T09 · Insecure Skill Coding Practices
Warning
- Location
aaron.py:14- Finding
Sensitive dental and insurance records are stored in plaintext without explicit access controls
- Content
View full analysis
- Remediation
View remediation
Security audit
Aaron
Security checks for vulnerabilities and agentic risk
Overview
The skill’s dental-assistant purpose is coherent, but it needs review because it persists sensitive dental, insurance, identity, and appointment details in plaintext files and logs without clear privacy controls.
Review before installing. This skill may keep dental appointments, treatments, dentist addresses, insurance IDs, a person/phone-like identifier, and commute context on disk under /root/.openclaw/workspace/aaron. Use it only if that local persistence is acceptable, verify file permissions and any external cron reminder setup, and avoid entering insurance member or group identifiers unless the storage is protected and there is a clear deletion plan.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill is presented as a persistent autonomous dental receptionist with reminders, scheduling, and insurance coordination, but the described behavior appears to be much narrower and largely manual/CLI-driven. This mismatch is dangerous because users may trust it to perform time-sensitive healthcare coordination or assume autonomous handling of reminders and insurance tasks that are not actually implemented, leading to missed appointments, privacy mistakes, or unsafe operational assumptions.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill describes persistent file read/write behavior but does not declare an explicit tool scope or permissions boundary. In a persistent agent handling health and insurance data, missing scope declarations increase the risk of overbroad file access, weak reviewability, and accidental or unauthorized data exposure if the runtime grants more access than intended.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes using the CFO's current location to estimate transit time for reminders but does not warn the user that location data may be accessed or processed. Silent use of location in a persistent healthcare-related assistant creates unnecessary surveillance and privacy risk, especially when combined with appointment history and treatment information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly stores dental and insurance records, including treatment history and member identifiers, on the local filesystem without any privacy warning, retention notice, or consent guidance. Because this is sensitive health-related and insurance data, undisclosed local persistence materially raises the risk of confidentiality loss, inappropriate collection, and compliance issues if the host is shared, backed up insecurely, or later accessed by other agents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script persists sensitive health and insurance data to disk in a fixed workspace location without any access controls, encryption, minimization, or user consent/notice. Because this agent is explicitly designed to manage dental appointments for a CFO, the stored data can include protected health information, insurance identifiers, addresses, and treatment history, making unauthorized local access or workspace compromise materially harmful.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The logging function writes appointment and treatment details to a JSONL log file, creating a second persistent copy of sensitive medical data that may be broader than necessary for operation. Logging increases exposure because health, scheduling, dentist, address, and treatment information can be harvested from audit trails even if the main records file is later edited or deleted.
- Content