Temp Notification Reader

• Outcome: Review
• Latest audit: May 28, 2026 · 1:29 PM UTC
• Version: 1.0.0

Overview

This skill appears to perform its stated local notification-export function, but it asks for broad Mac privacy access and can continuously store sensitive notification text in OpenClaw memory.

Install only if you are comfortable letting this skill read notification titles and message bodies and store them locally for OpenClaw to reuse. Prefer manual or narrowly scoped work-summary runs over cron, avoid granting Full Disk Access to /usr/bin/python3 unless you understand the system-wide effect, review generated memory files, and use the cleanup command carefully because it permanently deletes matching notification exports.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs users to run shell scripts that read notifications and write exported data into the OpenClaw memory tree, yet the skill metadata declares no permissions. This is dangerous because operators and policy engines cannot accurately assess or constrain the skill's access to local data and shell execution, especially given that notification contents often contain sensitive work and personal information.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared purpose says the skill reads macOS notifications and exports them to a notification directory, but the documented behavior goes further by generating summaries, extracting action items, and updating broader daily memory files. This mismatch matters because users may consent to simple export without realizing the skill performs additional analysis and persistence of potentially sensitive content, increasing privacy and downstream prompt-exposure risk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill description says notification data will be exported to `memory/computer_io/notification/`, but the code instead writes under the local skill directory by default and also permits arbitrary paths via `--output`. This breaks least surprise and can cause sensitive notification contents to be stored in unintended locations, making auditing, retention, and access control harder.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script instructs the user to grant Full Disk Access to `/usr/bin/python3`, which is a very broad privilege that would extend to any Python code run by that interpreter, not just this skill. In the skill context, this materially increases danger because the tool is designed to extract sensitive notification contents, and the permission request exceeds narrowly scoped access.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill description says notifications will be exported to a memory/computer_io/notification/ directory, but this script instead reads sensitive notification contents and prints them directly to the console. That mismatch increases the risk of unintended disclosure to terminal logs, screen recording software, observers, or downstream tooling that captures stdout.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The script instructs the user to grant Full Disk Access to /usr/bin/python3, which is a broad system-level permission far beyond a narrowly scoped notification export task. Once granted, any Python code run via that interpreter may inherit access to other protected user data, greatly expanding the blast radius if the environment or other scripts are untrusted.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README explicitly promotes exporting macOS notification contents into OpenClaw memory so the assistant can infer contacts, calendar items, and work activity, but it does not prominently warn that notifications often contain highly sensitive personal and corporate data. In this skill context, that omission matters because the tool is designed to persist exactly the kind of data that may include secrets, internal business information, and personal communications.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly promotes exporting macOS notification contents from apps like Teams, Outlook, and WeChat into OpenClaw memory so the AI can read and summarize them, but it does not prominently warn that these notifications may contain sensitive personal or corporate information. This creates a real privacy and data-exposure risk because users may enable broad notification harvesting without understanding the sensitivity or downstream availability of the stored content to the assistant.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill encourages periodic notification export and work summarization without a prominent warning that notifications may include sensitive personal messages, MFA codes, confidential meeting details, or client information. In this context, automatic harvesting into an AI-readable memory directory increases the chance of over-collection and accidental reuse of sensitive data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script aggregates notification-derived data and writes it into a persistent memory file under the OpenClaw memory directory without any user-facing notice, consent prompt, retention control, or sensitivity filtering. Notifications often contain sensitive personal or work information (messages, MFA codes, calendar details, internal alerts), so persisting even summarized content can create unintended long-term exposure to other tools, agents, or users with access to that memory store.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script exports recent macOS notification contents to a disk file under a persistent workspace/output directory without any user-facing notice, confirmation, or consent check. Notifications commonly contain sensitive information such as message previews, MFA codes, calendar details, and email subjects, so silently persisting them increases privacy and data-exposure risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The inline Python block writes notification data into a markdown file in a persistent directory, but the script itself provides no clear disclosure that this sensitive data is being retained on disk. In this skill's context, the stated purpose is to let another system 'understand your work dynamics,' which makes the collection broader and more privacy-invasive because unrelated personal and work notifications may be captured and stored.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This script reads and exports notification titles and bodies, which commonly contain messages, email subjects, codes, calendar details, and other sensitive personal or work data, yet it provides no explicit privacy warning or consent flow in the script itself. In this skill context, that makes the collection more dangerous because the functionality is surveillance-adjacent and produces a durable plaintext export of sensitive content.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This code extracts titles and bodies from notifications and prints them directly, which can expose messages, email subjects, calendar details, and other sensitive personal or work information. In an agent skill context, stdout is often captured, logged, or displayed to operators, making privacy leakage more likely than in a purely local interactive utility.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script accesses the protected macOS notification database but presents this primarily as a troubleshooting step for missing permissions, without clearly warning that it is reading privacy-sensitive notification history. That weak disclosure can mislead users about the sensitivity of the operation and the consequences of granting access.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script exports raw notification-derived content into a persistent markdown file under an OpenClaw memory/output directory without any user-facing notice, consent prompt, or minimization. Notifications commonly contain sensitive business messages, personal data, meeting details, and action items, so silently writing them to disk increases privacy and data-exposure risk if the files are later indexed, synced, or accessed by other tools.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The documentation encourages ongoing collection, storage, and summarization of notification contents in the AI memory directory, which can include sensitive communications and schedule data. Persistent storage increases the blast radius of any later compromise, misuse, or overreach by the assistant because historical notifications become available beyond their original transient context.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 方法二：手动添加 crontab

```bash
crontab -e
```

添加：

• Confidence: 84% confidence
• Finding: The documentation recommends installing a persistent cron job that repeatedly exports notification data every 30 minutes. Persistence increases risk because once enabled, sensitive notifications will continue to be harvested and written to disk without fresh user review, expanding the exposure window if the memory directory is later accessed by other tools or agents.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: README.en.md:136

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: README.md:136

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:131