Security audit

Birthday

Security checks for vulnerabilities and agentic risk

Overview

This skill has a legitimate member-reminder purpose, but its handling of personal data and persistent reminders needs review before installation.

Review before installing, especially if this will run for multiple users or in a bot. Require a real authenticated session key, avoid the shared default directory, keep the PII files private and backed up securely, and treat reminder text fields as untrusted data rather than future agent instructions.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:75
Finding: Missing Session Identity Falls Back to a Shared Data Directory
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:567
Finding: Persistent Prompt Injection Through Untrusted Member and Reminder Fields
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:97
Finding: Personal Data Is Written to Plaintext Files Without Secure Creation Guarantees
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:17
Finding: Dependency Installation Is Not Reproducibly Pinned or Integrity-Verified
Content: View full analysis
=0.2.2" license: GPL-3.0 required_for: "Lunar date conversion" ``` ```python # pip install lunardate from lunardate import LunarDate ``` ```text On first use of the lunar-calendar feature, confirm that lunardate is installed (pip install lunardate), and scan it with pip-audit. ``` ### Technical Analysis The declared constraint `>=0.2.2` permits installation of any future release, while the suggested command installs whatever version the configured package index currently selects. No lockfile, artifact hash, trusted index requirement, or isolated environment is specified. Consequently, the code reviewed during the Skill audit may not be the code eventually installed. A malicious future release, compromised package account, poisoned package index, or unsafe index configuration could introduce code that executes during installation or import. `pip-audit` identifies known published vulnerabilities but does not establish artifact provenance or guarantee that a package is non-malicious. ### Attack Path 1. The lunar-calendar feature is invoked on a system where `lunardate` is not installed. 2. The operator or agent follows the documented `pip install lunardate` instruction. 3. Package resolution selects a version newer than the reviewed minimum or retrieves an artifact from an untrusted or compromised index. 4. Malicious package code executes during installation or when `lunardate` is imported. 5. The malicious code runs with the privileges of the OpenClaw process and can access files and credentials available to that account. ### Impact Assessment A compromised dependency can execute Python code with the full privileges of the account running the Skill. This may expose all member d ...[truncated 401 chars]
Remediation: View remediation
=0.2.2`. - Maintain a lockfile containing cryptographic hashes for all accepted artifacts. - Install with hash verification, such as a requirements file used with `pip install --require-hashes`. - Require an explicitly trusted package index and disable unintended supplemental indexes. - Install dependencies during a controlled build or deployment phase rather than dynamically on first use. - Use a dedicated virtual environment with only the permissions required by the Skill. - Review package provenance, maintainer history, release artifacts, and license compatibility before upgrades. - Continue vulnerability scanning, but treat it as an additional control rather than a substitute for pinning and integrity verification. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 780)May include surrounding context.
md
### Session Key 安全 Session key **必須經過清洗**才能用於構建文件路徑，防止目錄遍歷攻擊（如 `../../etc/passwd`）。參見上方 `sanitize_session_key()` 函數。 ### Agent 自主存取控制

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description and the rest of the skill are written as instructions for Chinese-language use, and the usage examples assume Chinese input/output. There is no indication that users may choose another language or that this locale restriction is required for a region-specific compliance reason.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill says member data should never be accessed without a session key, but the sample logic falls back to a shared default key and creates/uses that directory automatically. In a multi-user deployment, this can collapse isolation boundaries and cause one user's PII to be read, modified, or mixed with another user's data whenever session context is absent or malformed.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 767)May include surrounding context.
md
本 skill 存儲個人可識別信息（PII），包括姓名、電話、生日等。**所有數據以明文 JSON 存儲在本地磁碟**。 **必要的安全措施：** 1. **文件權限**：數據目錄應設置為僅用戶可讀（`chmod 700 ~/.openclaw/workspace/users/`） 2. **備份加密**：備份時應使用加密（如 `gpg` 或加密壓縮包） 3. **不要將數據目錄同步到雲端**（如 iCloud、Dropbox），除非雲端本身有加密

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a local member/anniversary manager that stores data and creates scheduled reminders. However, the documentation tells the agent to use pip-audit and pip install lunardate, which introduces package-management and environment-modification capabilities not justified by the skill's stated user-facing purpose.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation claims writes require user confirmation, but the provided mutation functions perform immediate file changes with no confirmation gate. In agent-driven use, this mismatch can lead to unauthorized or accidental creation, modification, or deletion of sensitive member records and reminders if higher-level orchestration assumes the skill enforces confirmation internally.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.