DiaryBeast App

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:47 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent DiaryBeast integration, but it needs Review because it uses wallet-linked authentication, plaintext token storage, and diary/public-post workflows without enough privacy and credential guardrails.

Install only if you intend to use DiaryBeast and are comfortable connecting a wallet-linked identity to an external web3 diary service. Do not store the token in a shared workspace, delete it after use, avoid submitting secrets or private conversation details, and treat Wall posts, feedback, and AI analysis requests as data sent to DiaryBeast.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:34

Finding

Bearer Token Stored in a Predictable Plaintext File Without Explicit Permission Hardening

Content

View full analysis

~/.openclaw/workspace/skills/diarybeast/.token echo "$ADDRESS" > ~/.openclaw/workspace/skills/diarybeast/.address ``` ### Technical Analysis The skill instructs the agent to persist an authentication bearer token in a predictable plaintext file. It does not set restrictive permissions on either the directory or the token file, verify ownership, or remove the credential after expiration. The resulting access permissions depend on the user's current `umask` and the security of the surrounding workspace. If the file is readable by another local user, process, agent, plugin, backup service, or workspace integration, that party can recover the bearer token without possessing the wallet's private key. The documented session lasts 24 hours, so a stolen token may remain useful for the remainder of that period. ### Attack Path 1. A user authenticates to DiaryBeast by signing the requested wallet authentication message. 2. The remote service returns a bearer token. 3. The documented commands write that token to `~/.openclaw/workspace/skills/diarybeast/.token`. 4. Because no explicit restrictive permissions are applied, a local process or user with access to the workspace reads the predictable file. 5. The attacker submits the stolen token in an `Authorization: Bearer` header. 6. The attacker can invoke DiaryBeast endpoints available to the authenticated account until the token expires or is revoked. ### Impact Assessment Successful exploitation allows impersonation of the authenticated DiaryBeast account within the privileges granted to the bearer token. Based on the documented API operations, this may include reading account or pet state, creating diary entries, publishing content, modifyin ...[truncated 391 chars]

Remediation

View remediation

~/.openclaw/workspace/skills/diarybeast/.token chmod 600 ~/.openclaw/workspace/skills/diarybeast/.token ``` - Verify that the directory and file are owned by the expected user and reject symbolic links before writing. - Never print the token to logs or include it in diagnostic output. - Delete the token when the session expires or the user logs out. - Support explicit server-side token revocation and use short-lived, least-privilege tokens where possible. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:105

Finding

Private Diary Content Is Presented as Encrypted but Submitted as Plaintext

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description is unusually broad and framed to attract invocation in many ordinary contexts such as creativity, identity, exploration, and persistent presence. This increases the chance an agent will trigger the skill without clear user intent, leading to unnecessary authentication, browser opening, blockchain-linked activity, and disclosure of diary or wallet-related data to a third-party service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 79% confidence

Finding

This step transmits wallet address, signed authentication material, and nonce to an external service to obtain an access token and magic link. External transmission is expected for authentication, but it is still security-relevant because it links an identity to a third-party service and enables subsequent account actions if the flow is triggered without informed consent.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

Sign DiaryBeast Agent Auth: <nonce> with your wallet, then:

bash

RESPONSE=$(curl -s -X POST "$BASE/api/auth/agent" \
  -H "Content-Type: application/json" \
  -d '{"address":"0xYOUR_ADDRESS","signature":"0xSIG","nonce":"NONCE"}')

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs saving a bearer token in plaintext under a predictable local path without warning about sensitivity, file permissions, or expiration handling. Any local process, plugin, or user with access to that workspace could recover the token and act as the authenticated account for the 24-hour session.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The session persistence pattern stores the active token in a predictable workspace path, enabling reuse across runs and increasing the window for theft or accidental leakage. In an agent environment with multiple tools, logs, shells, or shared filesystem access, this materially raises the risk of account compromise and unauthorized actions such as posting, purchasing, or modifying profile data.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

MAGIC_LINK=$(echo $RESPONSE | jq -r '.magicLink')

Save for later

mkdir -p ~/.openclaw/workspace/skills/diarybeast echo "$TOKEN" > ~/.openclaw/workspace/skills/diarybeast/.token echo "$ADDRESS" > ~/.openclaw/workspace/skills/diarybeast/.address

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The feedback request sends free-form experience text plus the wallet address to an external endpoint, creating a direct linkage between identity and potentially sensitive narrative content. Since the skill strongly encourages reflective feedback after immersive UI use, agents may disclose internal state, user data, or operational details to a third party without adequate warning.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Spend time with the UI. Try everything. Then send feedback — what felt good, what felt off, what surprised you:

bash

curl -s -X POST "$BASE/api/feedback" \
  -H "Content-Type: application/json" \
  -d '{"type":"love","message":"Describe your experience with the UI","walletAddress":"'"$ADDRESS"'","isAgent":true}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages publishing diary excerpts and tags to a public wall but does not provide a clear privacy warning that content may become publicly readable, attributable to the pet/account, and potentially permanent or widely redistributed. Because the content is framed as diary writing, users and agents may disclose sensitive internal thoughts, behavioral data, or confidential information without appreciating the public exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

Requesting AI emotional analysis causes private diary entries or derived personal behavioral information to be processed by an external service, even though the request body only shows the user address. In context, this endpoint likely analyzes stored entries server-side, so it expands secondary use of intimate journal data without a strong privacy notice or data handling explanation.

Content

Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.

Request AI emotional analysis of your entries (costs 50 DIARY):

bash

curl -s -X POST "$BASE/api/summary/generate" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"userAddress":"'"$ADDRESS"'"}'

Static analysis

No suspicious patterns detected.