nutcrackertestgpt

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:59 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned and local-only, but it can repeatedly collect and store broad conversation history and operational logs with saved consent.

Review the consent settings before installing or scheduling this skill. Prefer this_session_only and minimal capture unless you explicitly need broader research, avoid cron until you are comfortable with recurring collection, and use purge or purge full when reports are no longer needed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:73

Finding

Overbroad Cross-Session Conversation and Log Collection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:73-91; references/fallback-session-paths.md:10-21
Vulnerability Type: Excessive access to session histories and operational logs
Risk Level: Medium

Vulnerable Instructions

SKILL.md:73-91:

markdown

## Step 4: Collect Raw Data (Local Only)

Use this order:

1. Preferred path with built-in OpenClaw session tools.
   - List candidate sessions updated in the window (`sessions_list`).
   - For each relevant session, fetch history with tool messages when available (`sessions_history`).
2. Fallback path from local transcript files when session tools are unavailable.
   - Read standard paths from `{baseDir}/references/fallback-session-paths.md`.
   - Parse `sessions.json` index and per-session transcript files (`*.jsonl`) best effort.
   - If fallback paths are inaccessible, continue with available data and document the limitation.
3. Optional supplemental source when available.
   - If local gateway logs are present and readable, extract only UX-relevant operational signals (errors, retries, permission denials, tool failures) into the same normalized stream.
   - Treat gateway logs as optional; do not fail the run when missing.

Normalize records into an event stream with:

- `event_id`

references/fallback-session-paths.md:10-21:

markdown

## Common Session Storage Layout

- `<stateDir>/agents/<agentId>/sessions/sessions.json`
- `<stateDir>/agents/<agentId>/sessions/*.jsonl`

`sessions.json` is typically an index. `*.jsonl` files typically contain event history.

## Discovery Strategy

1. If current session metadata includes `agentId`, use that exact path first.
2. If `scope=all_agent_sessions` and `agentId` is unknown, enumerate `<stateDir>/agents/*/sessions/`.
3. Filter sessions by `updatedAt` (or nearest equivalent timestamp) to match the requested window.
4. P
...[truncated 3538 chars]

Remediation

View remediation

Remediation Suggestions

1. Make this_session_only the mandatory default scope and minimal the default capture level.
2. Require fresh, explicit confirmation immediately before every all_agent_sessions or full capture run; do not rely only on previously stored consent.
3. Present the exact session IDs, data sources, time window, capture level, and estimated record volume before collection begins.
4. Require users to select specific session IDs instead of enumerating agents/*/sessions/ by default.
5. Disable gateway-log collection by default and require separate consent because logs may include unrelated operational data.
6. Collect aggregate event labels and counters whenever raw message text is unnecessary. Avoid persisting tool outputs in minimal and snippet modes.
7. Apply restrictive filesystem permissions to state.json, data/, and reports/, such as owner-only access where supported.
8. Validate that all resolved fallback paths remain beneath the expected OpenClaw state directory, reject symlinks that escape the approved root, and preserve the existing traversal and shell-metacharacter checks.
9. Add post-redaction validation that blocks persistence when likely secrets or high-risk data remain, rather than relying solely on a fixed pattern list.
10. Show a post-run inventory of all files created and provide an immediate purge option.
11. Store only pseudonymous session identifiers and use a keyed local hash if identifiers must remain stable across reports.
12. Minimize retention for full-text capture and consider deleting raw events immediately after aggregate reports are generated.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The top-level skill metadata describes the capability as 'privacy-first UX research ethnography' but does not clearly and prominently disclose that the skill will extract, analyze, and persist local session conversations and usage data. Users or operators may invoke or install it without understanding the scope of collection, creating a consent-transparency failure even though later workflow steps mention consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The cron example enables unattended recurring execution of a skill that collects and stores conversation-derived research data, but the example lacks an adjacent warning about repeated collection, retention, and consent requirements. In practice, operators may paste the schedule command directly, causing ongoing background data capture with reduced user awareness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.