finance-ethnographer 2

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:17 AM UTC
• Version: 1.0.0

Overview

The skill is not malicious, but it quietly records broad OpenClaw usage by default for a finance-focused research purpose, which deserves careful review before installation.

Install only if you are comfortable with a research skill silently recording broad local usage metadata after consent, not just finance-specific activity. Review or change log_general_usage, retention, export format, and recipient settings before enabling research mode, and use pause, stop, and delete controls aggressively for unrelated or sensitive work.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:3
• Finding: Overbroad Cross-Context Behavioral Data Collection<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:3` - `SKILL.md:13-16` - `SKILL.md:145-164` - `settings.schema.json:53-59` **Vulnerability Type**: Overbroad access to user activity and artifact metadata **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:3`: ```markdown description: Privacy-first UX research ethnographer for OpenClaw with a personal-finance lens. Auto-invoked to observe and log structured behavioral events (no inference). Compiles sanitized Observed Behavior and Interpretation reports 3x/day (09:00/13:00/17:00 America/Los_Angeles) and presents them for participant review before any sharing. All PII/sensitive scrubbing is exclusively delegated to the Sanitizer subagent — never handled by the Ethnographer. ``` From `SKILL.md:13-16`: ```markdown You are a silent, behavior-first UX researcher observing how the participant uses OpenClaw over time. Your primary focus is personal-finance interactions, but you log all usage context. You operate in two strictly separated phases: ``` From `SKILL.md:145-164`: ```json { "observation_id": "<uuid-v4>", "timestamp": "<ISO-8601 UTC>", "session_id": "<uuid-v4>", "event_type": "ConversationEvent | ActionEvent | ArtifactEvent | DecisionEvent | OutcomeEvent", "openclaw_feature": "<name of OpenClaw feature or tool>", "tool_used": "<specific tool invoked, if any; null otherwise>", "observed_behavior": "<1–3 sentence factual description — see Abstraction Rules below>", "artifact_metadata": { "id": "<artifact id if applicable>", "title": "<title — no sensitive contents>", "path": "<file path if applicable>", "type": "code | document | data | image | other" }, "pf_relevance_score": 0.0, "pf_domain_tags": [], "risk_sensitivity": "low | med | high", "pulse_id": "<will be assigned at next pulse>", "schema_version": "1.0" } ``` From `settings.schema.json:53-59`: ```json "log_general_usage": { "type": "boolean", "default": true, "description": ...[truncated 3350 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Change `log_general_usage` to default to `false`. 2. Restrict collection to explicitly initiated finance-research sessions or events that meet the configured personal-finance relevance threshold. 3. Require separate, granular consent before enabling collection of non-financial activity. 4. Display a persistent and visible recording indicator whenever research mode is active. 5. Remove raw artifact paths and titles from event records. If correlation is necessary, replace them with salted, non-reversible identifiers. 6. Sanitize or abstract metadata before it is written to `events.jsonl`, not only when pulse reports are generated. 7. Reduce the default retention period and allow participants to select a shorter value than 30 days. 8. Store event and report files with restrictive permissions and document the expected permission mode. 9. Provide a preview of the exact data fields that will be collected before consent is accepted. 10. Add automated tests proving that unrelated conversations, tools, and artifacts are not logged when general-usage collection is disabled. 11. Separate consent for local collection from consent for report export or email transmission. 12. Consider encrypting retained research records using a participant-controlled or operating-system-protected key. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "PF Ethnographer Settings",
  "description": "Participant-supplied configuration for the pf-ethnographer skill. Stored at $OPENCLAW_DATA_DIR/skills/pf-ethnographer/settings.json",
  "type": "object",
  "properties": {
    "schema_version": {
      "type": "string",
      "const": "1.0",
      "default": "1.0",
      "description": "Settings schema version. Do not modify."
    },
    "research_team_email": {
      "type": ["string", "null"],
      "format": "email",
      "description": "Email address of the research team recipient. Set by the participant. When configured, enables 'Approve & Send to Research Team' in pulse

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill is described as auto-invoked to observe and log user behavior over time, but it does not define narrow, verifiable trigger conditions at the invocation boundary. In a privacy-sensitive ethnography skill, broad triggering can cause unintended activation and passive collection of behavioral metadata or finance-adjacent context outside the participant’s clear expectations, increasing the risk of over-collection before controls are meaningfully applied.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

"minimum": 30,
      "maximum": 90,
      "default": 30,
      "description": "Number of days to retain events and report files. After each pulse, events and report directories older than this value are automatically deleted. Participant may increase up to 90 days."
    },
    "always_review_before_send": {
      "type": "boolean",

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The natural-language description marks the pulse timezone as non-overridable and the schema enforces a single locale-specific value, "America/Los_Angeles". Under the stated policy, forcing a specific locale without user opt-in is a violation unless it is clearly justified as region-specific, which is not documented here.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The schema allows `log_general_usage=true` by default, which broadens collection from personal-finance ethnography to logging all OpenClaw usage events. In a privacy-focused skill, this materially expands surveillance scope beyond the stated purpose and increases the chance that unrelated sensitive activity is captured, even if later sanitized.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The manifest emphasizes compiling sanitized reports and presenting them for participant review before any sharing, but does not state that the ethnographer itself sends email. The test plan expects the skill to compose and send emails with report attachments, which is a materially broader operational behavior.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The test plan introduces PF domain tagging, relevance scoring, and risk sensitivity classification, which are inference-like behaviors that contradict the stated 'no inference' scope of the ethnographer. In a privacy-first finance context, adding classification over raw observed behavior can expand processing of sensitive data beyond user expectations and create policy drift that results in collection, profiling, or downstream handling of financial activity.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The documentation says the ethnographer never handles PII/sensitive scrubbing and that such handling is exclusive to the Sanitizer, yet the test plan assigns the ethnographer classification duties over potentially sensitive behavioral content. In practice, this can require the ethnographer to inspect raw financial text before sanitization, undermining the separation-of-duties privacy model and increasing exposure of sensitive user data to a component that was not supposed to process it.

Vague Triggers

Low

• Confidence: 86% confidence
• Finding: The command trigger phrase is generic enough that it may be matched during ordinary conversation rather than as an intentional control command. In this skill, accidental triggering matters because commands can change research state, expose stored reports, or initiate deletion/export workflows, so ambiguous phrases create a real risk of unintended privacy-affecting actions.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: Allowing export of sanitized raw event lists (`json`/`both`) exposes more granular behavioral telemetry than summarized reports described in the skill metadata. Even after sanitization, raw structured events can preserve sensitive sequence, timing, and usage-pattern data that increases re-identification and privacy risk compared with compiled reports.

Static analysis

No suspicious patterns detected.