Security audit
Security checks for vulnerabilities and agentic risk
This is a real reflection/journaling skill, but it broadly reads and stores OpenClaw conversation history for behavioral analysis without tight consent, scoping, or retention controls.
Install only if you want a Chinese-language coach that records reflections and can mine your OpenClaw session history. Before enabling cron or deep mode, restrict the sessions directory, avoid broad transcript ingestion, review where memory files are stored, and set your own retention/deletion process for daily digests and growth records.
scripts/extract-raw-inputs.py:84Overbroad Collection and Persistent Retention of Private Session Transcripts
scripts/extract-raw-inputs.py:136Indirect Prompt Injection Through Untrusted Transcript Content
The declared description promises a reflective system that integrates current input, past retrospectives, and everyday context to detect deeper behavioral patterns. The supplied code does not do that. It only parses local OpenClaw session transcript files, filters messages by date, extracts user text, attaches short assistant previews, applies shallow rule-based labels such as emotion/task/review, and outputs a daily markdown summary. There is no evidence of multi-layer memory integration, retrospective linkage across time, note-taking beyond digest generation, or behavioral pattern discovery. The primary purpose is materially different: daily log extraction and summarization rather than a three-layer feedback/review analysis system.
The declared description presents a higher-level reflective system that integrates current input, past retrospectives, and everyday context to automatically detect deep behavioral patterns. The supplied code does not implement that functionality. Instead, it is a preprocessing/extraction script: it reads local session logs, selects user messages for a target date, removes some metadata/noise, filters certain automated messages, sorts results by time, and prints a plaintext timeline. While this could support a larger review pipeline, the chunk itself neither links multiple feedback layers nor analyzes behavior patterns. It also accesses local session transcript files, which is a concrete capability/resource use not reflected in the description. Therefore the code's actual behavior is materially narrower and different from the declared purpose.
The declared description presents an analytical memory/feedback skill focused on linking inputs, historical reflections, and contextual notes to identify deep behavior patterns. The supplied code does not implement such analysis or pattern recognition. Instead, it performs a file migration utility: it reads a markdown file, extracts structured fields with regex, emits JSONL, deduplicates by id, and renames the original file as a backup. This is a materially different primary purpose and includes undeclared file conversion and backup behavior. Therefore the description does not accurately represent the code.
The declared description promises a higher-level analytical system that integrates current input, past reviews, and everyday context to infer deep behavior patterns. The supplied code only performs lightweight keyword detection on command-line input, selects a predefined route/mode/dimension mapping, and returns a template reference. This is a materially different primary purpose: routing into review templates rather than performing the described multi-layer analysis or note integration. There are no undeclared sensitive permissions or resource accesses, but the implemented behavior is substantially narrower and different from the declared description.
The skill is designed to collect, persist, correlate, and summarize large amounts of user interaction data, but it does not present a clear user-facing privacy warning or consent mechanism at the point of use. This is dangerous because highly sensitive behavioral, emotional, and contextual data may be stored and reused without informed consent.
These trigger phrases are common everyday words such as '情绪', '目标', '回顾', and '帮助', so normal conversation can unintentionally activate storage, analysis, deletion, or history functions. In a skill that persistently logs and correlates user data, accidental triggering is dangerous because it can cause collection or destructive actions without clear user intent.
The daily digest process summarizes all user interactions, including projects, links, follow-ups, and emotional state, into a persistent structured file. This creates a concentrated, highly sensitive dossier that is more valuable to attackers and more harmful if exposed than the original fragmented interactions.
The README explicitly promotes connecting all user inputs, historical reviews, and daily context, but it does not prominently warn users that their conversations and behavioral data may be persistently collected, correlated, and analyzed. This creates a meaningful privacy risk because users may disclose sensitive personal, emotional, or behavioral information without informed consent or clear understanding of retention and reuse.
The README markets the skill as connecting all inputs and automatically identifying deep behavioral patterns across time, implying persistent logging and cross-session profiling of user data. In the context of reflective journaling and emotional analysis, this is especially sensitive because the stored material may include mental state, habits, commitments, and personal narratives.
The README instructs users to invoke the skill using Chinese trigger phrases such as 复盘, 周盘, and 帮助, and all operational guidance is presented only in Chinese. This effectively forces a specific language/locale without stating that the skill is Chinese-only by design or offering alternatives, which matches the language-policy violation criteria.
The Cron-based daily digest workflow directs automated extraction of content from session transcripts into memory files on an ongoing basis. This creates a standing data collection pipeline that can silently accumulate sensitive conversation data over time, especially if users are unaware that transcripts are being mined and re-materialized into separate persistent artifacts.
The deep mode description states that the skill will inject same-day conversation summaries and correlate them with user actions, which broadens collection beyond the immediate user prompt into wider interaction history. This increases the chance that unrelated, sensitive, or confidential content is reused in analysis without clear scoping, minimization, or consent.
Without declared permissions the skill's intent is opaque and cannot be validated.
The file is written entirely in Chinese and the message examples and operational guidance assume Chinese output without indicating any user choice or localization fallback. This can cause the skill to respond in an unexpected language, reducing user understanding and increasing the chance of mistaken confirmations or missed warnings in reminder-driven flows.
The reminder system suggests sending only a bare trigger word such as “复盘”, which is a common conversational term and can easily appear in ordinary chat. If the skill auto-expands on that trigger, unrelated user messages or scheduled reminders may unintentionally invoke the full workflow, causing unintended processing and confusing or intrusive behavior.
This markdown file presents all user-facing trigger labels, prompts, and output templates exclusively in Chinese, with no indication that users may choose another language. Per the policy scope, a skill that effectively requires a specific language without opt-in is a natural-language policy violation.
The file's natural-language interface and generated output are written in Chinese, and the script does not provide any user opt-in or configurable language selection. Under the stated policy, forcing a specific language or locale without choice is a natural-language policy concern unless clearly justified as region-specific.
The script is explicitly designed to collect, summarize, and retain users' daily messages in a long-lived digest file, including a complete timeline. Given the skill's context of analyzing deep behavior patterns and daily context, these records may contain highly sensitive personal data, making the retention itself a meaningful privacy and data-exposure risk if the workspace is accessed by other tools, users, or backup systems.
The script persists transcript-derived user messages into a plaintext markdown file without any consent prompt, retention control, or warning about sensitive content. In the context of a memory/behavior-coaching skill that processes reflective personal conversations, this increases the chance of privacy leakage through local compromise, backup sync, or unintended reuse by other tools.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
# 写入文件
os.makedirs(OUTPUT_DIR, exist_ok=True)
output_path = os.path.join(OUTPUT_DIR, f"{target_date}.md")
with open(output_path, "w", encoding="utf-8") as f:
f.write(digest)
print(f"✅ 摘要已写入: {output_path}", file=sys.stderr)
The script aggregates raw user messages from local session transcripts and prints them to stdout specifically for downstream LLM processing, which creates a privacy and data-handling risk because sensitive personal content may be forwarded, logged, or consumed without explicit user consent or notice. In the context of a 'user-growth-coach' skill that correlates current input, historical reflections, and daily context to infer deep behavior patterns, the extracted data is especially sensitive and can reveal intimate behavioral or psychological information.
The module docstring states that the script migrates user-growth markdown records to JSONL format. However, the implementation also performs a filesystem mutation by renaming the input markdown file to a .bak file, which materially changes the source file state beyond simple conversion.
The output path is taken directly from an environment variable and then opened for writing without validation. If an attacker or untrusted wrapper controls the runtime environment, they can redirect output to an arbitrary file path, causing unintended file overwrite or clobbering within the permissions of the executing user.
records = parse_md(INPUT)
print(f"解析出 {len(records)} 条记录")
with open(OUTPUT, "w", encoding="utf-8") as f:
for r in records:
f.write(json.dumps(r, ensure_ascii=False) + "\n")
The file docstring says the script migrates markdown records to JSONL format, which implies reading one format and producing another. In addition to writing the JSONL output, the code renames the original input file to a .bak backup, changing the source data on disk in a way not conveyed by the stated behavior.
The skill only recognizes Chinese mode terms (快速/标准/深度) and Chinese trigger words such as 复盘 and 决策. This imposes a specific language requirement in the skill logic without any visible opt-in, alternative locale support, or documented justification in the file.