T06 · System Persistence
Error
- Location
ONBOARDING.md:54- Finding
Heartbeat Integration Installs a Persistent Cross-Session Hook Without Explicit Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
Personal Nutritionist
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent nutrition tracker, but it under-discloses sensitive long-term health memory and installs persistent reminder behavior too automatically.
Review before installing. This skill is not malicious on the inspected artifacts, but it should be treated as a Review item because it can build a lasting health-adjacent profile, update memory silently, add heartbeat behavior, and create reminders. Install only if you are comfortable with persistent nutrition and health-context memory, and check or disable any HEARTBEAT.md and openclaw cron entries you do not explicitly want.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
HEARTBEAT_SNIPPET.md:1- Finding
Heartbeat Executes an Undeclared and Unverified PATH-Resolved Command
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md ## Who you are <!-- Agent rewrites this paragraph weekly as it learns more — one synthesized summary --> {WHO_YOU_ARE} Example: "You're a 32-year-old training for a half marathon. Protein is your main
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md | Chicken breast + rice (home) | 180g chicken / 200g rice | 520 | 52g | 6g | 62g | 12x | ## Learned food preferences <!-- Agent appends here when patterns emerge — do not delete --> {FOOD_PREFERENCES} ## Patterns
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly directs storage of health conditions, fitness goals, and medication details in persistent memory. In a nutrition skill, this is especially sensitive regulated-style health data, and persisting it long-term without strong consent boundaries, minimization, and retention controls creates significant privacy and misuse risk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The heartbeat snippet explicitly instructs the skill to react when a user merely mentions food in passing and to prompt for logging, which conflicts with the stated trigger boundary that it should not activate on casual mentions. This mismatch can cause unintended data collection and user nudging outside the declared scope, weakening user consent expectations and making the skill more intrusive than advertised.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to read stored personal profile sections from memory and display them immediately if setup already exists, without any contextual verification. In shared-device, cross-session, or mistaken-identity situations, this could expose another user's stored health-related preferences and goals to the wrong person.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The flow solicits weight, height, age, and activity level to estimate calorie goals, but gives no disclosure that these are sensitive personal and health-related attributes or how they will be processed and stored. Collecting such data without clear notice undermines informed consent and can expose users to privacy harms if retained or surfaced later.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill stores a nutrition profile, goals, restrictions, and meal-related preferences in persistent memory without warning the user about retention, scope, or future reuse. This is sensitive health-adjacent personal data, and silent persistence increases privacy risk if the memory is later accessed, reused out of context, or exposed to other workflows.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The heartbeat integration adds persistent platform-level behavior that is broader than simple meal logging and profile storage. Even if intended for convenience, modifying shared heartbeat/scheduling state can affect the broader agent environment and creates unnecessary capability expansion for a nutrition skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The onboarding flow directs the agent to create recurring cron-based reminders, which expands the skill from passive nutrition tracking into persistent autonomous behavior. That creates an execution surface beyond the user’s immediate request and contradicts the skill’s stated 'zero installation / memory-only' framing, increasing the risk of unexpected background actions or user surprise.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest explicitly says 'Zero installation required — no CLI, no pip, no binary. Works entirely through agent knowledge and memory.' Later, the skill instructs the agent to run
openclaw cron add/list/disablecommands to create reminders, which is behavior outside pure knowledge-and-memory operation and contradicts the no-CLI claim.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs background writes of sensitive nutrition data without routine user-facing disclosure, relying on one-time onboarding consent to justify ongoing persistence. Because dietary habits and related health signals can be sensitive, silent background storage reduces informed consent and makes it easier to accumulate more personal data than users reasonably expect.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
These instructions authorize broad collection, retention, and reuse of sensitive behavioral and nutrition data while intentionally minimizing notifications about writes. In context, this is more dangerous because the skill is designed to build a longitudinal health-related record, which can reveal routines, goals, and personal conditions beyond the immediate user request.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The weekly synthesis creates and rewrites a persistent personal profile from four weeks of logs, including inferred personality, consistency, and behavior patterns. This is risky because it transforms transactional meal entries into a durable dossier of inferred traits, increasing privacy harm if accessed improperly and expanding processing beyond what many users would expect from a food-tracking skill.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest frames the skill as a nutrition logger, but the instructions direct persistent synthesis of a broader personal dossier ('Who you are', patterns, personality, consistency) from historical behavior. In a health-related context, this hidden expansion of profiling scope is privacy-sensitive because users may consent to meal logging without understanding that long-term behavioral inference and persona rewriting will occur.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest narrows triggering to explicit food-related messages and nutrition/diet setup, but the skill includes a dedicated 'Calorie burn estimates' section for activities like running, cycling, and HIIT. That broadens the operational scope beyond the food-only trigger framing in the manifest.
- Content
Static analysis
No suspicious patterns detected.