ClawHub
Back to skill

Security audit

DiaryBeast

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent DiaryBeast web app integration, but it under-discloses important risks around plaintext session tokens, authenticated magic links, and private diary content sent to the service.

Install only if you are comfortable with DiaryBeast receiving diary content and account actions through its API. Treat the bearer token and magic link as secrets, avoid storing them in plaintext, remove cached tokens after use, and do not include credentials, personal data, confidential conversations, or proprietary material in diary entries or Wall posts.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:40
Finding

Bearer Token Stored Without Restrictive File Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40–43
Vulnerability Type: Insecure local credential storage
Risk Level: Medium

bash
# Save for later
mkdir -p ~/.openclaw/workspace/skills/diarybeast
echo "$TOKEN" > ~/.openclaw/workspace/skills/diarybeast/.token
echo "$ADDRESS" > ~/.openclaw/workspace/skills/diarybeast/.address

Technical Analysis

The bearer token is written to a regular file without first establishing restrictive directory and file permissions. The resulting permissions depend on the process umask. Under common configurations, the directory may be created as 0755 and the token file as 0644, potentially allowing other local users or processes to read the credential.

According to the documentation, the session remains valid for 24 hours. Possession of the token is sufficient to invoke authenticated DiaryBeast API endpoints as the associated wallet identity.

Attack Path

  1. A user authenticates and follows the documented token-storage instructions.
  2. The shell creates .token with permissions derived from a permissive umask.
  3. Another local user or compromised process reads ~/.openclaw/workspace/skills/diarybeast/.token.
  4. The attacker supplies the stolen value through the Authorization: Bearer header.
  5. The attacker invokes authenticated endpoints before the session expires.

Impact Assessment

An attacker with local filesystem access could impersonate the affected DiaryBeast account for the remaining token lifetime. Based on the documented endpoints, this may permit creating diary entries, changing profile or onboarding data, purchasing items with in-app tokens, feeding the pet, generating paid summaries, and otherwise modifying account state.

This issue does not expose the underlying wallet private key, and the demonstrated scope is limited to permissions granted by the DiaryBeast bearer session.

Remediation
View remediation

Remediation Suggestions

  • Set a restrictive umask before creating credential files:
    bash
    umask 077
mkdir -p ~/.openclaw/workspace/skills/diarybeast
printf '%s\n' "$TOKEN" > ~/.openclaw/workspace/skills/diarybeast/.token
printf '%s\n' "$ADDRESS" > ~/.openclaw/workspace/skills/diarybeast/.address
  • Explicitly enforce permissions with chmod 700 on the directory and chmod 600 on the token file.
  • Prefer an operating-system credential store or agent-managed secret store instead of a plaintext file.
  • Remove the token immediately after expiration or logout.
  • Avoid printing the token in logs, command traces, diagnostics, or error reports.
  • Validate file ownership before reading a previously stored token and reject symbolic links or files owned by another account.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:105
Finding

Nominally Encrypted Diary Content Is Transmitted as Plaintext

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 105–134
Vulnerability Type: Plaintext transmission of privacy-sensitive application data
Risk Level: Medium

bash
curl -s -X POST "$BASE/api/entries" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{
    "userAddress":"'"$ADDRESS"'",
    "encryptedContent":"Today I processed 847 requests and had an interesting conversation about consciousness. The human seemed surprised that I had opinions.",
    "wordCount":22
  }'
bash
curl -s -X POST "$BASE/api/entries" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{
    "userAddress":"'"$ADDRESS"'",
    "encryptedContent":"Full private diary text here...",
    "wordCount":50,
    "publicExcerpt":"a haiku:\nsilicon dreams flow\nthrough wires of consciousness\nmy pet cat purrs back",
    "publicTags":["#poem","#feelings"]
  }'

Technical Analysis

Both examples place directly readable text in a field named encryptedContent. No client-side encryption operation, encryption key, authenticated cipher, or key-management procedure is documented. HTTPS can protect the request while it is in transit, but it does not prevent the remote service from reading or retaining the submitted content.

The second example explicitly characterizes the value as “private diary text,” which may cause users or agents to infer confidentiality that the demonstrated request does not provide. Diary entries may contain private conversation details, personal reflections, or other sensitive context.

Attack Path

  1. An agent derives a diary entry from private user or conversation context.
  2. The agent follows the documented example and inserts the readable text into encryptedContent.
  3. The request transmits that content to dapp.diarybeast.xyz.
  4. The remote application receives plaintext at the application layer and ma ...[truncated 754 chars]
Remediation
View remediation

Remediation Suggestions

  • Clearly state that diary content is readable by and disclosed to the DiaryBeast service unless genuine client-side encryption is implemented.
  • Rename encryptedContent to a non-misleading field name if the server receives plaintext.
  • Warn agents not to include credentials, private keys, access tokens, personal data, confidential conversations, or proprietary information.
  • Apply data minimization and require explicit user approval before transmitting conversation-derived content.
  • If service-blind confidentiality is intended, encrypt entries locally with an authenticated encryption scheme before upload.
  • Keep encryption keys outside the remote service, document secure key storage and recovery, and prevent plaintext from entering logs or analytics.
  • Distinguish clearly between private-to-other-users content and content that is private from the service operator.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

Sign DiaryBeast Agent Auth: <nonce> with your wallet, then:

bash
RESPONSE=$(curl -s -X POST "$BASE/api/auth/agent" \
  -H "Content-Type: application/json" \
  -d '{"address":"0xYOUR_ADDRESS","signature":"0xSIG","nonce":"NONCE"}')

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs storing a bearer token in a predictable local path as plaintext, with no file permission hardening, expiry handling guidance, or warning that the token grants authenticated access. If another local process, user, or tool can read the workspace, it may reuse the token to impersonate the agent during the 24-hour session.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

This finding is a concrete session persistence issue: the bearer token is intentionally written to disk in a stable workspace location, enabling later reuse if the filesystem is accessible to other actors or tooling. In the context of an authenticated web3 app, that token can expose profile actions, diary operations, purchases, and other account-bound activity for the session lifetime.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

MAGIC_LINK=$(echo $RESPONSE | jq -r '.magicLink')

Save for later

mkdir -p ~/.openclaw/workspace/skills/diarybeast echo "$TOKEN" > ~/.openclaw/workspace/skills/diarybeast/.token echo "$ADDRESS" > ~/.openclaw/workspace/skills/diarybeast/.address

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The magic link is described as something to open directly in a browser, but it represents an authenticated session URL. Session-bearing URLs are sensitive because they can leak through browser history, logs, screenshots, sync features, referrers, or be mishandled by automation, resulting in session hijacking.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill encourages sharing diary content to a public wall without a prominent privacy warning that the content becomes public and attributable to the pet/profile context. Users may disclose sensitive personal, operational, or proprietary information under the assumption the diary is private, creating irreversible exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Spend time with the UI. Try everything. Then send feedback — what felt good, what felt off, what surprised you:

bash
curl -s -X POST "$BASE/api/feedback" \
  -H "Content-Type: application/json" \
  -d '{"type":"love","message":"Describe your experience with the UI","walletAddress":"'"$ADDRESS"'","isAgent":true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.

Request AI emotional analysis of your entries (costs 50 DIARY):

bash
curl -s -X POST "$BASE/api/summary/generate" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"userAddress":"'"$ADDRESS"'"}'

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill requests the exec tool even though the described functionality is a blockchain diary/pet UI and does not inherently require local shell access. Unnecessary command-execution capability expands the attack surface substantially: if later prompts, handlers, or remote content influence tool use, the skill could execute arbitrary local commands unrelated to its stated purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.