graduation report the user did not actually request.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This guidance explicitly encourages collecting a broad snapshot of user activity and state, including documents in memory, workflow patterns, and session/request history, but provides no minimization, consent, retention, or sensitive-data handling safeguards. In a graduation/reporting skill, this makes overcollection and unnecessary persistence of personal or sensitive behavioral data more likely, creating privacy and data exposure risk even if the author likely intended analytics rather than abuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instructions tell the agent to save and retain the graduation report for future check-ins without warning that the report may contain sensitive personal data, usage history, inferred traits, or behavioral summaries. Persisting such reports by default increases the chance of unauthorized access, secondary use, or long-term retention of data the user may not expect to be stored.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes broad phrases such as 'graduate', 'completion', 'my progress', and 'next steps', which are common in ordinary conversation and can cause unintended activation. In this skill, accidental activation is more risky because the workflow then performs broad data collection and analysis of workspace, session, and memory state.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The strategy directs collection of snapshots, session timestamps, configuration logs, workspace documents, skill usage, and user feedback, but provides no user-facing notice, consent, minimization, or retention limits. This creates a privacy risk because a retrospective request could silently aggregate sensitive behavioral and workspace data beyond what the user reasonably expects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill says to save a graduation record and automatically schedule future follow-ups, but it does not warn the user that state will be persisted or that proactive future contact may occur. This is dangerous because it normalizes hidden retention and outreach, which can surprise users and create privacy and trust issues.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs automatic follow-up scheduling at 14, 30, and 90 days even though the stated function is a graduation/retrospective report. That expands behavior from a one-time reflective task into proactive re-engagement and retention activity without clear user consent, which can lead to unexpected contact and persistence of user state.
- Content