Security audit

Decision Journal

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local decision-journal skill, with some privacy and safety-notice weaknesses users should understand before storing sensitive decisions.

Install only if you are comfortable storing decision records locally in plaintext. Avoid entering crisis, medical, legal, or investment-advice content, and protect `~/.openclaw/decisions` on shared machines; treat CSV exports as sensitive and be careful opening them in spreadsheets.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: src/storage.js:37
Finding: Sensitive journal data is created without restrictive filesystem permissions
Content: View full analysis
{ if (!fs.existsSync(file)) { fs.writeFileSync(file, ''); } }); // Create index if it doesn't exist if (!fs.existsSync(this.indexFile)) { fs.writeFileSync(this.indexFile, JSON.stringify({ decisions: [], reviews: [], tags: {}, stats: { totalDecisions: 0, totalReviews: 0, lastUpdated: null } }, null, 2)); } // Create patterns file if it doesn't exist if (!fs.existsSync(this.patternsFile)) { fs.writeFileSync(this.patternsFile, JSON.stringify({ patterns: [] }, null, 2)); } } ``` ### Technical Analysis The application stores decision titles, personal context, reasoning, expected outcomes, reviews, lessons, and behavioral patterns under `~/.openclaw/decisions`. Neither the storage directory nor its files are created with explicit restrictive permission modes. Consequently, permissions are determined by the process umask. On Unix-like systems using a common umask such as `022`, the directory may be created with mode `0755` and files with mode `0644`. This can permit other local users to traverse the directory and read sensitive journal records. The implementation also uses separate existence checks followed by file creation. It does not verify ownership, reject symbolic links, or ensure that an existing storage path is a regular file owned by the current user. In a shared or improperly configured environment, this can increase the risk of local disclosure or unintended writes. ### Attack Path 1. A user runs the decision journal under a permissiv ...[truncated 1032 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/storage.js:477
Finding: CSV export permits spreadsheet formula injection
Content: View full analysis
{ if (value === null || value === undefined) return ''; const str = String(value); if (str.includes(',') || str.includes('"') || str.includes('\n')) { return `"${str.replace(/"/g, '""')}"`; } return str; }; const lines = [headers.join(',')]; decisions.forEach(d => { const row = headers.map(h => escapeCSV(d[h])); lines.push(row.join(',')); }); return lines.join('\n'); } ``` ### Technical Analysis The exporter correctly escapes commas, quotation marks, and line breaks for CSV syntax, but CSV quoting does not prevent spreadsheet applications from evaluating cell contents as formulas. User-controlled fields such as `title`, `situation`, `decision`, `tag`, and `outcome` can begin with spreadsheet formula indicators including `=`, `+`, `-`, or `@`. Some spreadsheet programs also recognize dangerous values after leading tabs, carriage returns, or whitespace. When an exported CSV file is opened, these values may be interpreted as formulas rather than plain text. Depending on the spreadsheet application and its security configuration, formulas may initiate external network requests, expose other cell contents, create malicious hyperlinks, or invoke application-specific functionality. Exploitation requires a victim to export the data and open it in a formula-capable spreadsheet program. ### Attack Path 1. An attacker influences a journal field, or a user records untrusted text copied from another source. 2. The field begins with a formula payload, such as `=HYPERLINK("https://atta ...[truncated 981 chars]
Remediation: View remediation
{ const str = String(value); if (/^[\s]*[=+\-@]/.test(str) || /^[\t\r]/.test(str)) { return `'${str}`; } return str; }; ``` 2. Apply formula neutralization before ordinary CSV escaping: ```js const escapeCSV = (value) => { if (value === null || value === undefined) return ''; const str = neutralizeSpreadsheetFormula(value); if (str.includes(',') || str.includes('"') || str.includes('\n') || str.includes('\r')) { return `"${str.replace(/"/g, '""')}"`; } return str; }; ``` 3. Test cells beginning with `=`, `+`, `-`, `@`, tab, carriage return, and leading whitespace followed by a formula indicator. 4. Document that the CSV format is intended to contain plain text and that formula-like input will be escaped. 5. If exact unmodified data must be preserved, offer separate trusted and spreadsheet-safe export modes, with the spreadsheet-safe mode as the default. ]]>

SkillSpector

Vulnerability Patterns

Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · templates/default.md (reported line 35)May include surrounding context.
md
## Decision **I will:** [Clear statement of what was decided] ## Reasoning

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill places a mandatory safety disclaimer only in Chinese, while the rest of the document is primarily in English. An English-speaking user may not understand critical boundary information and may treat the tool as suitable for medical, legal, investment, or crisis-related guidance when it is not.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The high-risk escalation message for self-harm, violence, or acute mental-health crisis is hardcoded only in Chinese, creating a comprehension failure at the most safety-critical point in the workflow. If a user cannot read the message, the skill may fail to interrupt normal decision-journal prompts effectively, delaying access to emergency or professional support.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · src/storage.js (reported line 21)May include surrounding context.
js
*/ class Storage { /** * Create a new Storage instance * @param {string} [baseDir] - Base directory for storage (default: ~/.openclaw/decisions) */ constructor(baseDir = DEFAULT_STORAGE_DIR) {

Static analysis

No suspicious patterns detected.