Security audit

smarter-task-planner

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it writes persistent workspace memory and has under-scoped automatic/file-write behavior that users should review before installing.

Install only if you want a Chinese-language task planner that persistently records task progress in the OpenClaw workspace. Avoid using untrusted task IDs or step names, do not enable the heartbeat template unless you verify the script path, and review stored MEMORY.md, memory, and output files for sensitive content after use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/safe-writer.py:160
Finding: Workspace Escape Through Unvalidated Task and Step Identifiers
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/safe-writer.py:27
Finding: Predictable Temporary Files Allow Symlink-Based File Overwrite
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared purpose is task planning, but the described behavior includes persistent memory writing, recovery scanning, and use of auxiliary scripts that are materially broader than simple planning. This mismatch is dangerous because users may consent to a planner while actually enabling a persistence/logging mechanism that stores task content over time and accesses workspace state in ways not transparently described.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list contains broad, everyday phrases like creating tasks, planning work, organizing work, and project execution, which can cause accidental invocation during normal conversation. Because this skill performs filesystem writes and script execution steps, overbroad activation materially raises the chance of unintended side effects without clear user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Triggers for analysis, research, information extraction, and document generation are especially risky because they map to common benign requests that do not inherently imply permission to create folders, store checkpoints, or scan unfinished tasks. In this context, accidental activation could silently transform a simple content request into a persistent workspace-modifying workflow.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs the agent to use shell commands and write to workspace files, but it declares no explicit tool scope or permission boundary. This increases the risk of unintended file modification or command execution because the agent may invoke capabilities that the user was not clearly informed about or that the platform cannot constrain at skill-load time.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: 文件标题、描述及全部触发词均以中文为主，实际上将技能调用与使用方式绑定到单一语言，但文档未说明这是可选项，也未提供其他语言触发方式。若组织要求避免未经选择地强制特定语言/区域设置，这种默认中文约束属于自然语言层面的策略风险。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instructions direct the agent to automatically create directories and immediately write checkpoints, but they do not clearly warn the user that the skill will modify the workspace. This is dangerous because users may invoke what appears to be organizational help without realizing it causes persistent file changes and possibly stores sensitive task content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file presents all guidance in Chinese and does not indicate that users may choose another language or that the locale is intentionally constrained. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The entire guide, including headings, instructions, examples, and command descriptions, is written only in Chinese. For a general task-memory guide, this imposes a specific language/locale without any opt-in, alternative language option, or stated region-specific justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file is entirely written in Chinese and provides no indication that other languages are supported or that the user can choose their preferred language. Under the policy rule for natural-language violations, forcing a specific language without opt-in is a reportable issue.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a skill that creates timestamped task folders and supports step planning, checkpoint save/restore, interruption recovery, and progress tracking. This file instead implements a 'safe memory write' helper that appends content to daily memory files and updates a small metadata JSON file, which is materially narrower and different from the advertised task-planning behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language description in the script header is entirely in Chinese and does not provide an alternate language or indicate that the skill is intentionally limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Natural-language strings in the module docstring, comments, CLI description, help text, and runtime messages are all in Chinese, with no indication that the user can select another language. Under the stated policy, forcing a specific language without user opt-in is a locale-policy concern.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code writes to workspace-level shared paths (workspace/memory, workspace/MEMORY.md, workspace/output) rather than isolating all data to a single task. In a multi-task or multi-user environment, this can enable unintended persistence and cross-context data exposure if later tasks or tools read from the same shared store.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script persists selected content into a shared long-term MEMORY.md file in addition to task-scoped artifacts. Even though it filters for 'important' content, this creates cross-task durable storage that can retain sensitive prompts, analysis results, or secrets longer than users may expect, increasing privacy and data-retention risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI accepts arbitrary content and writes it to disk across daily memory, task metadata, and potentially long-term memory without any explicit user-facing warning or confirmation. Users may provide sensitive information assuming transient processing, causing unintentional storage of secrets, personal data, or proprietary material.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This is a natural-language policy issue because the file hard-codes Chinese for the title, status values, prompts, and argparse help text throughout the script. There is no opt-in, alternate locale, or justification that the tool is intended only for a Chinese-language environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes a task planner focused on creating timestamped task folders, checkpointing, interruption recovery, and progress tracking. While recovery itself is in scope, this file implements that behavior by spawning external interpreter commands via subprocess, which is a broader execution capability than the planner purpose alone justifies and could execute additional logic contained in the target script.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/task-recovery-check.py (reported line 70)May include surrounding context.
python
try: # Run scan command result = subprocess.run( ['py', str(manager_script), 'scan'], capture_output=True, text=True,

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script recognizes active tasks only when their status is '进行中' or '已暂停', and it instructs users to use the Chinese phrase '恢复上次任务'. This enforces a specific language/locale in both parsing logic and user-facing guidance without opt-in or an alternative, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/task-recovery-check.py (reported line 119)May include surrounding context.
python
if active_tasks: latest_task = active_tasks[0]['task_id'] print(f"\nINFO: Auto-recovering: {latest_task}") subprocess.run([ 'py', str(manager_script), 'load', '--task-ids', latest_task, '--max-per-task', '5'

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The recovery guide for the smarter-task-planner skill constructs a path to and executes a script from a different skill, workspace-organizer. This creates a trust-boundary violation: users enabling heartbeat for this skill may unintentionally run unrelated code, and if that other skill is absent, replaced, or maliciously modified, arbitrary code could execute under the user's context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The statement that the system will automatically execute the check on heartbeat is overly broad and does not constrain when, how often, or under what safety conditions code runs. In this context, the file already instructs execution of a local Python script, so vague automatic triggering increases the chance of repeated, implicit execution without clear user awareness or administrative control.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The comment at L113 states the basic functionality is 'only saving to daily memory files'. However, the script also calls Update-TaskMetadata, which writes .task-meta.json under the task output directory, so the documentation contradicts the actual side effects.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The header text says "Workspace Organizer quick commands (English)", which imposes a specific language in natural-language documentation without any visible opt-in or alternative locale support. Under the policy, language constraints should either be optional or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.