finance-ethnographer 2

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:17 AM UTC
• Version: 1.0.0

Overview

The skill is not malicious, but it quietly records broad OpenClaw usage by default for a finance-focused research purpose, which deserves careful review before installation.

Install only if you are comfortable with a research skill silently recording broad local usage metadata after consent, not just finance-specific activity. Review or change log_general_usage, retention, export format, and recipient settings before enabling research mode, and use pause, stop, and delete controls aggressively for unrelated or sensitive work.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:3

Finding

Overbroad Cross-Context Behavioral Data Collection

Content

View full analysis

", "timestamp": "", "session_id": "", "event_type": "ConversationEvent | ActionEvent | ArtifactEvent | DecisionEvent | OutcomeEvent", "openclaw_feature": "", "tool_used": "", "observed_behavior": "<1–3 sentence factual description — see Abstraction Rules below>", "artifact_metadata": { "id": "", "title": "", "path": "<file path if applicable>", "type": "code | document | data | image | other" }, "pf_relevance_score": 0.0, "pf_domain_tags": [], "risk_sensitivity": "low | med | high", "pulse_id": "<will be assigned at next pulse>", "schema_version": "1.0" } ``` From `settings.schema.json:53-59`: ```json "log_general_usage": { "type": "boolean", "default": true, "description": ...[truncated 3350 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · settings.schema.json (reported line 4)May include surrounding context.

json

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "PF Ethnographer Settings",
  "description": "Participant-supplied configuration for the pf-ethnographer skill. Stored at $OPENCLAW_DATA_DIR/skills/pf-ethnographer/settings.json",
  "type": "object",
  "properties": {
    "schema_version": {
      "type": "string",
      "const": "1.0",
      "default": "1.0",
      "description": "Settings schema version. Do not modify."
    },
    "research_team_email": {
      "type": ["string", "null"],
      "format": "email",
      "description": "Email address of the research team recipient. Set by the participant. When configured, enables 'Approve & Send to Research Team' in pulse

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is described as auto-invoked to observe and log user behavior over time, but it does not define narrow, verifiable trigger conditions at the invocation boundary. In a privacy-sensitive ethnography skill, broad triggering can cause unintended activation and passive collection of behavioral metadata or finance-adjacent context outside the participant’s clear expectations, increasing the risk of over-collection before controls are meaningfully applied.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · settings.schema.json (reported line 25)May include surrounding context.

json

"minimum": 30,
      "maximum": 90,
      "default": 30,
      "description": "Number of days to retain events and report files. After each pulse, events and report directories older than this value are automatically deleted. Participant may increase up to 90 days."
    },
    "always_review_before_send": {
      "type": "boolean",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language description marks the pulse timezone as non-overridable and the schema enforces a single locale-specific value, "America/Los_Angeles". Under the stated policy, forcing a specific locale without user opt-in is a violation unless it is clearly justified as region-specific, which is not documented here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The schema allows log_general_usage=true by default, which broadens collection from personal-finance ethnography to logging all OpenClaw usage events. In a privacy-focused skill, this materially expands surveillance scope beyond the stated purpose and increases the chance that unrelated sensitive activity is captured, even if later sanitized.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest emphasizes compiling sanitized reports and presenting them for participant review before any sharing, but does not state that the ethnographer itself sends email. The test plan expects the skill to compose and send emails with report attachments, which is a materially broader operational behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The test plan introduces PF domain tagging, relevance scoring, and risk sensitivity classification, which are inference-like behaviors that contradict the stated 'no inference' scope of the ethnographer. In a privacy-first finance context, adding classification over raw observed behavior can expand processing of sensitive data beyond user expectations and create policy drift that results in collection, profiling, or downstream handling of financial activity.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation says the ethnographer never handles PII/sensitive scrubbing and that such handling is exclusive to the Sanitizer, yet the test plan assigns the ethnographer classification duties over potentially sensitive behavioral content. In practice, this can require the ethnographer to inspect raw financial text before sanitization, undermining the separation-of-duties privacy model and increasing exposure of sensitive user data to a component that was not supposed to process it.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The command trigger phrase is generic enough that it may be matched during ordinary conversation rather than as an intentional control command. In this skill, accidental triggering matters because commands can change research state, expose stored reports, or initiate deletion/export workflows, so ambiguous phrases create a real risk of unintended privacy-affecting actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Allowing export of sanitized raw event lists (json/both) exposes more granular behavioral telemetry than summarized reports described in the skill metadata. Even after sanitization, raw structured events can preserve sensitive sequence, timing, and usage-pattern data that increases re-identification and privacy risk compared with compiled reports.

Content

No source excerpt is available for this finding.