GoList

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:22 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent GoList shopping-list helper, but it automatically creates and displays sharing links and stores list/device identifiers locally without strong file protections.

Review this skill before installing if your shopping lists may contain private information. It should only be used if you are comfortable with GoList receiving list contents and with the agent automatically creating share links after new lists; prefer a version that asks before sharing and protects or limits the local state file.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: golist_cli.py:78
• Finding: Authorization-Related State Stored Without Restrictive File Permissions<![CDATA[ ## Vulnerability Details **File Location**: `golist_cli.py`, lines 78-94 **Vulnerability Type**: Insecure local storage of authorization-related state **Risk Level**: Medium ### Vulnerable Code ```python def save_state(state: RuntimeState) -> None: state_path = resolve_state_file() state_path.parent.mkdir(parents=True, exist_ok=True) with state_path.open("w", encoding="utf-8") as handle: json.dump( { "device_id": state.device_id, "active_list_id": state.active_list_id, "known_lists": [ { "id": known_list.id, "name": known_list.name, } for known_list in state.known_lists ], }, handle, indent=2, ) ``` ### Technical Analysis The CLI persists its device identifier, active list ID, known list IDs, and list names in `~/.openclaw_golist_state.json` or a path selected through `OPENCLAW_STATE_FILE`. The file is opened without an explicit restrictive permission mode. Its resulting permissions depend on the process umask and could allow other local users or processes to read it. The implementation also does not verify whether the target is a symbolic link, validate ownership, repair insecure permissions on an existing file, or write the state atomically. The device identifier is transmitted in the `X-Device-Id` header on every API request. If the GoList backend uses that identifier as an authentication or authorization identity, disclosure may allow another party to impersonate the device. Even if it is not sufficient for authentication, the state file reveals private list names and identifiers. ### Attack Path 1. A victim invokes a command that calls `ensure_device_id`, causing `save_state` to create or update the state file. 2. The state file is created with permissions derived from the current umask rather th ...[truncated 970 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Create the state file atomically with mode `0600`. - Ensure that a dedicated parent directory is created with mode `0700`. - Validate that the state path is a regular file owned by the current user. - Refuse to follow symbolic links when opening the state file. - Check and repair permissions on existing state files before reading sensitive values. - Write updates to a protected temporary file, flush and synchronize it, and atomically replace the destination. - Do not use a device UUID as the sole authentication secret. Use a revocable, scoped credential issued by the server. - Minimize persisted metadata and document that `OPENCLAW_STATE_FILE` must point to a private location. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:26
• Finding: Share Capability Is Generated and Exposed Without Explicit User Consent<![CDATA[ ## Vulnerability Details **File Locations**: `SKILL.md`, lines 26-27 and 59-65; `golist_cli.py`, lines 350-370 **Vulnerability Type**: Unnecessary creation and disclosure of a transferable share capability **Risk Level**: Medium ### Vulnerable Instructions ```markdown 6. Immediately after creating a new list, OpenClaw must always generate a share token and send the share URL to the user without being asked. 7. When talking to the user, OpenClaw must never refer to lists by ID; always use list names (use the stored name↔id mapping internally). ``` ```markdown ### 1) Create a new list ```bash python3 apps/openclaw/golist_cli.py create-list "Weekend groceries" python3 apps/openclaw/golist_cli.py share ``` Creates a list with a generated UUID, stores it in known lists, sets it as active, then immediately creates a share token and returns the share URL to the user. ``` ### Vulnerable Implementation ```python def cmd_share(state: RuntimeState, args: argparse.Namespace) -> None: device_id = ensure_device_id(state) known_list = resolve_list_reference(state, args.list) payload = api_request("POST", f"/v1/lists/{known_list.id}/share-tokens", device_id=device_id) if not isinstance(payload, dict): raise CliError("Unexpected API response while creating share token.") share_token = payload.get("shareToken") if not isinstance(share_token, str) or not share_token: raise CliError("Share token response was missing shareToken.") print( json.dumps( { "list": {"id": known_list.id, "name": known_list.name}, "shareToken": share_token, "shareUrl": f"https://go-list.app/?shareToken={share_token}", }, indent=2, ) ) ``` ### Technical Analysis The declared behavior mandates creation of a share token immediately after list creation, even when the user only requested a private list and did not request sharing. List creation it ...[truncated 1937 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the instruction that sharing must occur automatically after list creation. - Require a separate, explicit user request or confirmation before issuing a share token. - Explain that anyone possessing the token or URL may be able to access the list. - Avoid printing the raw token unless the user explicitly requests it. - Redact share tokens from logs, telemetry, exception messages, and retained agent traces. - Prefer short-lived, single-use, scoped tokens with server-side expiration and revocation. - Provide a command to list and revoke outstanding share tokens. - Return only the minimum user-facing information and avoid including the internal list ID in share output. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Session Persistence

Medium

• Category: Rogue Agent

Content

This folder contains an OpenClaw skill that makes GoList easy to try with OpenClaw.

GoList is a fast, simplistic app for creating and sharing grocery / shopping lists with other people. This skill gives new users a friendly, low-friction CLI flow to create a list, add items, and share it in seconds.

- `SKILL.md`: operational instructions and constraints for OpenClaw.
- `golist_cli.py`: Python CLI wrapper that executes list creation/join/share/read/item operations.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Purpose
Enable OpenClaw to manage GoList through a simple, beginner-friendly CLI wrapper around the backend API.

GoList is a simplistic app for creating and sharing grocery / shopping lists. This skill is designed to make first-time usage feel fast and approachable: create a list, add items, share with others, and switch between saved lists with minimal setup.

This skill supports:
- creating new lists,

• Confidence: 84% confidence
• Finding: The skill persists device IDs, active list IDs, and known list mappings across sessions, creating a local store of identifiers tied to shared shopping lists. If the state file is accessible to other local users, backups, or logs, it can leak relationship metadata and facilitate unauthorized reuse of session context or mistaken actions on previously used lists.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Purpose
Enable OpenClaw to manage GoList through a simple, beginner-friendly CLI wrapper around the backend API.

GoList is a simplistic app for creating and sharing grocery / shopping lists. This skill is designed to make first-time usage feel fast and approachable: create a list, add items, share with others, and switch between saved lists with minimal setup.

This skill supports:
- creating new lists,

• Confidence: 84% confidence
• Finding: The skill persists device IDs, active list IDs, and known list mappings across sessions, creating a local store of identifiers tied to shared shopping lists. If the state file is accessible to other local users, backups, or logs, it can leak relationship metadata and facilitate unauthorized reuse of session context or mistaken actions on previously used lists.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly requires generating and sending a share token/URL immediately after list creation, even if the user only asked to create a private list. That can expose access-bearing share links without an explicit user action or warning, increasing the chance of accidental disclosure through chat history, logs, screenshots, or downstream integrations.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Generates and persists device id when missing.
- Generates list IDs and item IDs when creating entities.
- Generates item `updatedAt` timestamps on write operations.
- Automatically sends `X-Device-Id` on every request.
- Persists known lists with friendly names and IDs, and tracks an active list.

### CLI state and environment

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Low

• Confidence: 62% confidence
• Finding: The instruction says the agent must never refer to lists by ID and must always use list names in user-facing communication. This is a natural-language/output policy constraint applied unconditionally rather than based on user preference or documented compliance need.

Static analysis

No suspicious patterns detected.