Behavior Tracker

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:37 PM UTC
• Version: 1.1.0

Overview

This skill openly performs local conversation-derived behavior tracking and report generation, with privacy caveats but no evidence of hidden exfiltration, destructive behavior, or unrelated privilege use.

Install only if you want local conversation-derived behavior tracking. Review the OpenClaw workspace memory directory before use, avoid enabling cron or heartbeat automation unless you are comfortable with ongoing analysis, and delete the generated behavior files if you later want to remove the profile.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tainted flow: 'BEHAVIOR_FILE' from os.environ.get (line 16, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

"""保存行为数据"""
    data["last_updated"] = datetime.now().isoformat()
    BEHAVIOR_FILE.parent.mkdir(parents=True, exist_ok=True)
    with open(BEHAVIOR_FILE, 'w') as f:
        json.dump(data, f, indent=2, ensure_ascii=False)

def extract_from_memory(date_str=None):

• Confidence: 91% confidence
• Finding: The output path for behavior-patterns.json is derived from environment-controlled base directories (OPENCLAW_DIR/OPENCLAW_WORKSPACE) and is written without validation or confinement checks. An attacker who can influence the environment can redirect writes to unintended files or locations, which is especially concerning because this skill persistently stores conversation-derived profiling data.

Tainted flow: 'report_file' from os.environ.get (line 194, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

# 3. 生成报告
    report = generate_report(analysis, data)
    report_file = MEMORY_DIR / "behavior-report.md"
    with open(report_file, 'w') as f:
        f.write(report)
    
    print(f"[{datetime.now()}] ✅ 分析完成!")

• Confidence: 90% confidence
• Finding: The report file path is also rooted in MEMORY_DIR, which is derived from environment variables, so the markdown report can be written to attacker-chosen locations if the runtime environment is manipulated. Because the report summarizes behavior patterns from conversations, misdirected writes can leak sensitive profiling data or overwrite files in other directories.

Tainted flow: 'BEHAVIOR_FILE' from os.environ.get (line 13, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

return {"topics": {}, "projects": {}, "skills": {}}

def save_data(data):
    with open(BEHAVIOR_FILE, 'w') as f:
        json.dump(data, f, indent=2, ensure_ascii=False)

def record(topic=None, project=None, skill=None, note=None):

• Confidence: 87% confidence
• Finding: The script derives its storage path from the OPENCLAW_WORKSPACE environment variable and then writes to that path without validation. An attacker who can influence the environment could redirect writes to an unintended file location, causing unauthorized file overwrite within the privileges of the running process.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises automatic recording and analysis, and the detected capabilities include environment access plus file read/write, but no permissions are declared to inform or constrain that behavior. This creates a transparency and consent gap: a user or hosting platform cannot easily assess that the skill may persistently read local data and write profiling artifacts, which increases privacy and data-handling risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose suggests conversation-based behavior analysis, but the observed behavior extends to parsing local memory/workspace files, persisting reports, and exposing manual recording functions. That mismatch is dangerous because users may consent to one class of processing while the skill actually performs broader collection and persistence, enabling unexpected surveillance or data exposure.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill description says it records and analyzes behavior patterns, but the implementation also persists derived long-term profiles to disk, creating a durable behavioral dataset beyond transient analysis. In a conversation-analysis context, silent retention of derived profiling data increases privacy risk and broadens the data processing surface beyond what many users would reasonably expect.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: Generating a standalone behavior-report.md file creates an additional persistent artifact containing behavioral summaries, which materially expands the skill's data handling beyond simple recording/analysis. In this skill context, that report may expose sensitive inferences about the user and increases the number of locations where profiling data can be accessed or leaked.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger condition 'Auto call after each important conversation' is undefined and overly broad, which can cause the skill to run on far more interactions than a user expects. In a profiling skill, ambiguous automation increases the likelihood of silent collection of sensitive or irrelevant conversational data without clear user intent.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill describes automatic recording and behavior analysis but does not warn users that it performs behavioral profiling or persistent storage-related actions. For a tool centered on tracking habits, interests, and active hours, missing disclosure undermines informed consent and materially increases privacy risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script reads conversation memory files, extracts topics/projects/skills, and persistently stores behavioral profiles and reports without any disclosure, consent, or apparent user control. In a behavior-tracking skill, this context makes the issue more dangerous because it builds longitudinal user profiling from conversations, creating significant privacy and surveillance risk even without a conventional code-execution flaw.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script persists conversation-derived behavioral metadata to a local JSON file without any notice, consent, retention policy, or access controls. In the context of a skill explicitly tied to recording user behavior from conversations, silent retention increases privacy risk and can expose sensitive usage patterns to other local users, backups, or later compromise.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The skill is explicitly designed to automatically record and analyze user behavior patterns, yet it provides no clear scoping, minimization, or user-boundary rules. In context, that makes the data-collection risk more serious because profiling dimensions like interests, activity times, and learning habits can reveal sensitive personal patterns even without overtly secret content.

VirusTotal

56/56 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.