Meow Speech

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:02 AM UTC
• Version: 1.3.1

Overview

This is a coherent persona skill, but its proactive scheduling examples include under-scoped recurring outreach that could repeatedly message external channels if copied into a host scheduler.

Install only if you want this Chinese cat-persona behavior and you are comfortable with opt-in proactive reminders. Before enabling automation, require explicit consent for each schedule and external channel, prefer one-shot idle checks, set hard daily caps, and make opt-out cancel all pending jobs immediately.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/scheduler-templates.md:58

Finding

Fail-Open Recurring Idle Check-In Can Cause Persistent Unsolicited Messaging

Content

View full analysis

Remediation

View remediation

" }, "payload": { "kind": "idleCheck", "stateKey": "", "maxExecutions": 1 }, "sessionTarget": "main", "deleteAfterRun": true, "expiresAt": "" } ``` The host must evaluate consent, current inactivity, rate limits, and channel authorization at execution time. Message text should only be generated or dispatched after every condition succeeds. Documentation should not present a repeating schedule as the concrete example for behavior that is intended to execute once. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

- If the user asks to disable proactive outreach, stop future scheduled or idle-time check-ins.
- Do not store extra personal notes unless the user has asked for memory-backed continuity and the environment supports it.
- When memory-backed continuity is available, only use the platform’s approved memory store; do not invent hidden storage.
- Never assume permission to send messages to external channels.

## Proactive companionship

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/clawhub-publish.md (reported line 9)May include surrounding context.

md

- Mention that proactive behavior is opt-in.
- Mention that schedule control belongs to the host OpenClaw setup.
- Mention external channels like Feishu and Telegram if supported by the host.
- Mention that the skill is designed to draft or drive gentle scheduled care, not to secretly send messages.
- Mention the Heartbeat checklist as the decision gate for long-quiet human check-ins.
- Mention that long evening quiet gaps can trigger a gentle check-in, especially after nightfall when the human has been silent for a long time.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/heartbeat-checklist.md (reported line 46)May include surrounding context.

md

- Do not ask noisy follow-up questions.
- Do not check just because the timer fired.

## Output rule
- If no action is needed, stay quiet.
- If action is needed, keep the message short and soft.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The natural-language instruction sets the skill's language to simplified Chinese by default. Under the policy, forcing a specific language or locale without user opt-in is a violation unless the skill offers a choice or clearly justifies a region-specific constraint, which this file does not.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

- If the user asks to disable proactive outreach, stop future scheduled or idle-time check-ins.
- Do not store extra personal notes unless the user has asked for memory-backed continuity and the environment supports it.
- When memory-backed continuity is available, only use the platform’s approved memory store; do not invent hidden storage.
- Never assume permission to send messages to external channels.

## Proactive companionship

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The example text says information has been recorded in multiple stores ('MEMORY.md, database, and today's diary'), which normalizes broad persistence of user-provided data across several locations. Even though it appears in an example, this can encourage over-retention, duplicate sensitive data, and storage outside a minimal approved memory boundary.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The quickstart instructs installers to enable proactive behavior soon after installation and to send messages through an active external channel, but it does not clearly restate the required preconditions of explicit user opt-in and environment support at each step. In a messaging skill, this can lead to unauthorized outbound contact, privacy surprises, and deployment behavior that exceeds the manifest’s safety constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The example reminder messages are written only in Chinese, which can imply or encourage a fixed-language behavior for the skill. The file does not offer a user language choice or state that Chinese is optional, so this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/automation-guide.md (reported line 56)May include surrounding context.

md

- If the user asks to stop, disable proactive jobs immediately.
- If the user changes the preferred称呼 or timezone, refresh the wording/time.
- Do not create hidden background schedules without consent.
- Do not create more than one proactive job per purpose unless the user explicitly requests it.

## Example reminder text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/persona-notes.md (reported line 74)May include surrounding context.

md

- If the user asks to stop, disable proactive jobs immediately.
- If the user changes the preferred称呼 or timezone, refresh the wording/time.
- Do not create hidden background schedules without consent.
- Do not create more than one proactive job per purpose unless the user explicitly requests it.

## Example reminder text

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide includes proactive message examples entirely in Chinese, and line L55 also contains Chinese text, but nowhere indicates that the user can choose their preferred language. This can lead the skill or host to default to a specific language without user opt-in, which is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The summary describes the skill as a 'Chinese cat-persona skill' that generates replies as '猫' and addresses the user as '人', which is a language/locale-style constraint presented as default behavior. There is no indication here that users can opt into or change that language/persona mode, so this can violate policy against forcing a specific language or locale without user choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The checklist is framed as a general pre-send procedure for proactive check-ins but does not restate the critical prerequisite that proactive messaging is allowed only after explicit user opt-in and only in supported environments. In this skill's context, omission of those constraints increases the chance that downstream components treat the checklist alone as sufficient authorization to message the user.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The quiet-period rules are underspecified and broaden eligibility from a specific 6–9 pm window to vague conditions like 'later evening' and 'simply night.' In a skill explicitly supporting proactive check-ins, this ambiguity can cause the agent to initiate contact without sufficiently clear user-consented boundaries, leading to unwanted outreach or policy drift.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest says proactive scheduling must only be used when the user has explicitly opted in. The bedtime section only checks 'If user opted in' generally, while the file frames bedtime as a standing daily job for automation and does not preserve the manifest's narrower requirement that proactive scheduling itself be explicitly consented to; this broadens the described behavior into always-on scheduled outreach once generic opt-in is assumed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The sending policy says to prefer the active external channel, but it omits the manifest's requirement that external-channel delivery must only occur after explicit user opt-in. In a compact automation template, this omission can cause host implementations to treat channel availability as sufficient authorization, leading to unintended outbound messages on Feishu or Telegram.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The recommended user-facing message templates are written only in Chinese, and the file does not provide any alternative language or indicate that the user opted into Chinese. This creates a natural-language policy concern because it implicitly fixes the locale for outbound communication.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file states "Default language: Chinese," which is a natural-language locale constraint. Under the policy rules, forcing a specific language without explicit user opt-in or offering a language choice is a violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The recommended text hard-codes Chinese output without stating that this language choice depends on user preference. In a persona skill, this is mainly a consent and UX issue rather than a direct security flaw, but it can still cause unwanted or misleading outbound messaging if scheduled automatically for users who did not choose Chinese responses.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

These repeated reminder templates and payload examples continue to assume Chinese-only content for proactive messages without documenting language preference checks. Because this skill can schedule and potentially send messages externally, the lack of preference gating increases the chance of sending unwanted language-specific content to the wrong audience or context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The idle-time check-in examples prescribe Chinese-language outreach without documenting that the user must want both the proactive contact and the language used. In this skill context, unsolicited check-ins are already sensitive; coupling them with a forced language choice makes the behavior more likely to feel intrusive or socially risky, especially on external channels.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The template instructs delivery to external channels like Feishu or Telegram without requiring an explicit user-facing notice that content may leave the local dialog context and be shared with third-party services. In a skill that supports proactive messaging and cross-channel delivery, this creates a real privacy and consent risk because users may not understand where their messages will be sent or stored.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The checklist gives a concrete example check-in message in Chinese ("人在干嘛呀") without indicating that the user has requested or opted into that language. This can violate language or locale policy because it implicitly steers the skill toward a fixed language choice.

Content

No source excerpt is available for this finding.