Security audit

savenow

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent memory-saving purpose, but its command construction and preview/apply design create material risks around local command execution and unreviewed persistent memory writes.

Review before installing. Prefer plain /savenow with Apply/Cancel, avoid /savenow auto for sensitive conversations, and only allow trusted users to invoke explicit session keys. The maintainer should validate session/thread identifiers, invoke Node with shell-free argument arrays, and bind Apply to the reviewed entries snapshot or a verified digest.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:65
Finding: Shell Command Injection Through Unvalidated Session and Thread Identifiers
Content: View full analysis
" \ --message-thread-id "" \ --ttl-minutes 30 ``` ``` ### Technical Analysis The Skill permits the raw command argument to become an explicit `sessionKey`, then directs the Agent to interpolate that value and the runtime-provided `MessageThreadId` into a textual command. Wrapping an interpolated value in double quotes is not sufficient shell escaping. If a value contains a quote followed by shell syntax, it can terminate the quoted argument and introduce additional commands. For example, a value shaped like `" ; attacker-command ; #` may be interpreted as shell syntax rather than as a single session identifier. Validation inside `preview-diff.mjs` cannot prevent this issue because command substitution and parsing occur before the Node.js process starts. Exploitability depends on the OpenClaw runtime executing the documented command through a shell rather than using a shell-free argument-array API. ### Attack Path 1. An attacker submits `/savenow ` with quote characters and shell metacharacters embedded in the explicit session key. 2. The Skill accepts the raw argument as the resolved `sessionKey`. 3. The A ...[truncated 1079 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: scripts/preview-diff.mjs:191
Finding: Preview/Apply TOCTOU Allows Unreviewed Content to Enter Persistent Agent Memory
Content: View full analysis
" ``` ``` ### Technical Analysis The user approves content shown during the preview, but the apply operation is not cryptographically or structurally bound to that reviewed content. Although `preview-diff.mjs` stores `entries: parsedEntries` in the pending JSON, the apply instructions instead pass `pending.entriesFile` to the merge script. The entries file remains mutable between preview and Apply. No digest, content comparison, exclusive file ownership check, restrictive permission enforcement, or immutable per-preview storage protects it. Consequently, the file consumed during Apply may differ from the content displayed to the user. This is a time-of-check/time-of-use weakness affecting a long-term memory write. An attacker requires the ability to alter files in the workspace or cause another concurrent Agent action to overwrite the shared temporary entries file. ### Attack Path 1. The Skill writes candidate entries to `temp/savenow-entries.json`. 2. The preview script displays those entries and write ...[truncated 1393 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README documents /savenow auto as a mode that writes directly to the durable memory file while explicitly skipping the preview and Apply/Cancel confirmation flow. Because the skill persists conversation-derived content, bypassing confirmation increases the chance of unintended, sensitive, or low-quality data being stored durably, especially if the command is triggered casually or in the wrong session.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 159)May include surrounding context.
md
### Troubleshooting | Symptom | Likely cause | Fix | |--------------------------------------------------------------------------|----------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------| | `/savenow` isn't recognized | Skill folder is in the wrong place, or `SKILL.md` is missing / has invalid frontmatter. | Confirm the path matches the table above. `cat SKILL.md` should start with `---\nname: savenow`. | | Bot says `node: command not found` or similar | Node isn't on the PATH for the OpenClaw process. | Install Node 18+ and restart the agent so it sees the new PATH. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · README.md (reported line 159)May include surrounding context.
md
### Troubleshooting | Symptom | Likely cause | Fix | |--------------------------------------------------------------------------|----------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------| | `/savenow` isn't recognized | Skill folder is in the wrong place, or `SKILL.md` is missing / has invalid frontmatter. | Confirm the path matches the table above. `cat SKILL.md` should start with `---\nname: savenow`. | | Bot says `node: command not found` or similar | Node isn't on the PATH for the OpenClaw process. | Install Node 18+ and restart the agent so it sees the new PATH. |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown skill description introduces /savenow auto as a mode that writes directly, but it does not include a clear caution that this bypasses the safer preview/apply confirmation flow. Because the operation writes durable notes to workspace files automatically, users should be explicitly warned about the direct-write behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 0% confidence
Finding: No actionable natural-language policy violation is present in this file. The documented constraints are about platform surface, not language or locale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.