T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/exporter.py:31- Finding
CSV Formula Injection Through Untrusted Time-Entry Fields
- Content
View full analysis
- Remediation
View remediation
Security audit
Time Guru
Security checks for vulnerabilities and agentic risk
Overview
This time-tracking skill is mostly purpose-aligned, but it needs review because it persists sensitive work logs and can export them to unrestricted file paths with CSV export hardening gaps.
Review before installing if your time entries may contain client names, billing details, confidential projects, or sensitive notes. Use it only if local persistence under ~/.openclaw/data/time-guru and third-party parsing of individual activity descriptions are acceptable, and avoid exporting CSVs from untrusted imported data until formula-cell sanitization and export path restrictions are added.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (27)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Reminder or nudging functionality can introduce undeclared trigger-driven behavior, which is more sensitive than passive reporting because it may act on schedules or user activity patterns automatically. If those triggers are not declared, users and the platform may be unable to predict when the skill runs or what contextual data it uses, creating privacy and trust risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
Reminder or nudging functionality can introduce undeclared trigger-driven behavior, which is more sensitive than passive reporting because it may act on schedules or user activity patterns automatically. If those triggers are not declared, users and the platform may be unable to predict when the skill runs or what contextual data it uses, creating privacy and trust risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Reminder or nudging functionality can introduce undeclared trigger-driven behavior, which is more sensitive than passive reporting because it may act on schedules or user activity patterns automatically. If those triggers are not declared, users and the platform may be unable to predict when the skill runs or what contextual data it uses, creating privacy and trust risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Reminder or nudging functionality can introduce undeclared trigger-driven behavior, which is more sensitive than passive reporting because it may act on schedules or user activity patterns automatically. If those triggers are not declared, users and the platform may be unable to predict when the skill runs or what contextual data it uses, creating privacy and trust risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Reminder or nudging functionality can introduce undeclared trigger-driven behavior, which is more sensitive than passive reporting because it may act on schedules or user activity patterns automatically. If those triggers are not declared, users and the platform may be unable to predict when the skill runs or what contextual data it uses, creating privacy and trust risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Reminder or nudging functionality can introduce undeclared trigger-driven behavior, which is more sensitive than passive reporting because it may act on schedules or user activity patterns automatically. If those triggers are not declared, users and the platform may be unable to predict when the skill runs or what contextual data it uses, creating privacy and trust risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Reminder or nudging functionality can introduce undeclared trigger-driven behavior, which is more sensitive than passive reporting because it may act on schedules or user activity patterns automatically. If those triggers are not declared, users and the platform may be unable to predict when the skill runs or what contextual data it uses, creating privacy and trust risks.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill advertises local storage and lists scripts for persistence/import/export, but it does not declare any explicit tool scope or permissions. That creates a transparency and least-privilege problem: users and platforms cannot easily constrain file read/write behavior, increasing the chance of unintended access or modification of local data.
- Content
External Model or Provider Selection
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The skill explicitly selects an external model provider, which can expose user-entered activity descriptions and possibly metadata to a third party. In a time-tracking context, these descriptions may contain sensitive work details, customer names, schedules, and billing information, so undisclosed or weakly governed external model use creates material privacy risk.
- Content
md author: Golden Bean (coder) category: Productivity description: Natural language time tracking with smart activity classification, multi-dimensional reports, productivity analytics, and billing. model: deepseek/deepseek-v4-flash input_schema: schemas/input.schema.json output_schema: schemas/output.schema.json ---
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The schema restricts language to "zh-CN" or "en-US" but sets the default to "zh-CN" with no indication of user choice or region-specific justification. This can violate language/locale policy by forcing a specific locale behavior when the user has not explicitly opted in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill returns a fixed currency of "CNY" and formats output with the yuan symbol in user-facing text. This enforces a specific locale/currency convention without offering a user choice or documenting that the tool is region-specific, which matches the natural-language locale policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill returns and operates on fixed Chinese category names such as "开发", "会议", and "其他", which imposes a specific language/locale in its user-visible outputs. There is no opt-in, configuration, or documented justification for restricting output labels to Chinese only.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The exporter writes user time-entry data to any caller-supplied filesystem path without validation, restriction, or user-consent checks. In an agent context, this can enable unintended persistence of sensitive work logs and writing to unexpected locations, especially since the skill description does not disclose file creation behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Time-entry records can include sensitive descriptions, notes, projects, and billing details, and this function writes them to disk without any user-facing disclosure or warning. In a natural-language agent skill, undisclosed file creation materially increases privacy risk because users may not realize their conversation-derived data is being persisted locally.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The reminder string includes a fixed Chinese prompt (
刚才做了什么) embedded directly in the suggested command. This forces a specific language in user-facing output without any opt-in, language selection, or documented region-specific justification, which is a natural-language policy violation.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The fallback category label is hard-coded as "其他", which forces a specific language in generated reports when category data is missing. The file also mixes English report text with Chinese labels/currency conventions, and there is no documented user choice or locale configuration to opt into this behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description uses very broad trigger language such as 'Use when tracking work hours, analyzing time usage, generating productivity reports, or calculating billable time,' which can match a wide range of common user requests. Overly generic invocation criteria increase the chance that the platform routes unrelated or only loosely related prompts to this skill, expanding its access surface and creating opportunities for unintended data exposure or inappropriate tool use.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JSON file defines all visible category labels using only Chinese strings such as "开发", "会议", and "文档". Because the file provides no alternative locale, opt-in, or documented region-specific justification, it appears to enforce a specific language, which matches the natural-language policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file contains user-facing example invocations predominantly in Chinese, while not stating that the skill is Chinese-only or offering any language/locale choice. That can imply a language-specific interaction model without documented opt-in or justification.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This JSON schema is a manifest-type file, so vague-trigger checks apply. The required "action" field allows generic values like "start", "stop", "report", and "project" without any surrounding activation-context constraints, negative examples, or narrower invocation wording, which could contribute to unintended matching if this schema is used for skill activation or routing.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code uses the Chinese string "其他" as a default category label when no category is present. This forces a specific language in user-visible output without any indication of user choice or documented locale constraint, which is a natural-language policy concern.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The code silently creates a fixed export directory under the user's home folder and stores exported time data there by default. While less severe than arbitrary path writes, this creates undisclosed local persistence of potentially sensitive activity and billing information, which may surprise users and increase data exposure on shared or monitored systems.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code assigns the category value "开发" unconditionally for GitHub-derived entries. This forces a specific language in generated output without offering user choice or documenting a locale-specific justification, which is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Jira importer also sets the category field to the fixed Chinese label "开发". Because the file provides no opt-in or locale selection, this may impose a language choice on users contrary to policy expectations.
- Content
Static analysis
No suspicious patterns detected.