Debug Prompt Driven Cron Agent Zero Output

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:35 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent troubleshooting guide, but it is too tied to one real environment and directs broad local searches through private OpenClaw, workspace, source, and Obsidian paths.

Review this skill carefully before installing. It appears intended for a specific Discord/Obsidian/OpenClaw incident and should be sanitized before reuse: replace real paths and IDs with placeholders, narrow the trigger language, search exact job/run/output files first, ask before expanding to broad directories, and avoid returning unrelated match contents from private workspaces.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:181

Finding

Hardcoded User-Specific Paths and Operational Identifiers

Content

View full analysis

m.id === "1478785297784373490") ``` The package also contains the guild identifier `1478785964896817267`, multiple Discord thread identifiers, model and provider details, and the same environment-specific information in evaluation prompts. ### Technical Analysis The reusable Skill package embeds stable identifiers and absolute paths taken from a specific operating environment. The disclosed data includes: - A local operating-system username. - OpenClaw configuration and execution-history paths. - Personal Obsidian document locations. - A stable cron job UUID. - Discord user, guild, and thread identifiers. - Model and provider metadata associated with the job. These values are not credentials and do not directly grant access. Nevertheless, they expose environment topology and stable account identifiers that are unnecessary for implementing generic troubleshooting behavior. If the package is published, shared, indexed, or included in logs, an observer can correlate the local identity with Discord infrastructure and infer where operational records and personal documents are stored. The same values are repeated in `evals/evals.json`, increasi ...[truncated 1523 chars]

Remediation

View remediation

/cron/runs/.jsonl` - `/01-Daily/.md` 2. Replace production identifiers with clearly synthetic values: - `` - `` - `` - `` 3. Remove the case-specific task record from the distributable Skill or move it to a private incident report. 4. Sanitize `evals/evals.json` so evaluation prompts use synthetic fixtures rather than real paths and identifiers. 5. Add an automated release check that detects: - `/Users//` and other absolute home-directory paths. - UUIDs not present in an approved fixture list. - Discord Snowflake-like identifiers. - Provider, account, and local workspace metadata. 6. Keep any examples necessary for teaching ID-string handling, but use reserved synthetic identifiers that cannot be correlated with a real account. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:32

Finding

Overly Broad Local Filesystem Search Instructions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 75% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · references/discord-daily-sampling-contract.md (reported line 47)May include surrounding context.

text

scan parent messages
→ collect thread starters / thread ids
→ scan thread replies
→ merge messages
→ filter by author / mention / reply

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger description is unusually broad and includes many generic troubleshooting phrases such as tasks producing empty output, suspected sampling gaps, and locating retrieval-chain breakpoints. In an agentic environment, this can cause the skill to activate outside its intended niche and steer the system toward reading sensitive local paths, cron records, and user workspaces unnecessarily, increasing data exposure and unintended tool use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is configured to trigger with high confidence on broad, natural-language descriptions of debugging situations, but it does not define tight invocation boundaries or disambiguation checks. This can cause the skill to activate in unintended contexts and push the agent toward filesystem inspection, codebase searching, and operational guidance on sensitive local paths even when the user did not explicitly request this exact capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill file is written exclusively in Chinese and does not indicate that language selection is optional or limited to a justified region-specific context. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

Natural-language policy review applies to all file types. The user-facing prompt content is entirely in Chinese, but the file does not indicate that the skill is region-specific or that users may choose another language, which can amount to forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The document states that the business definition is specifically "Asia/Shanghai 的昨日" and prescribes +08:00 boundaries as fixed output. This is a natural-language locale constraint, and the file does not offer a user choice or explicitly justify that the skill is only for a China-specific deployment context.

Content

No source excerpt is available for this finding.