Temp Notification Reader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 1.0.0

Overview

The skill appears to perform its stated notification-summary function, but it collects sensitive notification text into agent-readable memory with recurring scheduling and broad macOS disk-access guidance that need careful review.

Install only if you are comfortable with OpenClaw reading and retaining macOS notification titles and bodies, which may include messages, calendar details, approvals, or codes. Prefer manual or narrowly filtered runs over the 30-minute cron setup, avoid granting Full Disk Access to a general Python interpreter where possible, pin the npm package version if using npm, and periodically review and delete the stored notification memory.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T06 · System Persistence

Error

• Location: README.en.md:77

Finding

Recurring Notification Collection Creates Cross-Session Persistence

Content

View full analysis

> ~/.openclaw/logs/notification.log 2>&1 ``` ### Technical Analysis The installation instructions direct users to create either an OpenClaw scheduled job or a user crontab entry. The task survives individual Skill executions and automatically reads notifications every 30 minutes. Scheduling is related to the advertised automatic-summary functionality, and the project does not silently install the task. Nevertheless, persistent collection is not required for on-demand notification summaries and exceeds the minimum privileges and lifetime needed for that mode. The documentation does not provide removal instructions, retention controls, expiration, or consent-renewal guidance. The scheduled command invokes `export-notification.sh`, which exports raw notification content rather than only a minimized work summary. ### Attack Path 1. A user installs the Skill and grants it access to protected notification data. 2. The user follows the recommended instructions and registers the OpenClaw job or crontab entry. 3. The task runs every 30 minutes across future sessions. 4. Recent notification titles and bodies are repeatedly copied into OpenClaw memory. 5. Sensitive content continues accumulating until the user independently identifies and removes the scheduled task and stored data. ### Impact Assessment The persistence operates with the permissions of the user and the Python interpreter. It can cont ...[truncated 260 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: scripts/export-notification.sh:42

Finding

Untrusted Notification Content Is Written into Persistent Agent Memory

Content

View full analysis

= 3: time = parts[0].strip() app = parts[1].strip() content = parts[2].strip().replace('|', '\\|')[:100] f.write(f"| {time} | {app} | {content} |\n") ``` The collector creates the source content as follows: ```python title = notif_data.get('title', '') body = notif_data.get('body', '') content = title or body if title and body: content = f"{title}: {body}" if content: app_display = simplify_app_name(app_name) cat_tag = f"[{category}]" if category else "" lines.append(f"{t} | {app_display} {cat_tag} | {content}") ``` ### Technical Analysis Notification titles and bodies are attacker-influenced input. A remote party may influence this content by sending an email, chat message, calendar invitation, or other push notification. The exporter only escapes Markdown table separators and truncates content. It does not mark the content as untrusted, distinguish data from instructions, neutralize prompt-injection text, or prevent the resulting files from ...[truncated 1295 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/read_notifications.py:146

Finding

Predictable Shared Temporary Files Expose Notification Databases and Permit Symlink Attacks

Content

View full analysis

/dev/null ``` ```bash TMP_RAW="/tmp/work_notif_raw_$TS.txt" ``` ```bash OUTPUT_FILE="/tmp/notif_summary_$TODAY.txt" ``` ### Technical Analysis The scripts place complete notification-database copies and plaintext notification exports in the shared `/tmp` namespace using fixed or timestamp-predictable names. They do not use secure exclusive creation, randomized names, explicit `0600` permissions, or reliable cleanup through `finally` or shell traps. `shutil.copy2()` and ordinary file writes can operate on attacker-precreated paths. A local attacker can create a symlink or monitor the predictable filename before the Skill runs. Depending on destination permissions, this can expose private data, disrupt execution, or redirect a write to another user-writable target. The fixed database name also creates race conditions between concurrent executions. If a process terminates before cleanup, a full copy of the notif ...[truncated 1060 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/read_notifications.py:133

Finding

Granting Full Disk Access to the General Python Interpreter Violates Least Privilege

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/daily-summary.sh:26

Finding

Environment-Controlled Path Is Interpolated Directly into Python Source

Content

View full analysis

= 3: app = parts[1].strip().split('[')[0].strip() msg = parts[2].strip() apps.append(app) messages.append(msg) if not apps: print("No valid notifications") exit(0) # Count app_count = Counter(apps) # Write to daily memory memory_file = "$MEMORY_DIR/$TODAY.md" existing = "" try: with open(memory_file, 'r') as f: existing = f.read() except: pass # Chinese + English if "## 今日通知 / Today's Notifications" in existing: import re pattern = r"## 今日通知 / Today's Notifications[\s\S]*?(?=\n## |\Z)" new_section = f"""## 今日通知 / Today's Notifications - 条数 / Count: {len(apps)} - 应用分布 / Apps: {', '.join([f'{k}({v})' for k,v in app_count.most_common(10)])}""" existing = re.sub(pattern, new_section, existing) else: new_section = f""" ## 今日通知 / Today's Notifications - 条数 / Count: {len(apps)} - 应用分布 / Apps: {', '.join([f'{k}({v})' for k,v in app_count.most_common(10)])} ### 重要通知 / Important """ important = [m for m in messages if len(m) > 10][:5] new_section += '\n'.join([f"- {m[:100]}" for m in important]) existing += f"\n{new_section}" with open(memory_file, 'w') as f: f.write(existing) print(f"Updated: {memory_file}") print(f"Today's notifications: {len(apps)} items") EOF ``` ### Technical Analysis The heredoc delimiter is unquoted, so the shell expands `$OUTPUT_FILE`, `$MEMORY_DIR`, and `$TODAY` before Python parses the program. `MEMORY_DIR` is explicitly accepted from the pro ...[truncated 1318 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.en.md:33

Finding

Recommended Global npm Installation Is Unpinned and Not Bound to the Audited Artifact

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (45)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.en.md (reported line 136)May include surrounding context.

md

- ✅ Data stored locally (OpenClaw memory directory), not uploaded to any server
- ✅ Only reads notification titles and content, not attachments
- ✅ One-click cleanup: `rm -rf ~/.openclaw/workspace/memory/*/computer_io/notification/`

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.en.md (reported line 136)May include surrounding context.

md

- ✅ 数据保存在本地（OpenClaw memory 目录），不上传任何服务器
- ✅ 只读取通知标题和内容，不读取附件
- ✅ 支持一键清理：`rm -rf ~/.openclaw/workspace/memory/*/computer_io/notification/`

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 136)May include surrounding context.

md

- ✅ 数据保存在本地（OpenClaw memory 目录），不上传任何服务器
- ✅ 只读取通知标题和内容，不读取附件
- ✅ 支持一键清理：`rm -rf ~/.openclaw/workspace/memory/*/computer_io/notification/`

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.en.md (reported line 136)May include surrounding context.

md

- ✅ 数据保存在本地（OpenClaw memory 目录），不上传任何服务器
- ✅ 只读取通知标题和内容，不读取附件
- ✅ 支持一键清理：`rm -rf ~/.openclaw/workspace/memory/*/computer_io/notification/`

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 136)May include surrounding context.

md

- ✅ 数据保存在本地（OpenClaw memory 目录），不上传任何服务器
- ✅ 只读取通知标题和内容，不读取附件
- ✅ 支持一键清理：`rm -rf ~/.openclaw/workspace/memory/*/computer_io/notification/`

---

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

If the implementation only prints notification data to the console or uses temporary copies without persisting to the documented location, the skill behavior still diverges from its declared contract. Such discrepancies undermine informed consent and security review, because users cannot accurately predict where sensitive notifications will appear or whether they are retained or exposed in terminal logs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the implementation only prints notification data to the console or uses temporary copies without persisting to the documented location, the skill behavior still diverges from its declared contract. Such discrepancies undermine informed consent and security review, because users cannot accurately predict where sensitive notifications will appear or whether they are retained or exposed in terminal logs.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the implementation only prints notification data to the console or uses temporary copies without persisting to the documented location, the skill behavior still diverges from its declared contract. Such discrepancies undermine informed consent and security review, because users cannot accurately predict where sensitive notifications will appear or whether they are retained or exposed in terminal logs.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The cleanup instruction uses rm -rf with a wildcarded path under the OpenClaw memory tree. While the intent is benign, recursive force deletion can still be dangerous if variables, shell expansion, or copied paths are modified incorrectly, and it normalizes use of a destructive command in documentation for non-expert users.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md

- ✅ 数据保存在本地（OpenClaw memory 目录），不上传任何服务器
- ✅ 只读取通知标题和内容，不读取附件
- ✅ 支持一键清理：`rm -rf ~/.openclaw/workspace/memory/*/computer_io/notification/`

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

The cleanup instruction uses rm -rf with a wildcarded path under the OpenClaw memory tree. While the intent is benign, recursive force deletion can still be dangerous if variables, shell expansion, or copied paths are modified incorrectly, and it normalizes use of a destructive command in documentation for non-expert users.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md

- ✅ 数据保存在本地（OpenClaw memory 目录），不上传任何服务器
- ✅ 只读取通知标题和内容，不读取附件
- ✅ 支持一键清理：`rm -rf ~/.openclaw/workspace/memory/*/computer_io/notification/`

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README promotes periodic export of macOS notification content, which commonly contains sensitive personal and business data such as messages, meeting details, and approvals, but it does not prominently warn users about that sensitivity before enabling scheduled collection. In this skill context, the risk is elevated because the tool is explicitly designed to harvest ongoing notification streams into persistent memory for later AI consumption.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The README instructs users to create a persistent cron job that repeatedly exports notification content, creating ongoing collection and retention of sensitive information. In this context, persistence materially increases privacy risk because it automates surveillance-like behavior and broadens the amount of historical data available to any process or actor with access to OpenClaw memory.

Content

Scanner excerpt · README.en.md (reported line 93)May include surrounding context.

Method 2: Manual Crontab

bash

crontab -e

Add:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README encourages exporting macOS notification contents into persistent OpenClaw memory, which can include highly sensitive message previews, calendar details, approvals, and work activity metadata. Although it says data stays local, it does not clearly warn users about the privacy sensitivity, retention implications, or the risk that other skills/agents may later access and process that stored data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The README instructs users to install a recurring cron job that continuously captures notification data every 30 minutes, creating persistent collection of sensitive information. In the context of a notification-harvesting skill, scheduled execution materially increases privacy risk, retention volume, and the chance of unnoticed long-term monitoring.

Content

Scanner excerpt · README.md (reported line 93)May include surrounding context.

方法二：手动添加 crontab

bash

crontab -e

添加：

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documentation describes shell execution plus file read/write behavior, but it declares no explicit tool scope or permissions boundary. In an agent environment, that omission weakens reviewability and allows broader-than-expected execution surfaces for scripts that access local notification data and write artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill promotes exporting notification titles and contents into OpenClaw memory so the assistant can infer who is contacting the user and what they are working on, but it does not present a prominent warning that this data may remain accessible to the AI assistant for ongoing processing. Notifications often contain sensitive business and personal information, so lack of clear disclosure defeats meaningful user consent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The stated goal is to persist and summarize personal notification contents so the agent can track contacts, schedules, and current work. Even if intended as a productivity feature, this creates a structured surveillance dataset that may reveal sensitive communications, internal deadlines, meeting details, and behavioral patterns to the agent and any component with access to its memory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation recommends scheduled background collection every 30 minutes without a strong warning that this creates continuous surveillance and accumulation of potentially sensitive notifications. Automated harvesting increases both volume and persistence of exposed data, magnifying the consequences of compromise, misconfiguration, or overbroad agent access.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Periodic automatic harvesting into agent memory creates an ongoing leakage surface rather than a one-time user-initiated export. In the context of notification data, this is more dangerous because notifications often include ephemeral but highly sensitive content that users do not expect to be archived and summarized for future agent use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Instructing users to install a crontab creates persistence for recurring execution of a notification-harvesting script. Persistence is not inherently malicious here, but in this skill context it increases risk because sensitive data collection continues across sessions and may be forgotten after setup.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

方法二：手动添加 crontab

bash

crontab -e

添加：

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script writes raw notification output to a predictable file in /tmp, which is an inappropriate location for sensitive transient data. Even if later deleted, the data exists on disk during processing and may be exposed to other local processes, backups, crash artifacts, or race/symlink issues depending on environment and permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script persists notification-derived content into a long-lived memory file without any consent prompt, filtering, or sensitivity checks. Notifications often contain OTPs, message previews, email subjects, calendar details, and other private data, so storing them in an agent-readable memory directory increases privacy exposure and broadens the blast radius of any later compromise or misuse.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script is designed to persist notification contents into an OpenClaw memory/workspace directory, creating durable records of transient notifications. In this skill context, that is more dangerous because the data is intentionally stored where an AI system may later ingest, index, or expose sensitive personal or enterprise information beyond the original notification lifecycle.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script captures recent macOS notification contents and writes them to a markdown file without any interactive warning, consent prompt, or sensitivity check. Notifications commonly contain secrets, personal messages, MFA codes, and work data, so silently exporting them to disk increases the chance of unintended disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script is explicitly designed to read macOS Notification Center data, which can contain highly sensitive personal and business information such as message previews, email subjects, calendar items, and authentication prompts, then export it to disk. In the skill context this is more dangerous because it centralizes private notifications into a readable file under the skill/output path, increasing exposure to other local processes, later collection, or accidental disclosure.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: README.en.md:136

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: README.md:136

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:131