Charisma Research Loop

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:27 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for recurring charisma brief generation, but it asks to send email, modify calendar entries, and update persistent workspace memory without enough user confirmation or scoping.

Review before installing. Use this only if you intend the agent to maintain a persistent charisma-insight ledger and have email/calendar write access. Require explicit recipients, calendar targets, event IDs, and confirmation before any send or calendar update, and consider moving the ledger to a skill-specific storage location.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:34
• Finding: Unrestricted Access to Persistent Root Workspace State<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 34-43 **Vulnerability Type**: Unauthorized access to persistent agent state **Risk Level**: Medium ### Vulnerable Code ```markdown ## Self-improving loop (mandatory) Before generating a new run: 1. Read `/root/.openclaw/workspace/memory/charisma-insight-ledger.md`. 2. Identify what was already sent recently and mark those clusters as `DONE` in today’s section when superseded. 3. Choose at least 3 new angles not used in the most recent 3 runs. 4. Generate the new 5-insight set. 5. Append a compact run log to the ledger: - timestamp - themes used - novelty score (1-10) - repeated ideas avoided - one improvement for next run ``` ### Technical Analysis The Skill requires both reading from and writing to a fixed path inside the root user's persistent OpenClaw workspace. This behavior crosses the boundary of a self-contained content-generation task and assumes access to agent-wide persistent state without verifying authorization, ownership, path scope, or the sensitivity of existing ledger contents. Because the path is under `/root`, execution may require or inherit highly privileged filesystem access. The Skill also makes the operation mandatory and provides no fallback for an unavailable or unauthorized ledger. Although the prescribed writes are compact run logs rather than executable rules, they persist across sessions and can affect the content of subsequent runs. No direct privilege-escalation exploit, arbitrary path construction, or secret extraction mechanism is shown in the audited file. The risk arises from requiring access beyond the minimum scope needed to generate the requested insights. ### Attack Path 1. A user or automated process invokes the Skill. 2. The agent follows the mandatory workflow and opens `/root/.openclaw/workspace/memory/charisma-insight-ledger.md`. 3. Existing persistent content is read and incorporated into decisions about future output. 4. Th ...[truncated 554 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Store the ledger in a dedicated, least-privileged, Skill-specific data directory rather than under `/root`. - Require explicit user or administrator authorization before reading or modifying persistent agent memory. - Resolve and validate the canonical file path before access, and enforce an allowlisted storage root. - Run the Skill under a non-root service account with access restricted to its own state file. - Use file permissions that prevent unrelated Skills or users from reading or modifying the ledger. - Define a safe fallback that generates insights without persistent state when the ledger is unavailable. - Record and expose proposed ledger changes for approval when the Skill is run interactively. - Avoid storing sensitive conversation content, credentials, recipient information, or other personal data in the ledger. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:45
• Finding: Unconfirmed Email Transmission and Calendar Mutation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 45-48 **Vulnerability Type**: Unsafe external side effects **Risk Level**: Medium ### Vulnerable Code ```markdown ## Delivery - Send concise email brief with the 5 insights. - Create/update calendar task/event containing same 5 insights. - Keep wording practical, direct, non-fluffy. ``` ### Technical Analysis The Skill mandates two external side effects: sending an email and creating or updating calendar data. It does not identify an authorized email recipient, sending account, calendar, event identifier, or permitted update scope. It also lacks a preview, explicit confirmation step, destination allowlist, and handling rules for ambiguous or missing destinations. An implementation may consequently rely on default accounts, inferred recipients, or a default calendar. The `create/update` instruction is particularly ambiguous because it does not define how an existing event should be selected, potentially allowing the agent to overwrite an unrelated item. The audited content does not contain credentials, hardcoded recipient addresses, or code that bypasses provider authorization. The risk is an insecure workflow specification that permits unintended outbound communication and data mutation when executed by an agent with email or calendar tools. ### Attack Path 1. The Skill generates the five required insights. 2. It invokes an available email integration without requiring confirmation of the sender or recipient. 3. The integration sends the generated content using a default, inferred, or stale destination. 4. The Skill invokes a calendar integration without a specific calendar or event identifier. 5. The integration creates an unwanted event or selects and updates an unintended existing event. 6. The email transmission and calendar change become externally visible and may be difficult to reverse completely. ### Impact Assessment The Skill may send generated content to an unintended re ...[truncated 384 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit email sender and recipient identifiers for every delivery configuration. - Require an explicit calendar identifier and, for updates, a specific event identifier. - Present the complete email and calendar payloads for user confirmation before performing external actions. - Apply destination allowlists and validate that recipients and calendars belong to the intended account or organization. - Prefer create-only calendar behavior unless the user expressly authorizes modification of a named event. - Use least-privilege OAuth scopes, separating email-send permission from calendar-write permission. - Make delivery optional and allow generation of a local draft without external side effects. - Log the destination, timestamp, operation, and provider response while excluding sensitive message content. - Provide clear failure and rollback handling, including deletion of an accidentally created event where authorized. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill description is broad enough to match many ordinary communication, psychology, or productivity-related requests, increasing the chance of unintended invocation. Because the skill also performs downstream actions like recurring delivery and stateful memory updates, accidental activation could cause the agent to read/write files and initiate message-sending behavior in contexts the user did not explicitly request.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to send email and create or update calendar items without any requirement for explicit user confirmation at execution time. This creates a real risk of unauthorized external side effects, including sending content to unintended recipients, modifying calendar data, or generating recurring outbound actions merely from the skill being selected.

Static analysis

No suspicious patterns detected.