Security audit

Home Todo

Security checks for vulnerabilities and agentic risk

Overview

This skill keeps a local home todo list and reminders, with broad automatic reminder and capture behavior that is disclosed but worth understanding before use.

Install this only if you are comfortable with home todo reminders being added to every Dashboard response and with matching “home todo” statements from connected channels being saved in a local markdown file. Avoid putting sensitive personal details in those todo items, and periodically review or delete ~/.openclaw/workspace/.home-todos.md.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

High

Confidence: 97% confidence
Finding: The skill auto-triggers on any Dashboard message, regardless of user intent or relevance. That creates unnecessary file access and unsolicited behavior on every interaction, increasing privacy exposure and the chance the skill surfaces personal todo data in unrelated conversations.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The skill description and operational text are entirely in Chinese and prescribe a fixed Chinese interaction pattern without offering the user any language or locale choice. Under the language/locale policy rule, forcing a specific language without opt-in is a natural-language policy concern unless clearly justified as region-specific.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The instruction to record todos from 'any channel' is overly broad and ambiguous, allowing persistent capture of user statements outside the immediate skill context. This can collect sensitive or unintended content and turn casual messages into stored records without clear consent boundaries.

Ssd 3

Medium

Confidence: 97% confidence
Finding: Persistently storing natural-language statements from any channel creates a real data retention risk because messages may contain sensitive personal information, context, or accidental commands. The danger is amplified by indefinite retention in a local file and by the lack of minimization, consent, or deletion policy.

Static analysis

No suspicious patterns detected.