ClawHub
Back to skill

Security audit

Homebase

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent and disclosed as a family assistant, but it needs Review because it can send private family data, change calendar entries, and read shared OpenClaw cron logs with limited scoping safeguards.

Install only if you are comfortable giving this skill Google Calendar read/write access, Gmail read access for configured senders, and authority to post to configured WhatsApp chats. Review the cron jobs, WhatsApp group IDs, Calendar delete behavior, and the shared cron-health digest before enabling scheduled automation or Club Studio.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (39)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def _macos_notify(message: str):
    try:
        subprocess.run([
            "osascript", "-e",
            f'display notification "{message}" with title "OpenClaw Preflight"'
        ], timeout=5)
Confidence
80% confidence
Finding
The code passes the alert message directly into an AppleScript snippet executed by `osascript`. Although `subprocess.run` is invoked with an argument list rather than a shell, the AppleScript source itself is dynamically constructed, so quotes or AppleScript metacharacters in `message` could break out of the intended string and alter the script behavior. In this skill, most messages are locally generated error strings, but some content may include exception text from external systems, which makes script injection plausible.

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill documentation describes use of sensitive capabilities including environment variables, local file read/write, outbound network access, and shell/subprocess invocation, but the metadata only declares environment requirements rather than an explicit permission model. That mismatch can prevent users or a platform from accurately understanding the skill’s effective privileges, increasing the risk of over-trust and unsafe installation.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The instructions explicitly tell the agent to use an external WhatsApp messaging command (`openclaw message send`) outside the declared tool interface. That creates an undisclosed outbound communication path that can transmit family data to third parties without the same validation, auditing, or consent controls as the household tools.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The prompt authorizes direct shell-mediated messaging as part of normal operation, bypassing the constrained tool model and expanding the agent's effective authority. If prompt injection or misclassification occurs, the agent could send unsolicited or privacy-sensitive messages to external recipients with little guardrail visibility.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The module performs destructive update and delete operations by querying with a loose free-text search term and then automatically acting on the first match. In a household calendar context, ambiguous natural-language inputs can easily target the wrong event, causing unauthorized or unintended schedule changes without any strong identity check or exact-match verification.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The prompt defines waitlist calendar entries with the title `⏳ Club Studio Waitlist: <CLASS_NAME>`, but the waitlist-promotion deletion step instructs deletion of `Club Studio Waitlist: <class_name>` without the emoji. Because later cleanup relies on exact naming consistency, promoted classes can leave stale waitlist entries behind, causing calendar drift and duplicate/conflicting events. In this household-coordination context, that can mislead family scheduling and downstream automations.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The cancellation flow tells the agent to delete title=`Club Studio: <class_name>` while claiming that search will match both `🏋️ Club Studio: <class_name>` and `⏳ Club Studio Waitlist: <class_name>`. That contradicts the documented naming convention and assumes fuzzy matching behavior that may not exist, so cancellations may fail to remove the actual calendar entry. In this skill, failed deletion can create false future commitments and incorrect family notifications.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The module silently loads Google secrets at import time even though its documented responsibility is local media scanning. Import-time credential access expands the privilege surface of any code path that merely imports this file, making unintended secret access harder to audit and increasing the chance of credentials being touched in contexts that do not need them.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The comment explicitly states an intent to avoid triggering credential/security scanners by constructing credential-shaped test data programmatically. Even though the data itself is placeholder content, documenting and normalizing scanner evasion creates a risky precedent and can mask future introduction of real secrets or make automated review less effective.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The get_cron_health_digest tool exposes contents of ~/.openclaw/cron/runs/*.jsonl, which is outside the stated household-coordinator data domain and may contain internal job names, status details, file paths, and error fragments. In an agent skill context, this broadens the accessible local telemetry surface and can leak sensitive operational data into user-facing channels or other tool flows.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The instructions direct outbound messaging to a family group after saving a meal plan, but do not require a user-facing notice or consent step for that transmission. Because meal plans and related household context can contain sensitive family routine data, silent external sharing increases privacy risk.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The trip-prep flow tells the agent to proactively DM the owner using calendar and child-profile data without an explicit warning that personal information will be transmitted externally. This combines travel plans, child observations, and health-related considerations, making unintended disclosure more sensitive than ordinary reminders.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The school email sync flow republishes email-derived content, including child names, event details, and food/schedule information, to the family group automatically via external messaging. Without an explicit warning or consent checkpoint, sensitive information from inbox content can be redistributed beyond the original source context, increasing privacy and prompt-injection exposure from untrusted email/PDF content.

Missing User Warnings

High
Confidence
96% confidence
Finding
The code copies GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, and GOOGLE_REFRESH_TOKEN from environment variables into self.config["supported_calendars"], and save_config() persists config.json to disk. Persisting long-lived OAuth secrets in a general config file significantly increases exposure through accidental commits, backups, lax filesystem permissions, or later reads by unrelated components.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code deletes calendar events immediately after finding a match, with no interactive confirmation or safety gate at the point of action. In an agent-driven household workflow, a misunderstood instruction, prompt injection in upstream text, or fuzzy match error can directly delete legitimate family schedule data.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
Credential access is triggered silently during module import and exceptions are suppressed, so operators may not realize a simple import touched secret material. Hidden secret access reduces auditability and can cause unexpected credential exposure or side effects in tests, tooling, or unrelated execution paths.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The module retrieves Gmail message bodies and includes subject, sender, and body snippets in a WhatsApp-formatted summary. That creates a real privacy and data-sharing risk because school emails commonly contain sensitive family and child information, and this file itself does not enforce user consent, minimization beyond truncation, or recipient validation before transmission.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
run_check() prints raw calendar candidates and per-child observations as JSON to stdout, which in this skill is intended for agent/cron consumption. Those payloads include sensitive family scheduling and child-related profile data, and stdout is commonly captured by logs, wrappers, or orchestration systems, creating an unnecessary secondary disclosure channel.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
geocode_location() sends destination/location strings to Open-Meteo's external geocoding API, which can reveal private travel plans and places associated with a family household. In this skill context, travel destinations are especially sensitive because they can expose absence from home or child-related itinerary information to third parties.

Ssd 2

Medium
Confidence
93% confidence
Finding
This comment goes beyond ordinary test setup and openly describes evading security scanners by avoiding literal KEY=value strings. That weakens trust in the codebase's security posture because it signals awareness of detection boundaries and encourages techniques that could later conceal genuine credentials or other sensitive artifacts.

Skill Enumeration

Medium
Category
Agent Snooping
Content
setup scripts you run yourself. `get_cron_health_digest` (in `tools.py`)
reads `~/.openclaw/cron/runs/*.jsonl` — this is OpenClaw's own cron log
directory, used only to summarize *this skill's own* job results into the
daily owner digest; it does not read other skills' data beyond filenames
already visible in that shared, host-level directory.

All household state (calendar cache, meal history, health log, kid profiles,
Confidence
73% confidence
Finding
The skill explicitly reads a shared host-level cron log directory and acknowledges visibility into filenames associated with other skills. Even if content access is intended to be limited to this skill’s own jobs, touching a shared directory creates an information disclosure surface and can enable cross-skill enumeration of installed components, schedules, or operational state.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
"type": "google",
                        "id": cfg.calendar_id,
                        "client_id": os.environ.get("GOOGLE_CLIENT_ID", ""),
                        "client_secret": os.environ.get("GOOGLE_CLIENT_SECRET", ""),
                        "refresh_token": os.environ.get("GOOGLE_REFRESH_TOKEN", ""),
                        "access_token": "",
                        "enabled": True
Confidence
95% confidence
Finding
This line reads GOOGLE_CLIENT_SECRET from the environment and places it into the persisted calendar configuration object, which is later saved to disk. The danger is not the environment access itself, but the unnecessary collection and storage of a sensitive credential in a less protected location, expanding the blast radius of compromise.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
"id": cfg.calendar_id,
                        "client_id": os.environ.get("GOOGLE_CLIENT_ID", ""),
                        "client_secret": os.environ.get("GOOGLE_CLIENT_SECRET", ""),
                        "refresh_token": os.environ.get("GOOGLE_REFRESH_TOKEN", ""),
                        "access_token": "",
                        "enabled": True
                    }]
Confidence
97% confidence
Finding
The refresh token is a highly sensitive long-lived credential that can enable ongoing access to the family's Google Calendar data. By ingesting it into the config object that is saved to disk, the code risks unauthorized API access if the file is exposed via source control, logs, backups, or local compromise.

External Transmission

Medium
Category
Data Exfiltration
Content
days_needed = 3

        url = (
            f"https://api.open-meteo.com/v1/forecast"
            f"?latitude={lat}&longitude={lon}"
            f"&current=temperature_2m,apparent_temperature,weather_code,"
            f"wind_speed_10m,relative_humidity_2m"
Confidence
88% confidence
Finding
The code transmits geocoded trip coordinates to the external Open-Meteo forecast API to retrieve destination weather. While this is functionally expected, it is still an external data transfer involving household travel-related location data, which can leak sensitive itinerary context if logged, monitored, or retained by third parties.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
return "No pending meal plan."

    plan = pending["plan"]
    lock_plan(plan, reason="auto_approved_timeout")
    message = format_plan_for_whatsapp(plan, is_final=True)
    message += "\n\n_Auto-approved — no changes requested by Sunday 9 PM. 🔒_"
    return message
Confidence
78% confidence
Finding
The code locks and persists the pending plan unconditionally when cmd_auto_approve is invoked, without verifying that the current time has reached the recorded expires_at deadline. If another component, a buggy scheduler, or an attacker with the ability to trigger this command calls it early, the family can be forced into a finalized plan without the intended review window.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.