Security audit

phoenixclaw

Security checks for vulnerabilities and agentic risk

Overview

Review before installing: this journal skill can automatically read broad private conversation history, keep long-term profile and media records, and includes an unsafe local shell fallback.

Install only if you want passive, scheduled journaling across OpenClaw sessions, agent sessions, cron runs, memory files, and media. Before enabling cron, review the journal path, disable unwanted plugins, decide whether profile and growth-map updates are acceptable, and avoid preserving sensitive media or EXIF/GPS data. The rolling-journal script should be fixed to remove execSync shell fallbacks or strictly validate journal_path before use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/rolling-journal.js:324
Finding: Command Injection Through Unvalidated Journal Path
Content: View full analysis
"${filename}" << 'EOF' ${escapedContent} EOF`, { encoding: 'utf-8' }); } catch (shellErr) { console.error('Shell write also failed:', shellErr.message); throw e; } } return filename; } ``` ### Technical Analysis The `journal_path` value originates in `~/.phoenixclaw/config.yaml`, but the implementation parses it with a regular expression and performs no validation against shell metacharacters, command substitutions, control characters, or an approved storage root. The path is interpolated directly into commands executed through `child_process.execSync() ...[truncated 1861 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/media-handling.md:80
Finding: Unscoped Media Copying Causes Excessive Retention of Private Images
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (57)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This second mismatch finding is also valid because the skill describes a user-invoked journaling capability but instructs standalone scheduled execution, broad local log reads, and configurable file writes without declared permissions. Such understatement of capability increases the chance of unauthorized data access and persistence under the guise of a simpler feature.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This second mismatch finding is also valid because the skill describes a user-invoked journaling capability but instructs standalone scheduled execution, broad local log reads, and configurable file writes without declared permissions. Such understatement of capability increases the chance of unauthorized data access and persistence under the guise of a simpler feature.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs comprehensive passive collection and persistence of private conversations across main, agent, and cron session sources into journals and long-term files without requiring a per-run request. This is dangerous because it centralizes sensitive content and inferences from multiple contexts, increasing exposure, misuse, and accidental disclosure risk.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The instructions explicitly require scanning raw session logs and memory files containing personal reflections the user asked the AI to remember, then combining them for richer profiling and journaling. This aggregation of sensitive records across sources creates a significant privacy and confidentiality risk, especially when done automatically and comprehensively.
Content: No source excerpt is available for this finding.

Context Leakage

High

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The skill's merge-and-fallback logic combines memory files, raw session logs, and historical search results to capture conversation context and persist enriched outputs. That broad context aggregation can leak information between separate sessions or roles and expose content to downstream journal, profile, or plugin outputs that users did not intend to unify.
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
md
) ``` - **Edge case - Midnight boundary**: For late-night activity that spans midnight, expand the **timestamp** range to include spillover windows (for example, previous day 23:00-24:00) and still filter per-message by `timestamp`. - **Merge sources:** Combine content from both memory files and session logs. Memory files capture explicit user reflections; session logs capture conversational flow and media. Use both to build complete context. - **Fallback:** If memory is sparse, reconstruct context from session logs, then update memory so future runs use the enriched memory. Incorporate historical context via `memory_search` (skip if embeddings unavailable) 3. **Moment Identification:** Identify "journal-worthy" content: critical decisions, emotional shifts, milestones, or shared media. See `references/media-handling.md` for photo processing. This step generates the `moments` data structure that plugins depend on.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Continuously updating a long-term profile with inferred values, goals, and personality traits is sensitive profiling that can be inaccurate, overreaching, and harmful if exposed or reused beyond the user's expectations. In the context of a passive journaling skill, this makes the capability substantially more dangerous because it creates durable inference records rather than simple summaries.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.
md
- `session-day-audit.js`: Diagnostic utility for verifying target-day message coverage across session logs.

Ssd 3

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The cron payload mandates scanning logs, generating moments from them, executing all plugins, and producing a journal with all plugin sections. This forces maximal data incorporation and plugin execution without contextual gating, which can amplify exposure of private content and propagate it into additional outputs or integrations beyond the original journaling purpose.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructions direct broad collection of session content from multiple directories and use that content to reconstruct context and update memory. In a journaling skill, this is especially dangerous because it can sweep in sensitive data from other agents, cron runs, or in-progress sessions, then persist or surface that material in generated output and downstream memory stores.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Preserving Exif metadata such as GPS coordinates and timestamps can expose precise location history and behavioral patterns. In a personal journaling context, embedding or retaining such metadata without warning or minimization is particularly risky because it ties sensitive images to a durable life log.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This file describes building a living user profile through passive observation and refinement over time, but it does not present a user-facing consent, notice, or control mechanism for that profiling. Because the broader skill context says it scans daily conversations from main, agents, and cron paths, the absence of explicit disclosure materially increases privacy risk and the chance of non-consensual behavioral profiling.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The profile bootstrap process explicitly says the AI scans available conversation history on first execution, yet no explicit privacy warning, consent gate, or scoped limitation is attached to that action. In this skill's context, where conversation history may span multiple session paths and contain sensitive behavioral data, bootstrap scanning creates immediate risk of collecting and inferring personal attributes without informed permission.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill declares no explicit tool scope or permissions, yet its instructions require broad filesystem and environment access to scan session trees, memory files, and write journals and profile artifacts. Missing scope declarations make the actual data-access surface opaque and can lead to overbroad execution in hosts that default to permissive access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is designed to passively scan all session paths and modify multiple user files, yet it does not prominently require clear notice and consent for those privacy and persistence impacts. Users may reasonably expect a journal request to summarize current context, not to mine all conversation stores and update long-term records automatically.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The document hard-codes Asia/Shanghai as the default timezone and incorporates Chinese-language commands and finance-screening keywords as part of normal operation. The skill does not clearly present this as an opt-in regional mode or offer users a locale/language choice, which can violate language or locale policy expectations.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The fallback behavior expands retention by reconstructing sparse memory from session logs and then writing that enriched memory back for future use. This can transform transient conversational data into durable memory without a clear user action, increasing privacy exposure and making later deletion or correction harder.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Adding finance-processing through a Ledger plugin expands the skill from journaling into transaction-related data handling, including payment screenshots and financial metadata. This introduces more sensitive-data exposure and secondary use risk that is not justified by the manifest's core purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Maintaining a growth map and evolving long-term profile goes beyond generating a daily journal and creates an accumulating dossier of inferred traits, goals, and behaviors. This broader persistence and inference surface increases privacy risk and potential misuse of sensitive personal data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest grants broad powers including reading all session/agent/cron logs, registering cron jobs, and executing plugins, but it does not declare any trigger scope, user-consent boundary, or activation constraint limiting when those powers may be used. In this skill’s context, that is especially dangerous because it is designed for passive journaling across multiple session sources, so overbroad capabilities can enable continuous collection, secondary processing, and extension through plugins beyond what a user may reasonably expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The template is explicitly designed to infer and store sensitive personal and behavioral data such as identity details, personality traits, communication style, interests, activity rhythms, and milestones. In the context of a journaling skill that scans conversations from all session paths, this creates a meaningful privacy risk because users may not realize the breadth of profiling being performed or how much sensitive information is being persisted.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The cron payload explicitly directs the skill to update timeline, growth-map, and profile data in addition to generating a journal. That expands the job from passive summarization into persistent mutation of user data stores, increasing the risk of unauthorized profiling, inaccurate state changes, and unintended cross-context retention if the nightly job runs without explicit per-scope consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file instructs recursive scanning of multiple session and memory directories, including agent and cron paths, without an explicit privacy notice, consent boundary, or minimization rule. Because this is scheduled and passive, it can collect sensitive content from unrelated sessions and ingest it into journaling context without the user realizing the breadth of access.
Content: No source excerpt is available for this finding.

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · references/cron-setup.md (reported line 95)May include surrounding context.
md
' | wc -l # 2. Check images were extracted (if any existed) ls -la ~/PhoenixClaw/Journal/assets/$(date +%Y-%m-%d)/ 2>/dev/null || echo "No assets dir" # 3. Check Ledger plugin ran (if installed) grep -q "财务\|Finance\|💰" ~/PhoenixClaw/Journal/daily/$(date +%Y-%m-%d).md && echo "Ledger OK" || echo "Ledger section missing"

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Declaring support for Telegram, WhatsApp, Discord, and CLI media capture extends the skill into multi-channel attachment handling beyond its stated passive conversation-scanning role. That broader intake surface increases the chance of collecting unrelated or sensitive attachments from multiple sources without users understanding that journaling includes attachment harvesting.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The workflow adds photo ingestion, transient buffering, vision analysis, relocation, renaming, and embedding into permanent journal assets, which materially expands the skill from passive text journaling into media processing and retention. In this skill context, that is dangerous because it increases collection and persistence of sensitive user data without clear consent, scope limitation, or necessity for the stated purpose.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/rolling-journal.js:333