T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cal_backend.py:65- Finding
Sensitive OAuth tokens and local state are created without enforced restrictive permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Proactive Claw
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent calendar assistant, but it stores powerful calendar credentials locally and can allow insecure Nextcloud connections, so users should review it carefully before installation.
Install only if you are comfortable granting calendar access and storing calendar tokens or app passwords on this machine. Use HTTPS-only Nextcloud URLs, prefer a dedicated low-privilege app password, keep the skill directory private to your user account, and revoke Google OAuth or rotate the Nextcloud password if you uninstall or suspect exposure.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/cal_backend.py:136- Finding
Nextcloud credentials can be transmitted over an unencrypted HTTP connection
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements-google.txt:1- Finding
Dependency installation instructions do not authenticate package artifacts with hashes
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (85)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | File / DB | Contents | Location | Retention | |-----------|----------|----------|-----------| | `credentials.json` | Google OAuth client definition (client_id, client_secret) | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it | | `token.json` | Google OAuth access + refresh token | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it or revoke at myaccount.google.com | | `config.json` | Your settings, calendar IDs, feature flags | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it | | `memory.db` | Meeting outcomes, rules, policies, contacts, notification logs, energy scores, proactivity scores | `~/.openclaw/workspace/skills/proactive-claw/` | Configurable via `memory_decay_half_life_days` (default: 90 days) |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | File / DB | Contents | Location | Retention | |-----------|----------|----------|-----------| | `credentials.json` | Google OAuth client definition (client_id, client_secret) | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it | | `token.json` | Google OAuth access + refresh token | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it or revoke at myaccount.google.com | | `config.json` | Your settings, calendar IDs, feature flags | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it | | `memory.db` | Meeting outcomes, rules, policies, contacts, notification logs, energy scores, proactivity scores | `~/.openclaw/workspace/skills/proactive-claw/` | Configurable via `memory_decay_half_life_days` (default: 90 days) |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | File / DB | Contents | Location | Retention | |-----------|----------|----------|-----------| | `credentials.json` | Google OAuth client definition (client_id, client_secret) | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it | | `token.json` | Google OAuth access + refresh token | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it or revoke at myaccount.google.com | | `config.json` | Your settings, calendar IDs, feature flags | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it | | `memory.db` | Meeting outcomes, rules, policies, contacts, notification logs, energy scores, proactivity scores | `~/.openclaw/workspace/skills/proactive-claw/` | Configurable via `memory_decay_half_life_days` (default: 90 days) |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python | File / DB | Contents | Location | Retention | |-----------|----------|----------|-----------| | `credentials.json` | Google OAuth client definition (client_id, client_secret) | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it | | `token.json` | Google OAuth access + refresh token | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it or revoke at myaccount.google.com | | `config.json` | Your settings, calendar IDs, feature flags | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it | | `memory.db` | Meeting outcomes, rules, policies, contacts, notification logs, energy scores, proactivity scores | `~/.openclaw/workspace/skills/proactive-claw/` | Configurable via `memory_decay_half_life_days` (default: 90 days) |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python | File / DB | Contents | Location | Retention | |-----------|----------|----------|-----------| | `credentials.json` | Google OAuth client definition (client_id, client_secret) | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it | | `token.json` | Google OAuth access + refresh token | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it or revoke at myaccount.google.com | | `config.json` | Your settings, calendar IDs, feature flags | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it | | `memory.db` | Meeting outcomes, rules, policies, contacts, notification logs, energy scores, proactivity scores | `~/.openclaw/workspace/skills/proactive-claw/` | Configurable via `memory_decay_half_life_days` (default: 90 days) |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh | File / DB | Contents | Location | Retention | |-----------|----------|----------|-----------| | `credentials.json` | Google OAuth client definition (client_id, client_secret) | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it | | `token.json` | Google OAuth access + refresh token | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it or revoke at myaccount.google.com | | `config.json` | Your settings, calendar IDs, feature flags | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it | | `memory.db` | Meeting outcomes, rules, policies, contacts, notification logs, energy scores, proactivity scores | `~/.openclaw/workspace/skills/proactive-claw/` | Configurable via `memory_decay_half_life_days` (default: 90 days) |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh | File / DB | Contents | Location | Retention | |-----------|----------|----------|-----------| | `credentials.json` | Google OAuth client definition (client_id, client_secret) | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it | | `token.json` | Google OAuth access + refresh token | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it or revoke at myaccount.google.com | | `config.json` | Your settings, calendar IDs, feature flags | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it | | `memory.db` | Meeting outcomes, rules, policies, contacts, notification logs, energy scores, proactivity scores | `~/.openclaw/workspace/skills/proactive-claw/` | Configurable via `memory_decay_half_life_days` (default: 90 days) |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh | File / DB | Contents | Location | Retention | |-----------|----------|----------|-----------| | `credentials.json` | Google OAuth client definition (client_id, client_secret) | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it | | `token.json` | Google OAuth access + refresh token | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it or revoke at myaccount.google.com | | `config.json` | Your settings, calendar IDs, feature flags | `~/.openclaw/workspace/skills/proactive-claw/` | Until you delete it | | `memory.db` | Meeting outcomes, rules, policies, contacts, notification logs, energy scores, proactivity scores | `~/.openclaw/workspace/skills/proactive-claw/` | Configurable via `memory_decay_half_life_days` (default: 90 days) |
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
OAuth setup, token storage, remote calendar creation, and account-identifier collection are highly sensitive backend operations that are not fully reflected in the assistant-style description. This is dangerous because mishandled scopes or storage could expose or modify external calendars and associated identity data.
- Content
Static analysis
No suspicious patterns detected.