Weekly Content Brief: Free OpenClaw Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:46 AM UTC
• Version: 1.0.0

Overview

The skill does what it advertises, but it sets up an ongoing autonomous WhatsApp briefing that reads recent agent session logs and sends summaries externally without per-message approval or clear removal controls.

Review this carefully before installing. It is not clearly malicious, but it will create an ongoing scheduled task that can read recent agent session logs and send a generated summary to WhatsApp. Prefer a version that uses a dedicated content-status file instead of general session logs, previews each message before sending, and documents how to disable or remove the cron job.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Warning

• Location: SKILL.md:43

Finding

Persistent Autonomous Cron Job Without Expiration or Removal Guidance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43-60
Vulnerability Type: Persistent scheduled task
Risk Level: Medium

Vulnerable Code

markdown

**Cron Setup**

Run this command once in the browser console as the claw user. Replace `[YOUR_TIMEZONE]` with your timezone. Common examples: `America/New_York`, `Europe/London`, `Africa/Nairobi`, `Asia/Singapore`.

Full timezone list: [https://en.wikipedia.org/wiki/List_of_tz_database_time_zones](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones). Use the value in the TZ identifier column.

PATH=/home/claw/.npm-global/bin:$PATH openclaw cron add --name "Weekly Content Brief" --cron "0 8 * * 1" --message "Show me this week's content brief" --tz "[YOUR_TIMEZONE]" --announce

text

Confirm it was created:

PATH=/home/claw/.npm-global/bin:$PATH openclaw cron list

text

The job should appear with status `idle`. It will run automatically next Monday at 8 AM.

Technical Analysis

The installation procedure creates a recurring OpenClaw cron job that persists beyond the session in which the skill is configured. It automatically invokes an agent every Monday and enables announcement behavior.

Although recurring execution is an advertised feature, the setup does not provide an expiration date, execution limit, disable procedure, or removal command. It also does not require per-run confirmation before accessing local information and initiating outbound messaging. Consequently, the task may continue operating after the user has forgotten about it or no longer expects it to run.

Attack Path

1. A user follows the documented setup instructions as the claw user.
2. openclaw cron add registers a persistent weekly task.
3. The task survives the original interaction and activates the agent every Monday.
4. Each activation causes the skill to access local files and prepare an externally delivered message.
5. The execution co ...[truncated 647 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit informed consent immediately before creating the recurring task.
2. Provide exact commands for disabling and permanently removing the cron job.
3. Support an expiration date, maximum execution count, or default trial period.
4. Display the execution schedule, accessed resources, destination, and recipient before installation.
5. Require confirmation before each external transmission, or provide a clearly documented opt-in for autonomous delivery.
6. Record executions in an accessible audit log and notify the user how to review them.
7. Allow users to test the brief without installing a persistent schedule.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:66

Finding

Overbroad Access to General Agent Session Logs With External WhatsApp Disclosure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 66-94
Vulnerability Type: Excessive local-data access and external disclosure
Risk Level: High

Vulnerable Code

markdown

**Tools used:**
- exec (reads ~/content-calendar.md and session log files)
- message tool (sends the brief to WhatsApp)

**What your agent reads:**
- ~/content-calendar.md (your content schedule)
- The 5 most recent session log files from ~/.openclaw/agents/main/sessions/

**What your agent does not read:**
- Email
- Direct messages
- Any social platform API
- Any file outside the workspace or home directory

**Steps:**

1. Agent reads ~/content-calendar.md for the current week's schedule
2. Agent reads the 5 most recent session log files to identify what shipped last week
3. Agent identifies what is due this week, what shipped last week, and one suggested focus area
4. Agent sends a formatted brief to WhatsApp via the message tool

**safety_constraints:**
- permissions: read-only
- writes: none
- approval_tier: 1 (autonomous) - read-only query, no approval needed
- scope: ~/content-calendar.md, ~/.openclaw/agents/main/sessions/ only
- cannot_access: email, social accounts, platform APIs, any write operation
- on_error: send WhatsApp alert, do not retry automatically

Technical Analysis

The stated business purpose is to produce a weekly content brief, but the skill reads the five most recent general agent session logs rather than a dedicated content-status data source. Recency does not establish that a session is related to content production. Those logs may contain unrelated conversations, personal information, credentials, operational details, or other confidential material.

The skill subsequently uses a messaging tool to transmit a model-generated summary to WhatsApp. The read-only designation is incomplete because it only characterizes local filesystem access; sending data to an external ...[truncated 1968 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove access to general agent session logs.
2. Store shipped-content information in a dedicated file or database with a strict, minimal schema.
3. Restrict reads to records explicitly tagged as content-production activity and to the exact reporting period.
4. Apply secret detection, personal-data filtering, and output redaction before creating any external message.
5. Show the complete proposed WhatsApp message to the user and require approval before transmission.
6. Bind the skill to an explicitly selected and verified recipient rather than relying on an implicit messaging destination.
7. Treat outbound messaging as a write or disclosure operation in the safety model; do not classify the workflow as entirely read-only.
8. Use a separate low-privilege service identity that cannot access unrelated agent history.
9. Log which source records contributed to each brief without copying sensitive source contents into the audit log.
10. If an error occurs, avoid including source data or diagnostic secrets in the WhatsApp alert.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

Your agent reads a content calendar file you maintain on your server.

**Create your content calendar:**

In the browser console, run:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description emphasizes convenience but does not prominently warn that weekly briefs and error alerts are transmitted over WhatsApp, potentially carrying sensitive planning data and summaries derived from session logs. Users may unknowingly consent to third-party disclosure of business context and prior agent activity.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is designed to read recent session logs and produce a natural-language summary of what 'shipped last week,' then send that summary externally via WhatsApp. Session logs often contain broader context than intended, so summarization can leak sensitive information from prior conversations even if raw logs are not directly transmitted.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section explicitly instructs the agent to read the 5 most recent session log files and use them to identify past activity for a WhatsApp brief. That creates a direct cross-context data flow from prior sessions into an external messaging channel, increasing the chance of leaking confidential prompts, outputs, or operational details.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The procedural steps operationalize a pipeline that mines recent session logs, derives summaries, and sends the result to WhatsApp. Because the extraction is semantic rather than field-limited, the skill can unintentionally include sensitive or irrelevant information from prior conversations in an external message.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The skill is configured for autonomous execution with no approval despite making judgment calls about what from recent logs 'shipped last week' and sending the result externally. Autonomous decision-making is more dangerous here because it combines interpretation of potentially sensitive history with unsupervised third-party transmission.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

**safety_constraints:**
- permissions: read-only
- writes: none
- approval_tier: 1 (autonomous) - read-only query, no approval needed
- scope: ~/content-calendar.md, ~/.openclaw/agents/main/sessions/ only
- cannot_access: email, social accounts, platform APIs, any write operation
- on_error: send WhatsApp alert, do not retry automatically

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill labels itself as a read-only, no-approval query, but it performs an external side effect by sending WhatsApp messages automatically, including on error. This misclassification can cause the system or user to grant lower-friction execution to a workflow that actually exports data to a third-party channel.

Content

No source excerpt is available for this finding.