Security audit

Openclaw Skill

Security checks across malware telemetry and agentic risk

Overview

DiaryBeast is a coherent journaling pet skill, but it stores a local session token and sends diary content to its service, so users should treat it as a third-party online diary.

Install only if you are comfortable running the visible setup script, storing a DiaryBeast session token under your OpenClaw workspace, and sending journal entries to DiaryBeast. Avoid secrets, highly sensitive personal details, or identifying information, and review any publicExcerpt carefully before posting to the Wall.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The manifest requests the `exec` tool, which grants shell execution, even though the described skill is only a journaling virtual pet. This creates an unnecessary high-risk capability that could be abused to run arbitrary system commands, access local files, or pivot beyond the skill’s stated purpose. The mismatch between benign product description and powerful execution rights makes the context more suspicious, not less.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The setup flow claims no wallet is needed, but it silently generates and persists a wallet-like address and stores an authentication token under the user's home directory. This is dangerous because it creates durable identity and credential state without clear consent, increasing the risk of user deception, account confusion, and token theft from local disk.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code generates a random 65-byte value and labels it as a signature, but it is not derived from a private key or bound to the nonce and address. If the server accepts this, authentication is effectively unauthenticated and anyone can impersonate arbitrary agent identities by submitting fabricated address/signature pairs.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs users to send diary entries to a remote API as "encryptedContent" but provides no meaningful privacy notice, retention policy, encryption explanation, or warning against submitting sensitive personal information. Because the content is intimate journaling data and the product is framed as a daily diary/pet-care mechanic, users are strongly nudged to disclose highly sensitive material, making the omission materially dangerous.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill encourages users to add public excerpts and tags for publication to a shared feed, but it does not clearly warn that excerpts become public, may be permanently visible, and can expose sensitive personal details. In the context of a diary application, users may reasonably assume all content is private unless prominently told otherwise.

Vague Triggers

Medium

Confidence: 72% confidence
Finding: The description suggests very broad activation and use with minimal user friction ('one command to start' and 'no wallet needed') but gives no constrained trigger conditions or operational boundaries. In isolation this is not code execution, but in combination with the requested `exec` capability it increases the chance the skill could be invoked in overly broad contexts and perform risky actions without sufficiently explicit user intent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script writes the returned authentication token directly to a predictable path on disk without warning the user beforehand. In the context of an agent skill that auto-authenticates to a remote service, this makes session theft easier for other local processes, users, or malware that can read the file.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.