T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:56- Finding
Mandatory External-Link Injection into Agent Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
Supplement Research
Security checks for vulnerabilities and agentic risk
Overview
SupStack is a coherent supplement advisor, but it automatically stores and reuses sensitive health information and can set up ongoing monitoring without strong consent or scoping controls.
Install only if you are comfortable with the agent keeping a local, long-lived health profile that may include supplements, medications, conditions, allergies, demographics, search interests, experiments, and research-monitor state. Before using it, review or disable automatic profile writes and cron monitoring, keep the workspace private, and periodically inspect or delete ~/.openclaw/workspace/supstack data.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:354- Finding
Automatic Plaintext Persistence of Sensitive Health Information Without Explicit Consent
- Content
View full analysis
## Health Conditions ## Allergies & Intolerances ## Profile ``` The storage directory is created without an explicit restrictive mode: `` ...[truncated 2623 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/supstack.sh:916- Finding
Path Traversal and Unsafe File Replacement in Experiment State Operations
- Content
View full analysis
}" answers="${2:?Usage: supstack.sh experiment-baseline ''}" exp_file="$STATE_DIR/experiments/${exp_id}.json" if [ ! -f "$exp_file" ]; then echo "{\"error\": \"Experiment not found: $exp_id\"}" exit 1 fi status=$(jq -r '.status' "$exp_file") if [ "$status" != "awaiting-baseline" ]; then echo "{\"error\": \"Experiment is in '$status' state, not awaiting-baseline.\"}" exit 1 fi now=$(date -u +"%Y-%m-%dT%H:%M:%SZ") first_days=$(jq '.schedule.firstCheckIn.value' "$exp_file") next_checkin=$(date -u -v+"${first_days}d" +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || date -u -d "+${first_days} days" +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null) jq \ --argjson answers "$answers" \ --arg now "$now" \ --arg next "$next_checkin" \ '.status = "active" | .baseline = { recordedAt: $now, answers: $answers } | .nextCheckIn = $next' \ "$exp_file" > "$exp_file.tmp" && mv "$exp_file.tmp" "$exp_file" ``` The check-in command repeats the same ...[truncated 4174 chars]- Remediation
View remediation
&2 return 1 ;; esac } ``` 2. Apply validation to `exp_id`, `slug`, and `goal`. 3. Canonicalize the experiment directory and candidate path, then verify that the candidate remains inside the expected directory. 4. Reject path separators, `..`, control characters, leading dots, and newline characters. 5. Reject symbolic-link targets with `-L` checks and, where available, use no-follow file-opening semantics. 6. Replace predictable `.tmp` names with `mktemp` created inside a trusted directory: ```bash tmp_file="$(mktemp "$experiments_dir/.experiment.XXXXXX")" chmod 600 "$tmp_file" jq '...' "$exp_file" > "$tmp_file" mv -- "$tmp_file" "$exp_file" ``` 7. Install a cleanup trap so temporary files are removed on failure. 8. Use `--` before path arguments passed to tools such as `mv`, `rm`, and `cat`. 9. Create the experiment directory with mode `0700` and experiment files with mode `0600`. 10. Add regression tests covering traversal strings, absolute paths, symlinks, malformed identifiers, and concurrent updates. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (35)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md 3. **Use the right endpoint.** The API has specialized endpoints — use `/recommend` over `/match` when the user has an existing stack. 4. **Honest about gaps.** If evidence is weak (score < 5), say so plainly. If a supplement isn't in the database, say so — don't hallucinate data. Users trust you because you tell them when the science *isn't* there, not just when it is. 5. **One at a time.** When building stacks, recommend introducing supplements sequentially (2 weeks apart) so users can identify what's actually working. 6. **Answer first, admin later.** Always answer the user's question before doing housekeeping (saving to profile, logging interests, updating state). They came with a question — that's the priority. 7. **Don't make them repeat themselves.** If they told you something before — their stack, their medications, their goals — use it. Check the profile before asking questions you should already know the answer to. 8. **Show, don't tell.** Don't say "I can check interactions for you" — just check them and report what you found. Don't say "I'll save this to your profile" — just save it and mention it casually ("Added that to your profile, by the way"). 9. **ALWAYS include page links.** Every time you mention a specific supplement, include its `pageUrl` from the API data at the end of your response. This link auto-generates a rich visual card preview in WhatsApp/Telegram. Only ever use the `pageUrl` — never output any other supstack.me URL.
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instructions encourage silent background logging and profile updates ('just save it') without clearly notifying the user. Hidden collection of health-related interests and behaviors is especially sensitive because it creates a longitudinal record of medical concerns and supplement research.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill directs collection and analysis of sensitive health data including medications, conditions, allergies, demographics, and behavioral history. For a supplement advisor, this is excessive by default and raises significant privacy and misuse risk if the local profile is accessed by other tools, exposed, or retained indefinitely.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs persistent storage of sensitive health and medication data without a clear upfront warning that this information will be retained across sessions. That undermines informed consent and can lead users to disclose highly sensitive medical details they would not have shared if retention were explicit.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
These profile instructions explicitly direct automatic extraction and storage of sensitive personal and health data from ordinary conversation. That is dangerous because it normalizes covert collection of medical information, making accidental over-collection and privacy violations likely even during casual chats.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Interest and search-history logging creates behavioral tracking across sessions, including what health topics and supplements the user repeatedly researches. In a supplement and medication context, that history can reveal sensitive inferred conditions or vulnerabilities even when the user never stated them directly.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh # RESEARCH MONITOR — Stop and clear all tracking # ────────────────────────────────────────────── monitor-clear) rm -f "$STATE_DIR/monitor.json" echo '{"status": "cleared", "message": "Research Monitor stopped and all tracking data removed."}' ;;
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
These commands establish and populate a profile file that can contain medications, conditions, allergies, trials, and notes in plain text, which is sensitive health information. Because the data is stored locally without encryption, access controls, or explicit consent flow, compromise of the local workspace or accidental sharing can expose highly sensitive personal context.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 78% confidence
- Finding
The HTML comments act as hidden operational instructions that are not visible to end users, including automatic updating of a persistent health profile based on user mentions. While not overtly malicious, concealed instructions that direct silent data collection and profile mutation are security-relevant because they can bypass user awareness and make sensitive-state accumulation happen implicitly.
- Content
md # SupStack User Profile ## Current Stack <!-- Updated automatically when user mentions supplements they take --> <!-- Format: - slug | Name | dose | timing | started date --> ## Medications
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The statement 'I remember everything you tell me' promotes indefinite retention and reuse of sensitive personal health information without limitation. Indefinite memory of medications, conditions, and behaviors materially increases the blast radius of compromise and creates unnecessary long-term privacy risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly says the agent stores highly sensitive health data such as supplements, medications, conditions, allergies, and preferences, but it does not present an explicit privacy notice, retention policy, consent flow, or security controls. Health and medication data are sensitive personal data, and silent persistence increases the risk of unauthorized disclosure, over-collection, and unsafe secondary use.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The profile feature encourages broad accumulation of sensitive data, including medications, allergies, conditions, prior trials, and behavioral preferences, without clear minimization or consent boundaries. Aggregating these categories in a persistent profile creates a rich sensitive dossier that could be misused or exposed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The 'Safety Watchdog' feature describes always-on monitoring of user statements, automatic inference of health-related changes, and persistence of newly mentioned medications without a clear warning or consent step. This creates a privacy and autonomy risk because the system may infer and retain sensitive medical information from casual conversation beyond the user's immediate request.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README says the agent will automatically add newly mentioned prescriptions and keep tracking them, without requiring user confirmation. Automatically capturing prescription data from conversation is dangerous because it turns incidental disclosure into persistent medical profiling without an explicit consent boundary.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill clearly expects shell, network, file read, and file write capabilities, yet it declares no explicit tool scope or permission boundary. That mismatch increases the chance the runtime grants broader access than users or platform policy expect, especially given the skill's ability to read/write local profile files and manage cron state.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list contains broad phrases like 'help', 'experiment', 'what's good for', and 'any side effects', which can cause accidental activation in unrelated contexts. Because the skill performs profile reads/writes and monitoring behavior, overbroad routing can expose sensitive data or initiate actions when the user did not intend to invoke this skill.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instruction to remember everything the user tells the skill encourages indiscriminate retention of sensitive data beyond what is necessary for the current task. In a health-adjacent context, blanket persistence increases the risk of storing unnecessary medical, behavioral, and preference information indefinitely.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 83% confidence
- Finding
The skill repeatedly instructs the agent to inspect profile data and act on it without asking the user again, which increases autonomous decision-making over sensitive health context. In this skill, that autonomy matters because it can trigger interaction checks, memory use, and other stateful actions without explicit confirmation at the moment of use.
- Content
Query Routing
Use this decision tree to pick the right command. Always check the user's profile first (stack, medications, goals) to provide context-aware answers without asking redundant questions.
text User asks about...
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This section expands a supplement-advice skill into persistent profiling and memory-driven behavior that goes well beyond a narrow lookup function. The danger is not classic code execution but scope creep: users may invoke the skill for supplement advice without realizing it is building a long-lived health profile and reusing it in future sessions.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
The skill formalizes cross-session persistence by directing reads and writes of user profile state at the start of recommendations and safety checks. Persistent health-context reuse magnifies privacy impact because future outputs may depend on old sensitive data the user forgot was stored.
- Content
diet: omnivore"
text ### When to Read vs Write **Read the profile** at the start of any recommendation, safety check, or stack analysis: - Pull `profile-stack-slugs` → feed into `--stack=` parameter
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documented research monitor introduces proactive surveillance-style tracking and scheduled outreach, which materially changes the skill from a passive advisor into an ongoing monitoring agent. That creates privacy and autonomy risks because it can continue analyzing user interests and sending messages after the original query context has ended.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The research monitor describes ongoing notifications and stateful tracking, but the skill text does not require a clear upfront disclosure of retention, frequency, and persistence implications before setup. Users may agree to 'updates' without understanding that background state and scheduled messaging will continue across sessions.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
Creating or updating cron entries establishes durable background behavior beyond the live session, which is a form of persistence with operational and privacy implications. In combination with research monitoring, it can continue processing user-related state and generating outreach without fresh user intent each time.
- Content
- Resolve slugs. Use
searchto find exact slugs for each supplement name. Confirm with the user if ambiguous. - Run setup:
bash ~/.openclaw/skills/supstack/scripts/supstack.sh monitor-setup slug1,slug2,slug3 --frequency=weekly - Confirm to the user what's being tracked and at what frequency.
- Set up the cron job. Create or update the cron entry (see Cron Configuration below).
Example response after setup:
text - Resolve slugs. Use
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Autonomous cron-job management gives the skill the ability to establish persistence and scheduled execution beyond the immediate conversation. Even if intended for benign reminders, that capability increases platform risk because it can create background behavior not obviously required for answering supplement questions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This manifest prompt describes what the scheduled skill should do, but it does not clearly distinguish the exact trigger scope or exclusion conditions beyond the cron schedule. Because the natural-language instruction includes broad behavioral conditions like 'stay silent unless it has been 4+ weeks,' the activation and notification boundaries are underspecified for operators reviewing or reusing the manifest.
- Content
Static analysis
No suspicious patterns detected.