T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:20- Finding
Mandatory Cross-Session Agent Behavior Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
observerclaude
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed UX research observer, but it asks to continuously record and persist everything a user says and does, which is too broad for default installation.
Install only if you intentionally want a persistent UX research study of your OpenClaw usage. Review the data directory, pause/delete controls, raw-log retention, report contents, and any Google/email integrations before enabling it; avoid using it around confidential work unless collection is explicitly narrowed and pre-storage redaction or deletion controls are added.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
observation.json:53- Finding
Excessive Persistent Collection of Conversation and System-Reconnaissance Data
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
UxrObserver-Skill-Prompt.md:252- Finding
Sensitive Raw Logs Are Persisted Before Redaction
- Content
View full analysis
- Remediation
View remediation
other
Error
- Location
report-template.md:302- Finding
Cloud Report Creation Can Transmit Data Before Explicit Sharing Consent
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
generate-charts.py:9- Finding
Unpinned Third-Party Dependency Installation Instruction
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (52)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description covers an end-to-end always-on UX research and reporting system with data capture, survey orchestration, persistence, redaction, and email/report workflows. The actual code chunk only implements one narrow reporting subcomponent: chart generation from existing JSON/JSONL files over a manually provided date range. While some chart topics align with parts of the declared functionality (use cases, satisfaction, failures, sentiment, costs, tool usage, complexity), the code’s primary purpose is materially narrower and lacks most of the core declared behaviors and triggers. Therefore the description does not accurately represent what this code chunk actually does.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly says it should be used on every conversation, run continuously, and never forget. Near-universal invocation turns a single-purpose research assistant into a background surveillance layer, greatly increasing the amount of user data collected and the chance of collecting sensitive content outside the user's immediate expectations.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is designed for continuous collection across every conversation and task, including broad behavioral profiling and persistence. That level of default collection is dangerous because it captures far more data than is necessary for a narrow task and creates a durable record of potentially sensitive activity, preferences, and workflows.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill mandates extensive persistent logging, aggregate tracking, heartbeat files, and immediate disk writes for every interaction without an ongoing just-in-time notice at the moment of capture. This creates a high risk of silently storing sensitive user content, behavior patterns, and operational metadata in a local archive that may outlast user awareness.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The verbatim capture policy instructs logging the user's exact words for every request, correction, emotional reaction, and commentary, while redacting only narrow categories. This is especially dangerous because free-text conversations often contain health, legal, workplace, relationship, financial, or other sensitive context that would still be retained and later surfaced in reports even if it is not a password or API key.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The reporting workflow assembles detailed task logs and a verbatim gallery from accumulated user data for later sharing, increasing the blast radius of prior overcollection. Even with user-prompted sending and redaction, consolidating longitudinal activity into a portable report materially raises the risk of privacy leakage, misdelivery, or exposure of sensitive context.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs comprehensive capture of everything users do and say, then retention of that content in logs and reports. Even with local storage claims, this creates a substantial natural-language data leakage risk because sensitive prompts, secrets, business data, and personal details may be stored and later surfaced or exported.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill mandates continuous observation, immediate disk persistence, and nonstop monitoring before any meaningful runtime warning or granular consent flow. For a tool that records everything users say and do, beginning collection without strong, upfront disclosure and opt-in creates a serious privacy and trust risk.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill presents itself as a local-only observer that 'never transmits without consent,' but elsewhere defines workflows that create Google Docs and send reports via email. Even if prompting for an address is intended as consent, the mismatch is dangerous because it can mislead users about when data leaves the local system and what external services receive sensitive content.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Explicitly logging every user request, reaction, correction, and spontaneous commentary as verbatim quotes guarantees retention of potentially sensitive natural-language content. Those verbatims can contain credentials, proprietary information, health data, legal matters, or personal identifiers that later appear in reports or exports.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The observation schema stores full request verbatims plus rich contextual narratives for every interaction, enabling broad retention and reconstruction of user activity. This level of detail creates a persistent repository of sensitive data that can be misused, accidentally disclosed, or over-shared in downstream reporting.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Automatic Google Doc creation and email-oriented report delivery send sensitive interaction data to third-party services, but the spec does not require a strong user-facing warning about that external exposure at the moment of action. This is dangerous because users may assume 'local only' handling while their data is actually copied into cloud services.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The report template requires per-task narratives and exact user quotes for every interaction, semantically directing broad reproduction of collected user data. This amplifies leakage risk because sensitive content is not only stored but intentionally repackaged into a shareable artifact.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The first-run messaging normalizes persistent observation of everything the user says and promises exact quoting in reports, which entrenches a high-risk data collection model from the outset. This is especially dangerous because it frames exhaustive surveillance as the default rather than a narrowly scoped, opt-in research activity.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This taxonomy mandates maintaining a persistent use-case frequency table tied to detailed interaction categories, which supports ongoing behavioral profiling without any visible consent, minimization, or retention controls. In the broader skill context, this is more dangerous because the skill is designed to run on every conversation, persist data immediately to disk, and "never forget," turning routine usage into continuous surveillance.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Pervasive longitudinal collection of all user inputs and reactions creates a direct natural-language leakage risk because prompts often contain confidential business data, authentication material, and personal information. The surrounding skill metadata substantially increases severity: it instructs continuous execution on every conversation, immediate disk persistence, sub-agent monitoring, and report generation, all of which expand the attack surface and the consequences of accidental disclosure or misuse.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document explicitly requires verbatim capture of every request, reaction, correction, emotion, and commentary, which can include secrets, personal data, credentials, health/financial information, or other sensitive free-form content. This is especially dangerous in this skill because it frames itself as passive background observation across all conversations, making overcollection and silent retention of sensitive natural-language data highly likely.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The combined instructions tell the system to retain detailed user requests, corrections, quotes, narratives, and tool/context metadata in persistent files, while only excluding a very narrow set of secrets. This is a classic natural-language data leakage pattern because many sensitive facts are not passwords or API keys and will still be stored and later processed.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The observer is instructed to passively record every interaction, capture actual user words, and write them to disk immediately while remaining invisible. Covert collection without a clear, timely user-facing notice and consent is a serious privacy and compliance risk, especially because the stored data includes arbitrary conversation content.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The observer prompt explicitly says to capture everything verbatim except a narrow class of secrets, which conflicts with the skill's claim of automatic PII redaction. That means names, emails, health details, legal matters, and other sensitive free-text content may be persistently stored before any later report-time redaction occurs.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
These instructions introduce external transmission of collected research data by email without a clear prior warning in the skill behavior. Because the underlying dataset includes persistent verbatim logs and derived reports, emailing materially increases privacy, confidentiality, and accidental disclosure risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions require generating and storing a task context summary plus detailed verbatim survey responses, but there is no user-facing warning that these data will be retained. This is especially dangerous given the skill's broader design of passive observation and immediate persistence, because users may reveal sensitive task details believing they are only answering a transient check-in.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The end-of-day schema stores detailed verbatim feedback and future-use plans without informing users at the point of collection, creating a hidden retention channel for sensitive personal and business information. In this skill's context of pervasive monitoring and disk persistence, the absence of transparent notice significantly increases privacy and misuse risk.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The schema directs collection of users' exact words about frustrations, valuable tasks, and tomorrow's plans, which can easily include sensitive personal, commercial, or security-relevant information. Persisting these verbatims in a system designed for comprehensive observation materially increases the risk of profiling, overcollection, and disclosure.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
A global instruction to log all responses verbatim creates an unbounded channel for retaining whatever sensitive information users happen to disclose, with no minimization or guardrails. In a continuous background-observation skill, this is particularly dangerous because users may be repeatedly prompted and their exact statements preserved indefinitely.
- Content
Static analysis
No suspicious patterns detected.