Homebase

• Outcome: Review
• Latest audit: Jul 18, 2026 · 11:04 PM UTC
• Version: 0.5.1

Overview

The skill is mostly coherent and disclosed as a family assistant, but it needs Review because it can send private family data, change calendar entries, and read shared OpenClaw cron logs with limited scoping safeguards.

Install only if you are comfortable giving this skill Google Calendar read/write access, Gmail read access for configured senders, and authority to post to configured WhatsApp chats. Review the cron jobs, WhatsApp group IDs, Calendar delete behavior, and the shared cron-health digest before enabling scheduled automation or Club Studio.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _macos_notify(message: str):
    try:
        subprocess.run([
            "osascript", "-e",
            f'display notification "{message}" with title "OpenClaw Preflight"'
        ], timeout=5)

• Confidence: 80% confidence
• Finding: subprocess.run([ "osascript", "-e", f'display notification "{message}" with title "OpenClaw Preflight"' ], timeout=5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill documentation describes use of sensitive capabilities including environment variables, local file read/write, outbound network access, and shell/subprocess invocation, but the metadata only declares environment requirements rather than an explicit permission model. That mismatch can prevent users or a platform from accurately understanding the skill’s effective privileges, increasing the risk of over-trust and unsafe installation.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The instructions explicitly tell the agent to use an external WhatsApp messaging command (`openclaw message send`) outside the declared tool interface. That creates an undisclosed outbound communication path that can transmit family data to third parties without the same validation, auditing, or consent controls as the household tools.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The prompt authorizes direct shell-mediated messaging as part of normal operation, bypassing the constrained tool model and expanding the agent's effective authority. If prompt injection or misclassification occurs, the agent could send unsolicited or privacy-sensitive messages to external recipients with little guardrail visibility.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The module performs destructive update and delete operations by querying with a loose free-text search term and then automatically acting on the first match. In a household calendar context, ambiguous natural-language inputs can easily target the wrong event, causing unauthorized or unintended schedule changes without any strong identity check or exact-match verification.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The prompt defines waitlist calendar entries with the title `⏳ Club Studio Waitlist: <CLASS_NAME>`, but the waitlist-promotion deletion step instructs deletion of `Club Studio Waitlist: <class_name>` without the emoji. Because later cleanup relies on exact naming consistency, promoted classes can leave stale waitlist entries behind, causing calendar drift and duplicate/conflicting events. In this household-coordination context, that can mislead family scheduling and downstream automations.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The cancellation flow tells the agent to delete title=`Club Studio: <class_name>` while claiming that search will match both `🏋️ Club Studio: <class_name>` and `⏳ Club Studio Waitlist: <class_name>`. That contradicts the documented naming convention and assumes fuzzy matching behavior that may not exist, so cancellations may fail to remove the actual calendar entry. In this skill, failed deletion can create false future commitments and incorrect family notifications.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The module silently loads Google secrets at import time even though its documented responsibility is local media scanning. Import-time credential access expands the privilege surface of any code path that merely imports this file, making unintended secret access harder to audit and increasing the chance of credentials being touched in contexts that do not need them.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The comment explicitly states an intent to avoid triggering credential/security scanners by constructing credential-shaped test data programmatically. Even though the data itself is placeholder content, documenting and normalizing scanner evasion creates a risky precedent and can mask future introduction of real secrets or make automated review less effective.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The get_cron_health_digest tool exposes contents of ~/.openclaw/cron/runs/*.jsonl, which is outside the stated household-coordinator data domain and may contain internal job names, status details, file paths, and error fragments. In an agent skill context, this broadens the accessible local telemetry surface and can leak sensitive operational data into user-facing channels or other tool flows.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The instructions direct outbound messaging to a family group after saving a meal plan, but do not require a user-facing notice or consent step for that transmission. Because meal plans and related household context can contain sensitive family routine data, silent external sharing increases privacy risk.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The trip-prep flow tells the agent to proactively DM the owner using calendar and child-profile data without an explicit warning that personal information will be transmitted externally. This combines travel plans, child observations, and health-related considerations, making unintended disclosure more sensitive than ordinary reminders.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The school email sync flow republishes email-derived content, including child names, event details, and food/schedule information, to the family group automatically via external messaging. Without an explicit warning or consent checkpoint, sensitive information from inbox content can be redistributed beyond the original source context, increasing privacy and prompt-injection exposure from untrusted email/PDF content.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The code copies GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, and GOOGLE_REFRESH_TOKEN from environment variables into self.config["supported_calendars"], and save_config() persists config.json to disk. Persisting long-lived OAuth secrets in a general config file significantly increases exposure through accidental commits, backups, lax filesystem permissions, or later reads by unrelated components.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code deletes calendar events immediately after finding a match, with no interactive confirmation or safety gate at the point of action. In an agent-driven household workflow, a misunderstood instruction, prompt injection in upstream text, or fuzzy match error can directly delete legitimate family schedule data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Credential access is triggered silently during module import and exceptions are suppressed, so operators may not realize a simple import touched secret material. Hidden secret access reduces auditability and can cause unexpected credential exposure or side effects in tests, tooling, or unrelated execution paths.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The module retrieves Gmail message bodies and includes subject, sender, and body snippets in a WhatsApp-formatted summary. That creates a real privacy and data-sharing risk because school emails commonly contain sensitive family and child information, and this file itself does not enforce user consent, minimization beyond truncation, or recipient validation before transmission.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: run_check() prints raw calendar candidates and per-child observations as JSON to stdout, which in this skill is intended for agent/cron consumption. Those payloads include sensitive family scheduling and child-related profile data, and stdout is commonly captured by logs, wrappers, or orchestration systems, creating an unnecessary secondary disclosure channel.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: geocode_location() sends destination/location strings to Open-Meteo's external geocoding API, which can reveal private travel plans and places associated with a family household. In this skill context, travel destinations are especially sensitive because they can expose absence from home or child-related itinerary information to third parties.

Ssd 2

Medium

• Confidence: 93% confidence
• Finding: This comment goes beyond ordinary test setup and openly describes evading security scanners by avoiding literal KEY=value strings. That weakens trust in the codebase's security posture because it signals awareness of detection boundaries and encourages techniques that could later conceal genuine credentials or other sensitive artifacts.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

setup scripts you run yourself. `get_cron_health_digest` (in `tools.py`)
reads `~/.openclaw/cron/runs/*.jsonl` — this is OpenClaw's own cron log
directory, used only to summarize *this skill's own* job results into the
daily owner digest; it does not read other skills' data beyond filenames
already visible in that shared, host-level directory.

All household state (calendar cache, meal history, health log, kid profiles,

• Confidence: 73% confidence
• Finding: read other skills

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

"type": "google",
                        "id": cfg.calendar_id,
                        "client_id": os.environ.get("GOOGLE_CLIENT_ID", ""),
                        "client_secret": os.environ.get("GOOGLE_CLIENT_SECRET", ""),
                        "refresh_token": os.environ.get("GOOGLE_REFRESH_TOKEN", ""),
                        "access_token": "",
                        "enabled": True

• Confidence: 95% confidence
• Finding: os.environ.get("GOOGLE_CLIENT_SECRET

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

"id": cfg.calendar_id,
                        "client_id": os.environ.get("GOOGLE_CLIENT_ID", ""),
                        "client_secret": os.environ.get("GOOGLE_CLIENT_SECRET", ""),
                        "refresh_token": os.environ.get("GOOGLE_REFRESH_TOKEN", ""),
                        "access_token": "",
                        "enabled": True
                    }]

• Confidence: 97% confidence
• Finding: os.environ.get("GOOGLE_REFRESH_TOKEN

External Transmission

Medium

• Category: Data Exfiltration

Content

days_needed = 3

        url = (
            f"https://api.open-meteo.com/v1/forecast"
            f"?latitude={lat}&longitude={lon}"
            f"&current=temperature_2m,apparent_temperature,weather_code,"
            f"wind_speed_10m,relative_humidity_2m"

• Confidence: 88% confidence
• Finding: https://api.open-meteo.com/

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

return "No pending meal plan."

    plan = pending["plan"]
    lock_plan(plan, reason="auto_approved_timeout")
    message = format_plan_for_whatsapp(plan, is_final=True)
    message += "\n\n_Auto-approved — no changes requested by Sunday 9 PM. 🔒_"
    return message

• Confidence: 78% confidence
• Finding: auto_approve

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.