Midlong Term Task Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:59 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent task manager, but it persists scheduled, agent-readable Markdown reports from raw task data that could mislead later agent reviews.

Review this skill before installing if task content may come from copied web text, other users, or untrusted sources. Use it only if you are comfortable with persistent .tasks logs and optional cron execution, and consider adding validation or Markdown escaping before letting an agent consume generated reports.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/task_check.sh:39

Finding

Unsanitized Task Data Injected into Heartbeat Markdown Logs

Content

View full analysis

/dev/null || echo "") if [ -n "$IN_PROGRESS_TASKS" ]; then echo "" >> "$LOG_FILE" echo "## 进行中的任务" >> "$LOG_FILE" while IFS='|' read -r task_id task_name due_date progress; do echo "" >> "$LOG_FILE" echo "### $task_id: $task_name" >> "$LOG_FILE" echo "- **截止日期:** $due_date" >> "$LOG_FILE" echo "- **当前进度:** $progress%" >> "$LOG_FILE" ``` ### Technical Analysis Values extracted from `tasks.json`, including `id`, `name`, `due_date`, and `progress`, are written directly to an agent-readable Markdown log without validation or escaping. An attacker who can create or modify a task can include line breaks, Markdown headings, links, HTML, or instruction-like content in these fields. The script also serializes fields with a literal pipe delimiter and parses them using `IFS='|'`. A pipe inside any task value can shift field boundaries and cause task attributes to be represented incorrectly. The resulting file is persistent under `~/.openclaw/workspace/.tasks/logs/` and is intended to be consumed during heartbeat reviews. Consequently, crafted content can be presented to an AI agent as if it were part of the trusted report. Shell command execution is not directly possible through this code because the expanded variables are quoted and are not passed to `eval` or a shell interpreter. ### Attack Path 1. The attacker gains the ability to add or modify an entry in `.tasks/tasks.json`. 2. The attacker places multiline Markdown or instruction-like content in a field such as `name`, for example a new heading followed by instructions directed at the reviewin ...[truncated 1066 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/daily_summary.sh:53

Finding

Unsanitized Task Fields Written to Persistent Daily Summaries

Content

View full analysis

/dev/null || echo "") if [ -n "$COMPLETED_TASKS" ]; then echo "$COMPLETED_TASKS" >> "$SUMMARY_FILE" else echo "- 无" >> "$SUMMARY_FILE" fi cat >> "$SUMMARY_FILE" << EOF --- ## 🔄 进行中的任务 EOF # 列出进行中的任务 IN_PROGRESS_TASKS=$(jq -r '.tasks[] | select(.status == "in_progress") | "- \(.id): \(.name) (进度：\(.progress)%, 截止：\(.due_date))"' "$TASKS_FILE" 2>/dev/null || echo "") if [ -n "$IN_PROGRESS_TASKS" ]; then echo "$IN_PROGRESS_TASKS" >> "$SUMMARY_FILE" else echo "- 无" >> "$SUMMARY_FILE" fi cat >> "$SUMMARY_FILE" << EOF --- ## ⏰ 即将到期（7 天内） EOF # 计算 7 天后的日期 DUE_SOON=$(date -d "+7 days" +%Y-%m-%d 2>/dev/null || date -v+7d +%Y-%m-%d 2>/dev/null || echo "2099-12-31") DUE_SOON_TASKS=$(jq -r --arg due "$DUE_SOON" '.tasks[] | select(.status != "completed") | select(.due_date <= $due) | "- \(.id): \(.name) (截止：\(.due_date))"' "$TASKS_FILE" 2>/dev/null || echo "") if [ -n "$DUE_SOON_TASKS" ]; then echo "$DUE_SOON_TASKS" >> "$SUMMARY_FILE" else echo "- 无" >> "$SUMMARY_FILE" fi ``` ### Technical Analysis The daily-summary generator interpolates task IDs, names, progress values, and due dates directly into Markdown. There is no schema enforcement, control-character filtering, line normalization, or Markdown escaping. Because `jq -r` returns raw strings, embedded newline characters in task data become new lines in the output document. An attacker can therefore terminate the intended list item and create arbitrary headings, links, HTML blocks, or instruction-like text. The resulting payload persists in `.tasks/summar ...[truncated 1347 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/weekly_review.sh:59

Finding

Unsanitized Task Fields Written to Persistent Weekly Reports

Content

View full analysis

= $start and .last_updated <= $end) | "- \(.id): \(.name)"' "$TASKS_FILE" 2>/dev/null || echo "") if [ -n "$COMPLETED" ]; then echo "$COMPLETED" >> "$REPORT_FILE" else echo "- 无" >> "$REPORT_FILE" fi cat >> "$REPORT_FILE" << EOF --- ## 🔄 进行中任务 EOF IN_PROGRESS_LIST=$(jq -r '.tasks[] | select(.status == "in_progress") | "- \(.id): \(.name)\n - 进度：\(.progress)%\n - 截止：\(.due_date)"' "$TASKS_FILE" 2>/dev/null || echo "") if [ -n "$IN_PROGRESS_LIST" ]; then echo "$IN_PROGRESS_LIST" >> "$REPORT_FILE" else echo "- 无" >> "$REPORT_FILE" fi cat >> "$REPORT_FILE" << EOF --- ## ⚠️ 延期任务 EOF OVERDUE_LIST=$(jq -r --arg today "$TODAY" '.tasks[] | select(.status != "completed") | select(.due_date < $today) | "- \(.id): \(.name)\n - 原截止：\(.due_date)\n - 延期：\((now - (.due_date | strptime("%Y-%m-%d") | mktime)) / 86400 | floor) 天"' "$TASKS_FILE" 2>/dev/null || echo "") if [ -n "$OVERDUE_LIST" ]; then echo "$OVERDUE_LIST" >> "$REPORT_FILE" echo "" >> "$REPORT_FILE" echo "**处理建议:**" >> "$REPORT_FILE" echo "1. 重新评估优先级" >> "$REPORT_FILE" echo "2. 调整截止日期或分解任务" >> "$REPORT_FILE" echo "3. 识别并解决阻塞问题" >> "$REPORT_FILE" else echo "- 无延期任务 ✅" >> "$REPORT_FILE" fi ``` ### Technical Analysis Weekly report entries are created by concatenating raw task fields into Markdown strings. The task `id`, `name`, `progress`, and `due_date` values are not escaped or constrained before being written to the report. The report format intentionally contains multiple lines per task, making it especially difficult for a later reader to distinguish legitimate generated line ...[truncated 1794 chars]

Remediation

View remediation

/dev/null || echo ""`. Log parsing errors and mark the report as incomplete rather than reporting “none.” 5. Use a structured report-generation mechanism that keeps untrusted values separate from formatting templates. 6. Add explicit provenance markers around task-derived content and instruct downstream agents not to interpret that content as commands. 7. Restrict modification of `tasks.json` and report files using least-privilege filesystem permissions. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly describes automatic review, progress logging, reminders, and scheduled script execution that write to workspace files, but it does not clearly warn users about these side effects or require explicit opt-in before enabling them. In an agent environment, undocumented autonomous file writes and cron-triggered execution can cause unintended persistence, privacy exposure, or repeated actions without the user's informed consent.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/task_check.sh (reported line 85)May include surrounding context.

sh

echo "" >> "$LOG_FILE"
    echo "## 提示" >> "$LOG_FILE"
    echo "- 未安装 jq，无法解析任务详情" >> "$LOG_FILE"
    echo "- 请安装：sudo apt install jq 或 brew install jq" >> "$LOG_FILE"
fi

echo "" >> "$LOG_FILE"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This shell script emits user-facing comments, report headings, status text, and guidance entirely in Chinese. The file does not provide any user opt-in, language selection, or documented justification for enforcing a single locale, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language instructions, headings, and examples in this skill are all presented in Chinese, and the document does not indicate that the user can select another language or that the skill is intentionally limited to a Chinese-speaking context. That can violate language/locale policy when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.