Floreo

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:22 AM UTC
• Version: 0.2.1

Overview

Floreo is a local journaling skill, but its package gives conflicting privacy and automation claims around cron jobs, background monitoring, and external sync.

Review this skill carefully before installing. Use it only in manual/local mode unless you understand and accept persistent cron jobs and any external sync. Do not enable integrations or import broad personal notes until the documentation clearly explains data scope, credential storage, privacy filtering, and how to disable or remove automation.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Warning

• Location: SKILL.md:2339

Finding

Optional Cron Configuration Creates Persistent Execution of Mutable User-Writable Scripts

Content

View full analysis

> ~/.openclaw/customers/{user_name}/floreo/.daily-prompt # Every Sunday at 8pm 0 20 * * 0 cd ~/.openclaw/customers/{user_name}/floreo && ./generate-weekly-reflection.sh ``` ### Technical Analysis The Skill instructs users to register recurring cron jobs that survive the current Skill or Agent session. These jobs execute shell scripts stored beneath a user-writable Floreo directory. Cron therefore turns later changes to those scripts into unattended code execution under the account that installed the jobs. Scheduled report generation is related to the declared optional automation feature, so the mechanism is not inherently unrelated or a demonstrated backdoor. However, cron persistence is not required for the core journaling functionality and exceeds the minimum privileges needed for manual entry, local analysis, and on-demand report generation. The instructions do not provide: - Script ownership or permission validation. - Integrity verification before scheduled execution. - A protected installation directory for executable files. - Logging or failure handling. - A documented removal or disable procedure. - A clear confirmation step explaining that the configura ...[truncated 1127 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:176

Finding

Unvalidated Profile Identifier Is Interpolated into Filesystem Paths

Content

View full analysis

/dev/null || echo "default") # Use in paths mkdir -p ~/.openclaw/customers/$user_name/floreo/domains/work echo "Entry for $user_name" ``` The same value is later used in report operations: ```bash user_name=$(cat ~/.openclaw/customers/.floreo-user 2>/dev/null || echo "default") date_str=$(date +%d-%m-%y) date_iso=$(date +%Y-%m-%d) day_of_year=$(date +%j) report_file="~/.openclaw/customers/$user_name/floreo/insights/daily-report-$date_iso.md" # Collect today's entries (native + imported with original dates) # NOTE: Uses date_str from filename (original entry date), not file modification time # This means imported historical entries show up on their ORIGINAL date, not import date today_entries=$(find ~/.openclaw/customers/$user_name/floreo/domains -name "$date_str.md" 2>/dev/null) ``` ### Technical Analysis The contents of `~/.openclaw/customers/.floreo-user` are treated as trusted pathname data. The documentation allows this file to be overwritten but does not constrain the identifier to a safe character set. A value containing path separators or traversal components such as `../` can move filesystem operations outside the intended customer directory. Unquoted uses of `$user_name` also permit whitespace splitting and wildcard expansion. These issues affect commands that create directories, search files, generate reports, copy data, and scan journal content. There is an additional correctness issue in assignments such as: ```bash report_file="~/.openclaw/customers/$user_name/floreo/insights/daily-report-$date_iso.md" ``` A tilde inside quotes is not expanded by the shell. Conseque ...[truncated 1535 chars]

Remediation

View remediation

&2 exit 1 ;; esac ``` 2. Reject `/`, `\`, `..`, control characters, whitespace, glob characters, and leading option characters. 3. Build paths from `$HOME`, not a quoted tilde: ```bash base_dir="$HOME/.openclaw/customers/$user_name/floreo" ``` 4. Quote every pathname expansion: ```bash mkdir -p "$base_dir/domains/work" find "$base_dir/domains" -name "$date_str.md" ``` 5. Canonicalize the resulting directory and verify that it remains beneath `$HOME/.openclaw/customers`. 6. Store a generated opaque identifier separately from the display name so human-readable names never become raw path components. 7. Apply the same validation consistently to all import, migration, analysis, report, and cron examples. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:548

Finding

Predictable Shared Temporary Files Permit Symlink Overwrite and Journal Disclosure

Content

View full analysis

/tmp/timeline.md ``` A second fixed temporary file is used for weekly analysis: ```bash # Compile this week's entries week_start=$(date -v-sun -v-7d +%d-%m-%y) week_end=$(date -v-sat +%d-%m-%y) echo "# Weekly Reflection: $week_start to $week_end" > /tmp/weekly.md echo "" >> /tmp/weekly.md for domain in work health learn relate create reflect; do echo "## $domain" >> /tmp/weekly.md find ~/.openclaw/customers/{user_name}/floreo/domains/$domain -name "*.md" -mtime -7 -exec cat {} \; >> /tmp/weekly.md echo "" >> /tmp/weekly.md done ``` ### Technical Analysis The commands create files with predictable names in the shared `/tmp` directory using normal shell redirection. Shell redirection follows existing symbolic links. No exclusive creation, ownership check, restrictive `umask`, or cleanup is used. On a multi-user system, another local account can anticipate these filenames and create a symbolic link before the Floreo command runs. The victim’s shell then writes journal content through that link. Separately, the resulting temporary file may be readable by other local users depending on the account’s umask and platform defaults. The timeline command also performs command substitution over `find` output: ```bash cat $(find ... | sort) ``` This is unsafe for filenames containing whitespace, newlines, or leading hyphens and can cause incorrect file selection. It should be replaced with null-delimited processing. ### Attack Path 1. A local attacker predicts `/tmp/timeline.md` or `/tmp/weekly.md`. 2. The attacker creates that pathname as a symbolic link to a file writable by the victim, or monito ...[truncated 803 chars]

Remediation

View remediation

"$timeline_file" ``` 6. Ensure generated files containing private health or journal information use mode `0600`. ]]>

other

Note

• Location: RELEASE_v0.2.0.md:12

Finding

Bundled Security Claims Contradict Documented Persistence and Integration Behavior

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 694)May include surrounding context.

enclaw/customers/{user_name}/floreo/domains/work/2026/04/15-04-26.md Then append a summary to ~/.openclaw/customers/{user_name}/memory/15-04-26.md

text

### Import from Memory

Read ~/.openclaw/customers/{user_name}/memory/14-04-26.md Parse entries and write them to appropriate Floreo domain files with privacy: private

text

---

## Automation with Cron

### Daily Entry Prompt

```bash
# Add to crontab
0 21 * * * echo "What did you work on today?" >> ~/.openclaw/customers/{user_name}/floreo/.daily-prompt

Weekly Summary

bash

# Every Sunday at 8pm
0 20 * * 0 cd ~/.openclaw/customers/{user_name}/floreo && ./generate-weekly-reflection.sh

---

Tips & Best Practices

1. Use Consistent Date Formats

Always use DD-MM-YY for entry dates and YYYY/MM/DD for directory structure.

2. Unique Entry IDs

Generate with: FE-$(date +%Y%m%d)-$(openssl rand -hex 3 | tr '[:lower:]' '[:upper:]')

3. Tag Consistently

Use lowercase, hyphenated tags: deep-work, `clien

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The import principles say imports preserve original dates and are idempotent based on entry_id. But the actual import script writes to paths based on $(date +%Y), $(date +%m), $(date +%d-%m-%y) and creates random IDs with openssl rand, so re-imports would create new entries dated 'today' instead of preserving source dates.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 2671)May include surrounding context.

md

All documentation in one `SKILL.md`:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · RELEASE_v0.2.0.md (reported line 22)May include surrounding context.

md

- ❌ No automatic detection of git commits, meetings, etc.

### What This Skill DOES Do
- ✅ **Manual entry only** — You explicitly create every entry
- ✅ **Local storage** — All data in `~/.openclaw/customers/{name}/floreo/`
- ✅ **Optional shell scripts** — Run analysis only when you invoke them
- ✅ **100% offline** — No cloud services or external dependencies

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The philosophy section explicitly states there are no custom scripts and that the skill is 'Pure OpenClaw.' However, the rest of the document includes many #!/bin/bash scripts and scheduled cron jobs implementing core behavior, which directly contradicts that claim rather than merely adding detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill promotes syncing journal data to external services and storing API keys, but it does not pair that with prominent warnings about privacy exposure, data minimization, third-party retention, or accidental export of private/internal entries. Because the skill manages sensitive life logs, external sync materially increases the risk of disclosure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger language is broad enough to overlap with normal user requests, increasing the chance the skill activates in contexts where the user did not intend journaling, import, or cross-file operations. In a skill that reads memory, scans files, and writes reports, accidental activation can lead to unintended collection or propagation of sensitive content.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The weekly review command concatenates raw content from all domains into a single summary file, including potentially sensitive private entries. Centralizing disparate personal data into one artifact increases the blast radius of any accidental sharing, later export, or unauthorized read.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The memory sync/import workflows instruct reading personal memory files and reproducing their contents into other files, which can duplicate sensitive information and spread it into broader-access locations. This increases the likelihood of data leakage through subsequent searches, exports, reports, or integrations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The bulk import instructions encourage ingesting personal historical notes into managed storage and timeline/reporting flows without a strong warning that sensitive content will be copied, indexed, and subsequently included in searches or reports. That creates a realistic privacy risk through over-collection and later secondary use.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The automated daily/weekly/monthly report logic aggregates same-day or recent raw entry content across domains into consolidated files. Since entries may contain private health, work, relationship, or imported note data, this broad aggregation expands exposure and bypasses least-privilege handling, especially if reports are later synced or shared.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The maintainability section asserts zero external dependencies, no API keys, and offline-only operation. Earlier sections explicitly describe optional Notion/GitHub/Calendar/Slack integrations and storing API keys in ~/.openclaw/customers/.floreo-config, which is a direct contradiction in the skill's own documentation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section claims resilience because there are no API integrations, yet the skill earlier advertises optional connections to Notion, GitHub, Calendar APIs, and Slack webhooks. That is an active contradiction about the skill's actual intended capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest repeatedly advertises 'autonomous', 'auto-detects activities', 'open connections', and 'scheduled shell scripts' without stating concrete activation boundaries, approval requirements, or default-off behavior. In a skill that monitors files, calendars, git activity, and synchronizes with external services, ambiguous autonomy increases the risk of over-collection, unintended execution, or surprise data egress if the runtime or user assumes broad permission from the manifest language.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The search terms include very broad phrases such as 'productivity', 'health tracking', 'work tracking', 'habit tracker', and 'life logging', which can cause the skill to match generic user intents unrelated to this specific capability set. Because the skill also claims autonomous monitoring and integrations, overbroad discoverability can lead users to invoke or install a high-privilege skill in contexts where they did not expect background tracking or external sync features.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.