Excretion Tracker

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:41 AM UTC
• Version: 0.4.1

Overview

The skill is a coherent bathroom tracker, but it needs review because it stores sensitive health data and gives unsafe command templates for user-provided text.

Review before installing, especially on a shared machine. This skill records private bathroom and symptom details in a local plaintext database and may create image files with those details if cards are enabled. Use it only if you are comfortable with that local persistence, and prefer a version that enforces private file permissions, documents deletion and retention, and invokes the CLI without shell interpolation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:100

Finding

Shell Command Injection Through User-Controlled CLI Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/excretion.py:29

Finding

Sensitive Health Database Created Without Explicitly Restrictive Permissions

Content

View full analysis

Path: return Path.home() / ".openclaw" / "excretion" / "excretion.db" def ensure_db_dir() -> None: db_path().parent.mkdir(parents=True, exist_ok=True) def connect() -> sqlite3.Connection: ensure_db_dir() con = sqlite3.connect(db_path()) ``` ### Technical Analysis The application stores sensitive health-related information in a local SQLite database, including bathroom-event timestamps, pain levels, blood indicators, stool form and color, and free-text notes. The database directory is created without an explicit mode, and the SQLite file's permissions are not explicitly restricted after creation. Consequently, effective permissions depend on the process umask and any pre-existing directory state. Under a permissive configuration, the directory or database may be readable by other local users or processes. SQLite data is stored in plaintext. The implementation also does not verify or correct permissions when the directory or database already exists. This creates an access-control weakness for particularly sensitive personal information. ### Attack Path 1. The skill runs under a permissive umask or uses a pre-existing directory with permissive permissions. 2. `ensure_db_dir()` creates or reuses `~/.openclaw/excretion/` without enforcing owner-only access. 3. `sqlite3.connect()` creates or opens `excretion.db` without enforcing an owner-only file mode. 4. Another local user or process with filesystem access traverses the directory. 5. The local actor reads or copies the SQLite database and extracts the health records. This attack requires local filesystem access and depends on the effective directory, file, and parent-directory permissions. ### Impact Assessment Exploitation can disclose private health and ...[truncated 407 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill’s declared behavior does not accurately match what it instructs the agent to do, especially around collecting additional sensitive health data and using a local CLI-backed workflow. In a health-tracking context, undocumented data collection and misleading claims about reminders or interaction mode can undermine informed consent, cause unexpected retention of highly sensitive medical information, and lead users to rely on features that may not exist.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger keywords are broad enough to activate on ordinary conversation about bowel, urine, constipation, or symptoms, which risks invoking the skill when the user is seeking general discussion rather than consenting to log health events. Because the subject matter is highly sensitive medical data, accidental activation can lead to over-collection, unnecessary prompting, or unintended storage of private information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill handles highly sensitive health information but does not provide an upfront warning in the description that these details are stored locally through CLI logging. Users may disclose intimate medical data without understanding that it will be persisted, which creates a meaningful privacy and consent failure even if storage is only local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction says to ask for missing required fields "in the user's language (Chinese)," which effectively forces Chinese output rather than detecting or offering the user's preferred language. This is a language-policy issue because the skill imposes a specific locale without opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language prompt explicitly forces Chinese text such as "厕所记录" and Chinese label translations on the generated card. This is a language/locale policy issue because the file does not offer the user a language choice or explain why Chinese output is required.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The SOP instructs creating a persistent local directory and saving generated image files containing bathroom-event metadata such as time, duration, color, pain, and Bristol scale. Because this is sensitive health-adjacent information, persistent storage can create a privacy risk if the user is not clearly informed, if files accumulate indefinitely, or if local access by other software/users is possible.

Content

Scanner excerpt · references/card_sop.md (reported line 64)May include surrounding context.

How to run Nano Banana Pro (example)

bash

mkdir -p ~/.openclaw/media/excretion-cards
uv run /Users/herve.clawd/.openclaw/workspace/skills/nano-banana-pro/scripts/generate_image.py \
  --prompt "<PROMPT>" \
  --filename "$HOME/.openclaw/media/excretion-cards/excretion-card-YYYY-MM-DD-HH-MM-SS.png" \

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Hard-coding DEFAULT_TZ = 'Asia/Shanghai' for sensitive health-event records can silently mislabel timestamps and distort time-based analysis such as nocturia counts, weekly windows, and interval calculations for users in other regions. In this context the issue is mainly data-integrity and privacy-context risk rather than direct compromise, but incorrect timing can still produce misleading health reminders and summaries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The weekly summary treats every non-pee event as poop, so 'attempt' events are counted as bowel movements and included in poop pain/interval statistics. In a health-tracking skill, this creates materially incorrect summaries that can mislead users about constipation, bowel frequency, and symptom trends, which is a real integrity issue even though it is not code-execution related.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file instructs the skill to produce a PNG in a local directory and later shows commands that create that directory and write an output file. Under the markdown-file criteria for missing user warnings, there is no explicit warning that the skill may create local files or invoke an installed external generator to process user-provided event data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The top-level docstring presents the tool as a local pee/poop tracker, yet the documented usage and implementation also support an 'attempt' event type for unsuccessful bathroom attempts. That is an intent/documentation mismatch because the code's supported domain is broader than the headline description suggests.

Content

No source excerpt is available for this finding.