Debug Prompt Driven Cron Agent Zero Output

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:35 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent troubleshooting guide, but it is too tied to one real environment and directs broad local searches through private OpenClaw, workspace, source, and Obsidian paths.

Review this skill carefully before installing. It appears intended for a specific Discord/Obsidian/OpenClaw incident and should be sanitized before reuse: replace real paths and IDs with placeholders, narrow the trigger language, search exact job/run/output files first, ask before expanding to broad directories, and avoid returning unrelated match contents from private workspaces.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:181
• Finding: Hardcoded User-Specific Paths and Operational Identifiers<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:22-24, 34-40, 55-56, 71-83, 181-218, 255`; `evals/evals.json:6-45` **Vulnerability Type**: Plaintext disclosure of environment-specific metadata **Risk Level**: Medium ### Vulnerable Code Snippet ```json { "id": "c6e92d09-5ff6-4079-b839-a9c4fe6d2e10", "name": "obsidian-discord-guild-daily-review-final", "schedule": { "expr": "0 5 * * *", "tz": "Asia/Shanghai" } } ``` ```text /Users/can4hou6joeng4/.openclaw/cron/jobs.json /Users/can4hou6joeng4/.openclaw/cron/runs/c6e92d09-5ff6-4079-b839-a9c4fe6d2e10.jsonl /Users/can4hou6joeng4/Documents/Obsidian/Second Brain/01-Daily/2026-03-13.md /Users/can4hou6joeng4/Documents/Obsidian/Second Brain/00-Inbox/Daily Sync Digest - 2026-03-13.md ``` ```js author.id === "1478785297784373490" mentions.some(m => m.id === "1478785297784373490") ``` The package also contains the guild identifier `1478785964896817267`, multiple Discord thread identifiers, model and provider details, and the same environment-specific information in evaluation prompts. ### Technical Analysis The reusable Skill package embeds stable identifiers and absolute paths taken from a specific operating environment. The disclosed data includes: - A local operating-system username. - OpenClaw configuration and execution-history paths. - Personal Obsidian document locations. - A stable cron job UUID. - Discord user, guild, and thread identifiers. - Model and provider metadata associated with the job. These values are not credentials and do not directly grant access. Nevertheless, they expose environment topology and stable account identifiers that are unnecessary for implementing generic troubleshooting behavior. If the package is published, shared, indexed, or included in logs, an observer can correlate the local identity with Discord infrastructure and infer where operational records and personal documents are stored. The same values are repeated in `evals/evals.json`, increasi ...[truncated 1523 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace all absolute paths with neutral variables or placeholders: - `$HOME/.openclaw/cron/jobs.json` - `<OPENCLAW_HOME>/cron/runs/<JOB_ID>.jsonl` - `<OBSIDIAN_VAULT>/01-Daily/<DATE>.md` 2. Replace production identifiers with clearly synthetic values: - `<JOB_ID>` - `<GUILD_ID>` - `<TARGET_USER_ID>` - `<THREAD_ID>` 3. Remove the case-specific task record from the distributable Skill or move it to a private incident report. 4. Sanitize `evals/evals.json` so evaluation prompts use synthetic fixtures rather than real paths and identifiers. 5. Add an automated release check that detects: - `/Users/<name>/` and other absolute home-directory paths. - UUIDs not present in an approved fixture list. - Discord Snowflake-like identifiers. - Provider, account, and local workspace metadata. 6. Keep any examples necessary for teaching ID-string handling, but use reserved synthetic identifiers that cannot be correlated with a real account. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:32
• Finding: Overly Broad Local Filesystem Search Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32-46` **Vulnerability Type**: Excessive local filesystem access beyond least-privilege search boundaries **Risk Level**: Medium ### Vulnerable Code Snippet ```text /Users/can4hou6joeng4/.openclaw/workspace /Users/can4hou6joeng4/.openclaw /Users/can4hou6joeng4/Documents/code/Ours ``` ```text obsidian-discord-guild-daily-review-final c6e92d09-5ff6-4079-b839-a9c4fe6d2e10 1478785297784373490 Conversation info thread starter message_reference mentions dispatch ``` The Skill directs the Agent to search an entire OpenClaw directory tree, a workspace, and a separate source-code directory for these values. ### Technical Analysis The troubleshooting objective legitimately requires locating the implementation of a cron job. However, the prescribed search scope includes the complete `.openclaw` hierarchy and a separate source-code tree rather than narrowly scoped implementation directories. A recursive search of these roots may inspect unrelated configuration, conversation state, execution histories, proprietary source code, or other private files. Matching content can then be returned through tool output and placed in the Agent's active context. The Skill provides no explicit controls for: - Obtaining authorization before searching each directory. - Limiting searches to the affected job and expected implementation folders. - Excluding secrets, credentials, memory, history, version-control internals, or personal content. - Restricting output to filenames rather than matching file contents. - Redacting unrelated data from search results. No evidence shows that the Skill modifies permissions, bypasses access controls, or exfiltrates the collected data. The issue is an excessive-access design that can expose data available under the Agent's existing filesystem permissions. ### Attack Path 1. A user invokes the Skill to diagnose an empty cron result. 2. The Agent follows the instructions and recursivel ...[truncated 1288 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user authorization before reading outside the specific job, run-record, and output files supplied for the incident. 2. Use a staged, least-privilege search strategy: - Inspect the exact cron job configuration first. - Inspect only the corresponding run-record file. - Search approved `skills`, `scripts`, and `templates` directories. - Expand the scope only after the user approves it. 3. Avoid recursively searching the complete `.openclaw` directory by default. 4. Add explicit exclusions for sensitive locations and file types, including: - Credential and token stores. - `.env` files. - Memory, history, and conversation archives. - Private keys and certificates. - `.git` internals. 5. Prefer filename-only searches initially. Read matching file contents only after validating that the file is relevant. 6. Limit output to the minimum matching fields and redact unrelated values. 7. Replace hardcoded external source-tree paths with a user-provided, validated project root. 8. Document that discovered text is untrusted data and must not be interpreted as Agent instructions or executable commands. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Context Leakage

High

• Category: Data Exfiltration

Content

```text
scan parent messages
→ collect thread starters / thread ids
→ scan thread replies
→ merge messages
→ filter by author / mention / reply

• Confidence: 75% confidence
• Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger description is unusually broad and includes many generic troubleshooting phrases such as tasks producing empty output, suspected sampling gaps, and locating retrieval-chain breakpoints. In an agentic environment, this can cause the skill to activate outside its intended niche and steer the system toward reading sensitive local paths, cron records, and user workspaces unnecessarily, increasing data exposure and unintended tool use.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill is configured to trigger with high confidence on broad, natural-language descriptions of debugging situations, but it does not define tight invocation boundaries or disambiguation checks. This can cause the skill to activate in unintended contexts and push the agent toward filesystem inspection, codebase searching, and operational guidance on sensitive local paths even when the user did not explicitly request this exact capability.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire skill file is written exclusively in Chinese and does not indicate that language selection is optional or limited to a justified region-specific context. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale policy violation.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: Natural-language policy review applies to all file types. The user-facing prompt content is entirely in Chinese, but the file does not indicate that the skill is region-specific or that users may choose another language, which can amount to forcing a specific language without opt-in.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The document states that the business definition is specifically "Asia/Shanghai 的昨日" and prescribes +08:00 boundaries as fixed output. This is a natural-language locale constraint, and the file does not offer a user choice or explicitly justify that the skill is only for a China-specific deployment context.

Static analysis

No suspicious patterns detected.