T09 · Insecure Skill Coding Practices
Error
- Location
scripts/location.sh:5- Finding
Arbitrary Shell Execution Through Shared Environment File
- Content
View full analysis
- Remediation
View remediation
Security audit
Location Awareness
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its location-helper purpose, but it handles precise location and credentials with enough under-scoped and unsafe behavior that users should review it carefully before installing.
Install only if you are comfortable with this skill reading location-service credentials, storing saved places and reminders locally, and sending precise location or destination data to mapping services. Avoid using it with a shared or broadly writable ~/.openclaw/.env, prefer dedicated least-privilege credentials, disable or avoid cron notifications unless you want ongoing background checks, and treat ETA/nearby/address features as third-party location disclosure.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/location.py:991- Finding
Precise Location and Destination Transmitted Over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/location.py:266- Finding
Sensitive Location State Persisted Without Enforced Access Controls
- Content
View full analysis
dict: if STATE_FILE.exists(): with open(STATE_FILE) as f: return json.load(f) return {"last_triggered": {}} def save_state(state: dict): with open(STATE_FILE, "w") as f: json.dump(state, f, indent=2) ``` ### Technical Analysis The Skill stores geofences, precise saved coordinates, proximity alerts, reminder text, creation times, and trigger timestamps as plaintext JSON. Files are written inside the Skill's `scripts` directory, and the implementation does not explicitly enforce owner-only permissions. New-file permissions consequently depend on the process umask. Existing files retain their existing permissions. The implementation also writes files directly rather than using secure atomic replacement, making state vulnerable to partial writes and broadening exposure if the package directory is backed up, synchronized, archived, or committed to source control. Although persistence is required for geofences and reminders, storing this information in the executable package directory without explicit access controls is not required by the declared functionality. ### Attack Path 1. A user saves a place, creates a proximity alert, or configures a location reminder. 2. The Skill serializes exact coordinates and associated private data to `scripts/geofences.json`. 3. Geofence trigger timestamps are similarly written to `scripts/.location_state.json`. 4. If directory permissions, file permissions, backups, repository settings, or synchronization rules expose these files, another principal obtains the stored data. 5. The exposed records can be correlated to infer sensitive places, h ...[truncated 526 chars]- Remediation
View remediation
other
Warning
- Location
scripts/location.py:298- Finding
Undisclosed Precise Location Disclosure to Public Mapping Services
- Content
View full analysis
dict: """Get city/region from coordinates using OpenStreetMap Nominatim.""" url = f"https://nominatim.openstreetmap.org/reverse?lat={lat}&lon={lon}&format=json&zoom=10" req = urllib.request.Request(url, headers={"User-Agent": "Clawdbot/1.0"}) try: with urllib.request.urlopen(req, timeout=10) as resp: data = json.load(resp) ``` Nearby POI searches transmit exact coordinates and the requested category to Overpass: ```python osm_tag = category_map.get(category.lower(), f"amenity={category}") query = f"[out:json][timeout:10];(node[{osm_tag}](around:{radius_m},{lat},{lon});way[{osm_tag}](around:{radius_m},{lat},{lon}););out center tags;" try: req = urllib.request.Request( "https://overpass-api.de/api/interpreter", data=query.encode("utf-8"), headers={"Content-Type": "application/x-www-form-urlencoded"} ) with urllib.request.urlopen(req, timeout=15) as resp: ``` Place-name geocoding sends the query and a location-derived viewbox: ```python encoded = urllib.parse.quote(query) url = f"https://nominatim.openstreetmap.org/search?q={encoded}&format=json&limit=5" # Add viewbox bias if we have a location (±0.5 degrees ~ 50km) if near_lat and near_lon: vb = f"{near_lon-0.5},{near_lat+0.5},{near_lon+0.5},{near_lat-0.5}" url += f"&viewbox={vb}&bounded=0" req = urllib.request.Request(url, headers={"User-Agent": "Clawdbot/1.0"}) with urllib.request.urlopen(req, timeout=10) as resp: ``` Street-level reverse-geocoding also sends exact coordinates: ```python def reverse_geocode(lat: float, lon: float) -> str: """Reverse geocode coordinates to a human-readable a ...[truncated 2093 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description suggests a privacy-friendly location helper, but the documented behavior also includes generic HTTP ingestion, geofence and place management, proximity alerts, and external geocoding/routing calls that materially expand data exposure and side effects. This mismatch can mislead users and reviewers about the skill's true reach, especially because location history and destination lookups may be sent to third-party services.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The cron setup forwards location-triggered reminders and alerts to an external messaging channel, which can leak sensitive movement and place data outside the local environment. Because there is no privacy warning or consent flow, users may enable persistent outbound notifications without understanding that their whereabouts could be transmitted to third-party services or phone numbers.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh #!/bin/bash # Location awareness wrapper - loads credentials and runs location.py # Source OpenClaw .env if available (provides HA_URL, HA_TOKEN, etc.) [[ -f "$HOME/.openclaw/.env" ]] && set -a && source "$HOME/.openclaw/.env" && set +a SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
Using source on ~/.openclaw/.env executes the file as shell code, not just as passive key=value data, and exports everything into the environment. If that file is tampered with or contains unexpected commands, this can lead to arbitrary code execution and unauthorized access to Home Assistant tokens or other secrets, which is especially sensitive in a location-awareness skill handling movement data and home automation context.
- Content
sh # Location awareness wrapper - loads credentials and runs location.py # Source OpenClaw .env if available (provides HA_URL, HA_TOKEN, etc.) [[ -f "$HOME/.openclaw/.env" ]] && set -a && source "$HOME/.openclaw/.env" && set +a SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" exec python3 "$SCRIPT_DIR/location.py" "$@"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill clearly relies on capabilities with security implications: reading environment variables for secrets, writing persistent files such as geofences/reminders/cron jobs, and making network requests to location providers and mapping/geocoding services. Failing to declare an explicit tool scope weakens least-privilege controls and can cause users or the host agent to underestimate what the skill is allowed to access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill exposes highly sensitive data including current location, coordinates, addresses, travel patterns, and visit history, yet the user-facing instructions emphasize terse direct output with no privacy warning. In a location-tracking context, this increases the risk of accidental disclosure to anyone with access to the chat/session or downstream logs.
- Content
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
Every command must be run via
scripts/location.sh. Example:User asks: "How long to walk home?"
You run:bash scripts/location.sh eta home --mode walk
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
Every command must be run via
scripts/location.sh. Example:User asks: "How long to walk home?"
You run:bash scripts/location.sh eta home --mode walk
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documented commands allow adding, editing, disabling, and deleting saved places and rules without warning that they modify persistent state. In a conversational environment, ambiguous phrasing or prompt injection through user content could cause irreversible changes to geofence configuration or reminders.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
The documented cron configuration establishes ongoing autonomous behavior that persists across sessions and repeatedly processes sensitive location data. In the context of a location skill, session persistence increases risk because it can continue monitoring movement and sending alerts after the user has forgotten it was enabled.
- Content
Automatic Notifications (OpenClaw Cron)
Use OpenClaw's built-in cron to run periodic location checks. Add a job to
~/.openclaw/cron/jobs.json:json {
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill sends precise location data to external third-party services for reverse geocoding without clearly disclosing that behavior in the skill description. For a location-tracking skill, undisclosed outbound sharing materially affects user privacy expectations because users may assume coordinates stay within Home Assistant/OwnTracks/local providers.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code transmits user coordinates to external geocoding services without any visible warning, consent flow, or inline disclosure. Because this skill handles highly sensitive movement and location data, silent disclosure to third parties can expose home/work patterns, travel history, and other personal inferences.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The POI, geocoding, and ETA features rely on third-party services such as Overpass/Nominatim/OSRM, but the manifest description does not mention these external dependencies. This creates a privacy and transparency gap because destination queries and current location can be sent off-device without the user's informed awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script silently loads sensitive credentials from ~/.openclaw/.env with no disclosure or user confirmation at runtime. Even if intended for convenience, this can surprise users, increase secret propagation into subprocesses, and make it easier for a compromised or overly capable skill to access tokens unrelated to its primary function.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The module documentation says the skill supports 'HTTP endpoint' providers, while the manifest description specifically names Home Assistant, OwnTracks, and GPS Logger as the privacy-friendly tracking sources. This creates an intent mismatch in documentation because the code advertises a broader, arbitrary-network provider model than the manifest's more constrained provider framing.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill can resolve configuration values from environment variables, including tokens and endpoints, via the env:VAR_NAME mechanism and direct environment lookups. For a location-awareness skill this capability is not inherently required by the stated user-facing purpose, and it expands the skill into credential/config harvesting territory beyond pure location operations.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill resolves secrets from environment variables, including provider tokens used for location services, but there is no visible user-facing notice that credentials may be read from the environment. While this may be operationally normal, the rule calls for disclosure when accessing sensitive environment variables or credentials and no such disclosure appears in code comments intended for users, prompts, or nearby output.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The wrapper automatically sources a global .env file and exports all variables into the child process environment before launching location.py. This broadens the skill's access beyond location processing and creates implicit credential exposure and trust in a shell-parsed file, which is risky if the file contains more secrets than strictly needed or can be modified by another local process.
- Content
Static analysis
No suspicious patterns detected.