Driftwatch

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:26 AM UTC
• Version: 1.1.4

Overview

This appears to be a legitimate local OpenClaw workspace scanner, but it directs agents to always create persistent reports and may send workspace metadata as attachments without per-run consent.

Review this skill before installing in sensitive workspaces. It appears local and non-exfiltrating, but expect scan metadata to be saved under ~/.driftwatch and avoid letting an agent automatically send the HTML report over messaging platforms unless you have reviewed it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:35

Finding

Skill instructions force persistent branded report generation and promotional output

Content

View full analysis

Generated by Driftwatch — github.com/DanAndBub/driftwatch-skill ``` ### Technical Analysis The declared purpose of the Skill is to inspect workspace health and report truncation, compaction, hygiene, and trend findings. Producing an HTML report can support that purpose when requested, but the Skill instructions override the agent’s ordinary output discretion by requiring an HTML report for every non-check scan, requiring permanent timestamped storage, and requiring the report to be transmitted over supported messaging surfaces. This is broader than the minimum behavior necessary to perform a workspace scan. A conversatio ...[truncated 3294 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad workspace health and truncation analysis tool for OpenClaw, including compaction anchor health, bootstrap file checks, workspace hygiene, and drift tracking over time. The supplied code is much narrower: it opens a single file (AGENTS.md), parses ##/### headings, verifies specific recommended anchor sections from constants, measures their character counts against a cap, and emits warnings/info. While this partially overlaps with 'compaction anchor health' and bootstrap-file status, it does not implement the broader claimed functionality such as full workspace scanning, truncation simulation/risk analysis, hygiene checks, or drift tracking over time. Therefore the description materially overstates the tool's actual behavior and primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code does implement part of the declared description: it analyzes workspace hygiene and bootstrap/subagent file status. However, the declared purpose prominently includes truncation risks, compaction anchor health, and drift tracking over time, none of which are present in the supplied code. The implementation is limited to file existence/emptiness and extra markdown-file checks in the workspace root. This is a material description-to-behavior mismatch because key advertised capabilities are absent, even though there are no obvious undeclared dangerous capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The implemented code is narrowly focused on truncation simulation. It iterates over bootstrap files, reads file contents, calculates truncation thresholds, identifies danger zones, and reports affected lines/sections. This aligns with the truncation-related part of the description, but the declaration materially overstates the skill by claiming compaction anchor health, workspace hygiene, drift tracking over time, and broader workspace health/bootstrap status analysis. Those capabilities are not present in this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The code is narrowly focused on bootstrap truncation analysis: it iterates through a predefined bootstrap file order, reads files from the workspace, computes character counts, truncation head/tail zones, per-file and aggregate status, and a potential late-file budget starvation warning. This matches part of the declared purpose around truncation and bootstrap file status. However, the description materially overstates the skill’s capabilities by claiming compaction anchor health, workspace hygiene, and drift tracking over time, none of which are implemented in this chunk. The actual resource access is limited to bootstrap files in the provided workspace path, which is consistent with part of the description, but the broader health-analysis claims are unsupported. ამიტომ this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/trends.py (reported line 240)May include surrounding context.

python

def prune_history(history_dir):
    """Delete history files older than retention_days."""
    config, _ = _load_config()
    retention_days = config.get("retention_days", DEFAULT_RETENTION_DAYS)
    cutoff = datetime.now(timezone.utc) - timedelta(days=retention_days)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation phrases are broad enough to match common, high-frequency user requests such as scanning configs or analyzing a workspace. That increases the chance the skill is auto-selected in situations the user did not specifically intend, causing unnecessary access to local bootstrap and memory files and expanding the skill's effective reach beyond a narrow purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill directs the agent to read workspace files, inspect environment-derived paths, and write persistent HTML/JSON artifacts, but it declares no explicit tool scope or permission boundaries. In an agent ecosystem, this can cause overbroad execution authority and makes it harder for the platform or operator to constrain file-system and environment access to the minimum necessary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation guidance uses broad catch-all triggers for vague workspace-health questions, which can cause the agent to run a file-reading and file-writing skill in situations where the user did not specifically request those actions. Overbroad auto-invocation increases the chance of unnecessary access to local workspace data and unintended persistence of reports.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The skill instructs the agent to always create timestamped HTML reports under ~/.driftwatch/reports, introducing persistent local storage of workspace-analysis results by default. These reports may contain sensitive file names, structural metadata, and health findings, and automatic retention over time increases exposure if the host is shared or compromised.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

Always generate the HTML report when running a scan:

bash

mkdir -p ~/.driftwatch/reports
python3 {baseDir}/scripts/scan.py --html ~/.driftwatch/reports/driftwatch-$(date +%Y-%m-%dT%H%M).html

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

If all files are safe:

> "No truncation risk — all files are well under 18,000 characters. The danger zone simulation shows nothing at risk right now."

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The workflow and cron guidance encourage repeated saving of reports/history over time, which creates ongoing session persistence and a growing repository of potentially sensitive operational metadata. Longitudinal storage can reveal workspace evolution and internal practices, making compromise or accidental disclosure more damaging than a one-time scan.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

python3 {baseDir}/scripts/scan.py --check --save

Weekly review with trends + HTML report

mkdir -p ~/.driftwatch/reports python3 {baseDir}/scripts/scan.py --history --html ~/.driftwatch/reports/driftwatch-$(date +%Y-%m-%dT%H%M).html

text

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is presented as a local workspace scanner, but it also persists detailed scan reports to disk and includes externally oriented output content. In a workspace-health context, scan artifacts can contain sensitive metadata such as absolute paths, file names, growth trends, and hygiene findings; saving or repurposing that data beyond the immediate scan increases disclosure risk and expands the tool's behavior beyond the narrow stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

When --save is used, the scanner writes full scan reports into ~/.driftwatch/history/ without any in-flow warning that the report may contain sensitive workspace metadata. Because the report includes workspace paths, timestamps, module findings, and potentially hygiene or truncation details, it creates a local data-at-rest exposure that may persist longer than the operator expects.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · scripts/simulation.py (reported line 115)May include surrounding context.

python

"percent_of_limit": percent_of_limit,
                "simulation_needed": False,
                "status": "safe",
                "note": "Well under limit — no truncation risk",
            })
            continue

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code performs file deletion via os.remove for scan history entries older than the retention cutoff. Although the docstring notes deletion, there is no runtime confirmation, logging, or other user-visible disclosure in this file about which files are being removed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code injects a promotional note pointing users to an external website unrelated to the core local scanning function. Even though it does not itself perform a network request, embedding an unsolicited external reference in security tooling can steer users toward sharing potentially sensitive workspace data or trusting off-tool services, which is inappropriate for a local analysis skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The code generates and writes a self-contained HTML report to a user-supplied path, which is a file write operation covered by the warning requirement for code files. While the argument help states that an HTML report will be generated, there is no runtime disclosure or nearby explanatory comment about the write occurring at this stage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.