Security audit

Survival Manager

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it asks for broad autonomous access to files, browser state, messages, calendars, business accounts, and balance data without enough scoping or user control.

Install only if you are comfortable with an autonomous assistant periodically inspecting sensitive local and account-linked information. Before enabling it, narrow the allowed files, accounts, browser origins, APIs, and notification channels; require fresh approval before reading email/calendar/browser/business-account data or sending any data to models, search, APIs, or Telegram; and use a pinned reviewed package version.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:44
Finding: Overbroad Autonomous Access to Sensitive Resources<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:44-49` and `SKILL.md:269-274`; duplicated in `README.md:114-119` **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium ### Vulnerable Code ```markdown | Task | Interval | Description | |------|----------|-------------| | health_check | 5 minutes | Gateway/browser/skill status | | email_check | 1 hour | Urgent unread email | | calendar_check | 1 hour | Events within 24 hours | | fiverr_order_check | 30 minutes | New orders/messages | | balance_check | 1 hour | Balance/survival tier | ``` The autonomous-execution rules at `SKILL.md:269-274` state: ```markdown ### Autonomous operations permitted without authorization - Read files - Perform network searches - Capture browser snapshots - Make API calls costing less than ¥10 ``` ### Technical Analysis The skill permits file reads, browser snapshots, network searches, and paid API calls without user authorization. It also directs the agent to inspect email, calendar events, Fiverr messages, account balances, and browser state on recurring schedules. These permissions are not constrained by: - An allowed directory list for file reads - An approved account or mailbox list - Browser origin or page restrictions - An API endpoint and HTTP-method allowlist - Data-field minimization rules - Per-operation consent for sensitive information - Restrictions on placing retrieved information into model context The ¥10 threshold limits monetary cost only. It does not control the sensitivity of transmitted or retrieved information. Consequently, an inexpensive request could still disclose highly sensitive data. No implemented external exfiltration endpoint was found in the audited artifact, so this finding concerns excessive authorized capability rather than confirmed malicious data theft. ### Attack Path 1. The user installs or activates the skill. 2. A scheduled heartbeat or user interaction triggers an email, calen ...[truncated 1184 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, operation-specific consent before accessing email, calendars, authenticated browser pages, financial data, or commercial account messages. 2. Restrict file reads to documented project-relative paths and reject absolute paths, parent-directory traversal, symbolic-link escapes, and protected operating-system locations. 3. Introduce allowlists for browser origins, accounts, API endpoints, HTTP methods, and permissible response fields. 4. Treat browser snapshots and operations that may transmit data as high-risk regardless of monetary cost. 5. Display a preview of the destination, fields, and data payload before any network or model request containing user information. 6. Minimize sensitive content placed into model context by using local filtering and redaction. 7. Record access decisions in an auditable log containing the resource, purpose, requesting component, and authorization result. 8. Disable recurring checks by default and require the user to opt in separately to email, calendar, Fiverr, browser, and financial monitoring. ]]>

T08 · Insecure Dependencies

Note

Location: README.md:25
Finding: Unpinned Third-Party Installation Sources<![CDATA[ ## Vulnerability Details **File Location**: `README.md:25-30` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Low ### Vulnerable Code ```bash # Install through the ClawHub CLI clawhub install survival-manager # Or install manually git clone https://github.com/openclaw_ceo/skills/survival-manager # Copy into the OpenClaw skills directory ``` ### Technical Analysis Both documented installation methods retrieve mutable upstream content. The commands do not specify an immutable package version, release tag, commit hash, checksum, or cryptographic signature. This is particularly relevant because `SKILL.md:6` declares `scripts/*`, but the audited artifact contains only `README.md` and `SKILL.md`. A future or different upstream package could therefore include executable scripts that were not present in, and are not covered by, this audit. This finding does not establish that the current upstream repository or ClawHub package is malicious. It identifies a supply-chain integrity weakness that prevents users from reliably reproducing the reviewed artifact. ### Attack Path 1. An attacker compromises the upstream repository, package publisher account, or distribution channel, or the upstream content otherwise changes after this audit. 2. Malicious or vulnerable files are added to the mutable package or default repository branch. 3. A user runs `clawhub install survival-manager` or clones the repository without selecting a reviewed immutable revision. 4. The user receives content different from the audited two-file artifact. 5. Newly supplied scripts or instructions execute later when the skill is invoked, using the permissions available to the OpenClaw runtime. ### Impact Assessment Successful exploitation could install unaudited skill instructions or executable scripts. The resulting privileges would be those granted to the package manager, OpenClaw runtime, and invoked scripts, potentially including access to local files, browser to ...[truncated 240 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin ClawHub installation to a specific immutable release version supported by the package manager. 2. Pin manual installation to a full Git commit hash rather than the mutable default branch. 3. Publish SHA-256 or stronger checksums for every release artifact and document mandatory verification steps. 4. Cryptographically sign releases and verify signatures against a separately documented maintainer key. 5. Ensure the distributed package manifest lists every included file and reject unexpected files during installation. 6. Align the declared `scripts/*` content with the actual package. Remove the declaration if scripts are not distributed, or include the scripts so they can be audited. 7. Re-run security review whenever the pinned revision or package manifest changes. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The skill explicitly claims that all file writes require user authorization, but the included PowerShell examples write to finance logs, authorization-pending.md, and survival-config.json directly with no authorization enforcement. This creates a trust-boundary mismatch: an operator may rely on the documentation for safety while the actual workflow permits silent state changes and file modification.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The README presents all operational instructions, examples, safety notes, and approval responses exclusively in Chinese, including the expected authorization reply terms like "批准" and "拒绝". This can constitute a language/locale policy violation because it implicitly forces a specific language for use without documenting an opt-in or stating that the skill is region-specific.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: Most operational instructions, outputs, and user-facing authorization/status formats are specified in Chinese, including required response phrases like "批准" and "拒绝". The document does not state that language is configurable or optional, which can violate a language/locale policy requiring user choice unless the locale restriction is documented and justified.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger conditions are broad enough to cause the skill to activate on many routine events such as balance changes, record updates, or vague coordination needs. In an autonomous or semi-autonomous agent, ambiguous triggers increase the chance of unintended execution chains, including repeated checks, unsolicited actions, or cascading authorization requests.

Static analysis

No suspicious patterns detected.