GoList

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:22 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent GoList shopping-list helper, but it automatically creates and displays sharing links and stores list/device identifiers locally without strong file protections.

Review this skill before installing if your shopping lists may contain private information. It should only be used if you are comfortable with GoList receiving list contents and with the agent automatically creating share links after new lists; prefer a version that asks before sharing and protects or limits the local state file.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: golist_cli.py:78

Finding

Authorization-Related State Stored Without Restrictive File Permissions

Content

View full analysis

None: state_path = resolve_state_file() state_path.parent.mkdir(parents=True, exist_ok=True) with state_path.open("w", encoding="utf-8") as handle: json.dump( { "device_id": state.device_id, "active_list_id": state.active_list_id, "known_lists": [ { "id": known_list.id, "name": known_list.name, } for known_list in state.known_lists ], }, handle, indent=2, ) ``` ### Technical Analysis The CLI persists its device identifier, active list ID, known list IDs, and list names in `~/.openclaw_golist_state.json` or a path selected through `OPENCLAW_STATE_FILE`. The file is opened without an explicit restrictive permission mode. Its resulting permissions depend on the process umask and could allow other local users or processes to read it. The implementation also does not verify whether the target is a symbolic link, validate ownership, repair insecure permissions on an existing file, or write the state atomically. The device identifier is transmitted in the `X-Device-Id` header on every API request. If the GoList backend uses that identifier as an authentication or authorization identity, disclosure may allow another party to impersonate the device. Even if it is not sufficient for authentication, the state file reveals private list names and identifiers. ### Attack Path 1. A victim invokes a command that calls `ensure_device_id`, causing `save_state` to create or update the state file. 2. The state file is created with permissions derived from the current umask rather th ...[truncated 970 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:26

Finding

Share Capability Is Generated and Exposed Without Explicit User Consent

Content

View full analysis

None: device_id = ensure_device_id(state) known_list = resolve_list_reference(state, args.list) payload = api_request("POST", f"/v1/lists/{known_list.id}/share-tokens", device_id=device_id) if not isinstance(payload, dict): raise CliError("Unexpected API response while creating share token.") share_token = payload.get("shareToken") if not isinstance(share_token, str) or not share_token: raise CliError("Share token response was missing shareToken.") print( json.dumps( { "list": {"id": known_list.id, "name": known_list.name}, "shareToken": share_token, "shareUrl": f"https://go-list.app/?shareToken={share_token}", }, indent=2, ) ) ``` ### Technical Analysis The declared behavior mandates creation of a share token immediately after list creation, even when the user only requested a private list and did not request sharing. List creation it ...[truncated 1937 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 5)May include surrounding context.

md

This folder contains an OpenClaw skill that makes GoList easy to try with OpenClaw.

GoList is a fast, simplistic app for creating and sharing grocery / shopping lists with other people. This skill gives new users a friendly, low-friction CLI flow to create a list, add items, and share it in seconds.

- `SKILL.md`: operational instructions and constraints for OpenClaw.
- `golist_cli.py`: Python CLI wrapper that executes list creation/join/share/read/item operations.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill persists device IDs, active list IDs, and known list mappings across sessions, creating a local store of identifiers tied to shared shopping lists. If the state file is accessible to other local users, backups, or logs, it can leak relationship metadata and facilitate unauthorized reuse of session context or mistaken actions on previously used lists.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

## Purpose
Enable OpenClaw to manage GoList through a simple, beginner-friendly CLI wrapper around the backend API.

GoList is a simplistic app for creating and sharing grocery / shopping lists. This skill is designed to make first-time usage feel fast and approachable: create a list, add items, share with others, and switch between saved lists with minimal setup.

This skill supports:
- creating new lists,

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill persists device IDs, active list IDs, and known list mappings across sessions, creating a local store of identifiers tied to shared shopping lists. If the state file is accessible to other local users, backups, or logs, it can leak relationship metadata and facilitate unauthorized reuse of session context or mistaken actions on previously used lists.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

## Purpose
Enable OpenClaw to manage GoList through a simple, beginner-friendly CLI wrapper around the backend API.

GoList is a simplistic app for creating and sharing grocery / shopping lists. This skill is designed to make first-time usage feel fast and approachable: create a list, add items, share with others, and switch between saved lists with minimal setup.

This skill supports:
- creating new lists,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly requires generating and sending a share token/URL immediately after list creation, even if the user only asked to create a private list. That can expose access-bearing share links without an explicit user action or warning, increasing the chance of accidental disclosure through chat history, logs, screenshots, or downstream integrations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

- Generates and persists device id when missing.
- Generates list IDs and item IDs when creating entities.
- Generates item `updatedAt` timestamps on write operations.
- Automatically sends `X-Device-Id` on every request.
- Persists known lists with friendly names and IDs, and tracks an active list.

### CLI state and environment

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 62% confidence

Finding

The instruction says the agent must never refer to lists by ID and must always use list names in user-facing communication. This is a natural-language/output policy constraint applied unconditionally rather than based on user preference or documented compliance need.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.