Conversation Flow Monitor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:14 AM UTC
• Version: 1.0.1

Overview

This is a plausible reliability-monitoring skill, but it expands into persistent agent-memory changes and automatic log maintenance without enough scoping or user control.

Review this skill carefully before installing. Its basic monitoring code is not an exfiltration tool, but you should avoid enabling automatic memory promotion, AGENTS.md/SOUL.md/TOOLS.md edits, or heartbeat log cleanup unless you can inspect and approve each change. Prefer an immutable, verified install source instead of the placeholder unpinned npx/GitHub commands, and configure logging retention/redaction before using it on sensitive conversations or workspaces.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README.md:59
• Finding: Unpinned Third-Party Installer Execution<![CDATA[ ## Vulnerability Details **File Location**: `README.md:59-64` **Vulnerability Type**: Unpinned and unverifiable package installation **Risk Level**: Medium ### Vulnerable Code ```bash # Via Clawhub (recommended) npx skills add your-username/conversation-flow-monitor # Manual installation git clone https://github.com/your-username/conversation-flow-monitor.git ~/.openclaw/skills/conversation-flow-monitor ``` ### Technical Analysis The recommended `npx` command does not specify an exact version or package integrity value. If the `skills` package is unavailable locally, `npx` may retrieve and execute its currently resolved release. Consequently, the code executed during installation can differ from the version that was originally audited. The Skill and repository identifiers also contain the placeholder owner `your-username`. This prevents users from reliably validating the intended publisher and increases the possibility of installing an unrelated or attacker-controlled package or repository. This finding does not establish that the current repository contains a malicious dependency. The risk arises from the unpinned and unverifiable installation procedure. ### Attack Path 1. A user follows the installation instructions from the README. 2. `npx` resolves the unpinned `skills` package from the configured npm registry. 3. An attacker has compromised the resolved package, its publisher account, or a similarly named package selected by mistake. 4. `npx` downloads and executes the package during installation. 5. Malicious installation logic runs with the invoking user's privileges and can access resources available to that user. For the manual path, an attacker could register or control a repository matching the unresolved placeholder and persuade a user to clone it. ### Impact Assessment Successful exploitation can execute arbitrary code under the account running the installation command. Depending on that account's permissions, the code could ...[truncated 260 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace all placeholder publisher and repository identifiers with the verified canonical identities. 2. Pin the installer to an exact audited version, for example `package-name@X.Y.Z`. 3. Publish and verify package integrity hashes or signed release artifacts. 4. Use an installation mode that refuses implicit retrieval of an unavailable package. 5. Document the expected npm publisher, repository URL, release tag, and checksum. 6. Recommend reviewing installation scripts before running the package. 7. For Git-based installation, reference a signed release tag or immutable commit hash rather than an unspecified repository state. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:77
• Finding: Unsafe Promotion of Recovery Content into Persistent Agent State<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:77-84`; related instructions at `README.md:156-157` and `README.md:197-198` **Vulnerability Type**: Persistent Agent memory and behavioral-rule modification **Risk Level**: Medium ### Vulnerable Instructions ```markdown ### With self-improving-agent - Logs conversation flow issues to `.learnings/ERRORS.md` - Promotes successful recovery patterns to permanent memory - Tracks recurring conversation failure patterns ### With OpenClaw Workspace - Integrates with existing AGENTS.md guidelines - Updates SOUL.md with behavioral improvements - Enhances TOOLS.md with tool-specific reliability notes ``` Related README instructions include: ```markdown ### Self-Improving Agent Integration - Logs conversation flow issues to `.learnings/ERRORS.md` - Promotes successful recovery patterns to permanent memory - Tracks recurring conversation failure patterns for continuous improvement ``` ```markdown 1. Log them to `.learnings/ERRORS.md` or `.learnings/LEARNINGS.md` 2. Promote broadly applicable patterns to `AGENTS.md` ``` ### Technical Analysis The Skill instructs integrations to promote observed recovery patterns into permanent memory and to modify `AGENTS.md`, `SOUL.md`, and `TOOLS.md`. These files can influence behavior, identity, and tool usage across later Agent sessions. The instructions do not define a trust boundary, sanitization process, provenance requirement, approval workflow, or rollback mechanism. Error descriptions and apparent recovery patterns may be derived from untrusted tasks, files, websites, or tool output. Promoting such content without review can turn transient attacker-controlled input into persistent Agent instructions. The reviewed Python files do not directly implement these writes. The risk is present in the Skill-level operational instructions and arises when an Agent or the described integration follows them. ### Attack Path 1. An attacker supplies task content, external ...[truncated 993 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic promotion of recovery patterns into permanent memory, `AGENTS.md`, `SOUL.md`, and `TOOLS.md`. 2. Store diagnostic events in a Skill-local, structured log that is not interpreted as Agent instructions. 3. Treat all exception messages, task content, external output, and suggested recovery rules as untrusted data. 4. Require explicit user approval before creating any persistent behavioral rule. 5. Display the exact proposed change, its source, and its intended effect before approval. 6. Apply an allowlist-based schema that prevents diagnostic content from becoming executable instructions. 7. Record provenance, timestamps, and authorizing identities for approved changes. 8. Maintain version history and provide a straightforward rollback mechanism. 9. Never update identity or safety-policy files automatically as part of error recovery. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/conversation_monitor.py:140
• Finding: Timeout Wrappers Do Not Reliably Terminate Underlying Operations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/conversation_monitor.py:140-159`; related implementation at `scripts/error_handler.py:45-54` **Vulnerability Type**: Ineffective timeout enforcement and unsafe retries **Risk Level**: Medium ### Vulnerable Code The synchronous wrapper only records a timeout threshold and then directly invokes the tool: ```python def create_safe_tool_wrapper(tool_func, tool_name: str, default_timeout: int = 30): """Create a safe wrapper for tool functions with timeout and error handling.""" def safe_wrapper(*args, **kwargs): monitor = ConversationMonitor() monitor.start_operation(tool_name, timeout=default_timeout) try: result = tool_func(*args, **kwargs) monitor.end_operation(success=True) return result except Exception as e: error_info = monitor.handle_error(e, context=f"tool_call:{tool_name}") # Return structured error instead of letting it propagate return { 'error': True, 'tool_name': tool_name, 'error_details': error_info, 'suggested_action': 'Check logs and retry with different parameters or shorter timeout' } ``` The asynchronous handler places synchronous work in a thread and only times out the future: ```python if asyncio.iscoroutinefunction(func): result = await asyncio.wait_for(func(*args, **kwargs), timeout=timeout) else: # For sync functions, run in thread pool loop = asyncio.get_event_loop() result = await asyncio.wait_for( loop.run_in_executor(None, lambda: func(*args, **kwargs)), timeout=timeout ) return result ``` ### Technical Analysis `create_safe_tool_wrapper` does not enforce a timeout. It sets monitoring state but calls `tool_func` synchronously and does not check or interrupt it while it runs. A blocked function can therefore hang indefinitely ...[truncated 1637 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not describe elapsed-time monitoring as timeout enforcement. 2. Use cooperative cancellation for asynchronous operations and ensure wrapped functions handle cancellation correctly. 3. Pass native timeout parameters directly to network clients, subprocess APIs, browser tools, and file-operation abstractions where supported. 4. Run non-cooperative synchronous work in a separately terminable process rather than a thread. 5. Terminate and reap the worker process after a timeout. 6. Avoid automatically retrying operations that are not proven idempotent. 7. Generate operation identifiers or idempotency keys for retried external requests. 8. Limit concurrent attempts and executor capacity to prevent resource exhaustion. 9. Distinguish between “caller stopped waiting” and “underlying operation terminated” in logs and returned errors. 10. Add tests proving that timed-out operations cease their side effects before a retry starts. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The README instructs users to run `npx skills add ...` without pinning a specific package version. Because `npx` resolves and executes packages dynamically, a future malicious or compromised release of the referenced package or its dependencies could execute arbitrary code on the user's system during installation. In a setup/install context, this is more dangerous because users are likely to run the command verbatim with local privileges.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README describes persistent logging of conversation flow issues, diagnostics, and learnings to local files such as log directories and `.learnings/*` without clearly warning users that potentially sensitive prompts, outputs, file paths, or operational metadata may be retained. This creates a privacy and data-handling risk, especially for an agent-monitoring skill whose normal function involves observing and recording conversation behavior over time.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill describes file-validation behavior and references reading skill files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can cause the agent to exercise file access implicitly or unexpectedly, weakening least-privilege controls and making review of actual capabilities harder.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill claims to monitor conversation flow, but these sections expand its role into modifying persistent memory and workspace governance files like SOUL.md and TOOLS.md. That scope drift is dangerous because a monitoring skill can become a persistence or policy-modification mechanism, enabling unintended long-term influence over agent behavior.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The recovery table includes auto-fixing skill files and creating missing directories/files, which goes beyond monitoring into autonomous mutation of files and execution context. Automatic repair actions can be abused or can unintentionally alter trusted artifacts, especially when the skill has vague activation boundaries and no explicit write constraints.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The installation/availability language implies broad automatic applicability, but the skill does not define concrete trigger conditions, boundaries, or exclusions. Ambiguous activation increases the chance that it runs during unrelated tasks and applies monitoring, retries, file checks, or recovery logic in contexts where those actions are inappropriate or risky.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documented heartbeat behavior extends beyond conversation-flow monitoring into file maintenance and integrity-checking, which broadens the operational scope of the skill. Scope creep of this kind is risky because users may grant trust or deployment approval based on the manifest description without realizing the skill can perform filesystem-affecting actions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Automatic log cleanup implies deletion of local data, yet the examples do not clearly warn about deletion scope, retention consequences, or recovery limitations. In an agent skill context, undocumented data modification or deletion can cause loss of forensic logs, troubleshooting information, or user data if paths are misconfigured.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The document downplays the skill as containing only core monitoring functionality while elsewhere describing autonomous heartbeat actions such as log cleanup and integrity validation. That mismatch can mislead operators about the skill's effective scope and permissions, increasing the chance that maintenance or integrity-related actions run without proper review.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: On timeout and exception paths, the code logs stringified args and kwargs into an in-memory error log, which can capture secrets, prompts, file paths, tokens, or user content without redaction. In this skill context, tool wrappers are likely to handle sensitive conversation and operational data, so failures could inadvertently retain or expose that data through logs, summaries, or downstream debugging output.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The decorator advertises configurable timeout protection but never passes the provided timeout value into execute_with_timeout/execute_with_retry, so callers may believe long-running or hung tool calls are bounded when they are not. In a conversation-flow monitoring skill, that undermines the core reliability and safety guarantee and can allow denial-of-service style stalls or resource exhaustion from unexpectedly long operations.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The markdown shows browser navigation and later recommends monitoring external API and network operations, which may send user or system data over the network. The document does not include any warning reminding users to avoid sending sensitive data or to verify destinations before use.

Context-Inappropriate Capability

Low

• Confidence: 76% confidence
• Finding: Validating skill file integrity is a separate capability from handling stuck conversations, timeouts, and recovery for agent interactions. While it may be operationally useful, this file-level integrity checking is not an obvious or direct requirement of a conversation-flow monitor based on the manifest description alone.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {},
  "devDependencies": {
    "flake8": "^3.9.2"
  }
}

• Confidence: 91% confidence
• Finding: The devDependency uses a caret range (^3.9.2), which allows newer compatible versions to be installed. This can introduce build-time supply chain risk if a later allowed release is compromised or behaves unexpectedly, even though it does not directly affect runtime behavior of the skill.

Static analysis

No suspicious patterns detected.