ClawHub
Back to skill

Security audit

Timedoctor

Security checks for vulnerabilities and agentic risk

Overview

This TimeDoctor skill appears to be a real integration, but it handles passwords and long-lived tokens unsafely while exposing sensitive employee, payroll, and screenshot data.

Install only if you are authorized to access the relevant TimeDoctor company data, including payroll and screenshots. Do not paste TimeDoctor passwords or raw JWT tokens into an agent chat, avoid storing six-month tokens in shell profile files, and prefer a manually provisioned token kept in a proper secret store with least-privilege account permissions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
timedoctor.py:372
Finding

TimeDoctor Credentials and Long-Lived JWT Tokens Are Exposed Through Unsafe Interfaces

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:27-35, SKILL.md:187-198, SKILL.md:278-295, timedoctor.py:372-373, timedoctor.py:396-402
Vulnerability Type: Credential exposure through command-line arguments, agent conversations, and standard output
Risk Level: Medium

Vulnerable Code and Instructions

SKILL.md:27-35 instructs users to provide their password as a command-line argument and then export the returned long-lived token:

bash
python3 timedoctor.py login --email "your-email@company.com" --password "your-password"

This returns a JWT token valid for 6 months. Copy the token and set it:

bash
export TIMEDOCTOR_TOKEN="your-jwt-token-from-login-response"

SKILL.md:187-198 explicitly instructs the agent to solicit credentials from the user:

text
1. **Check if User Has Token**
   - If `TIMEDOCTOR_TOKEN` is not set, help them login:
     ```
     "To get started, I need your TimeDoctor credentials.
     
     I'll run: python3 timedoctor.py login --email YOUR_EMAIL --password YOUR_PASSWORD
     
     What's your TimeDoctor email and password?"
     ```
   - After getting credentials, run login command
   - Extract token from response
   - Tell user to set: `export TIMEDOCTOR_TOKEN="extracted-token"`
   - Explain token is valid for 6 months

SKILL.md:278-295 repeats the workflow and directs the agent to return the token to the user:

text
Steps:
1. Check if TIMEDOCTOR_TOKEN is set
2. If not, ask for credentials:
   
   "To get started, I need your TimeDoctor login credentials.
   
   What's your TimeDoctor email and password?"

3. User provides: "email@company.com" and "password123"
4. Run: python3 timedoctor.py login --email "email@company.com" --password "password123"
5. Parse response and extract token
6. Tell user:
   
   "Great! I got your token. It's valid for 6 months (until September 2026).
   
   Please set it in your environment:
   export TIMEDOCTOR_TOKEN='1jxExVs9WGsWccrq2ysMKMZVZlTVyTZc15tl
...[truncated 3833 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove password collection from agent conversations

    • Do not instruct the agent to ask users for TimeDoctor passwords.
    • Explicitly warn users not to paste passwords or tokens into chat.
    • Prefer an official OAuth, browser-based authorization, device-code, or equivalent delegated authentication flow.

  2. Remove the --password command-line option

    • If password authentication is unavoidable, read the password directly from an interactive terminal with Python's getpass.getpass().
    • Ensure the password is neither echoed nor included in command arguments.
    • Reject password input when no trusted interactive terminal is available.

  3. Do not print authentication responses or tokens

    • Parse the authentication response internally.
    • Never send the complete response to standard output.
    • Return only a success message and non-sensitive metadata, such as the expiration date.
    • Redact token-like values from exceptions, debug output, and agent tool results.

  4. Use protected credential storage

    • Store tokens in an operating-system credential manager or platform-provided secret store.
    • Apply restrictive file permissions if a file-based fallback is necessary.
    • Avoid documenting persistent token exports in shell profiles, because those files and commands may be copied into backups or exposed through support logs.

  5. Reduce token exposure and lifetime

    • Prefer short-lived access tokens with refresh-token rotation where supported.
    • Document revocation procedures.
    • Revoke and replace any token disclosed in a transcript, terminal recording, or command history.

  6. Harden operational logging

    • Disable tool-call and subprocess argument logging during authentication.
    • Add structured redaction for passwords, Authorization headers, JWTs, and login responses.
    • Verify that monitoring, crash reporting, and support bundles do not collect authentication material.

  7. **Upda ...[truncated 276 chars]

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 102)May include surrounding context.

rectory cp -r timedoctor-skill ~/.openclaw/workspace/skills/timedoctor

Install Python dependencies

cd ~/.openclaw/workspace/skills/timedoctor pip3 install -r requirements.txt

text

### Step 3: Set Environment Variables

```bash
export TIMEDOCTOR_TOKEN="your-jwt-token-here"
export TIMEDOCTOR_COMPANY_ID="your-company-id"  # Optional

Or add to your shell profile (~/.bashrc, ~/.zshrc):

bash
echo 'export TIMEDOCTOR_TOKEN="your-token"' >> ~/.bashrc
echo 'export TIMEDOCTOR_COMPANY_ID="your-company-id"' >> ~/.bashrc

Step 4: Restart OpenClaw

Restart your OpenClaw agent to load the skill.

Configuration

Set the required environment variables:

bash
export TIMEDOCTOR_TOKEN="your-jwt-token-here"
export TIMEDOCTOR_COMPANY_ID="your-company-id"

The TIMEDOCTOR_COMPANY_ID is optional but recommended. You can discover it by calling get_authorization().

Usage

Once installed, ask your OpenClaw agent questions like:

  • "Get authorization info to find my company ID"

Missing User Warnings

High
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill describes access to employee monitoring and productivity analytics, and elsewhere documents payroll and screenshot capabilities, yet provides no privacy or sensitivity warning. In this context, the data is inherently high-risk because it concerns employee behavior, potentially compensation, and possibly captured screen content, all of which require heightened consent and handling safeguards.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

These instructions direct the agent to collect the user's password, extract a returned access token, and then present or store that token in plain language. This is dangerous because it turns the agent and conversation channel into a credential-handling surface, exposing both the original password and a long-lived bearer token to logs, memory, or downstream tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill tells the agent to ask for the user's TimeDoctor email and password and then submit those credentials through the tool workflow, without any security warning or safer alternative. Collecting raw passwords in chat or agent memory materially increases the chance of credential theft, retention, replay, or leakage through logs and transcripts.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The first-time setup workflow explicitly instructs the agent to obtain login credentials and echo back a valid six-month token for manual export. That creates a direct secret-exfiltration pattern: anyone with access to the transcript, shell history, or agent state could reuse the token to access company time-tracking data across the token's lifetime.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description focuses on time tracking, worklogs, statistics, and productivity metrics, but the implementation also exposes payroll settings and employee screenshot/screencast retrieval. This materially broadens access to highly sensitive HR and surveillance data, increasing the chance of over-collection, misuse, or unauthorized disclosure under the guise of an analytics tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

Payroll endpoints expose sensitive compensation and company payroll configuration data that is unrelated to the stated analytics/time-tracking purpose. Including these functions in a general productivity skill creates unnecessary access to HR-sensitive information and raises the risk of unauthorized internal data exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Access to screenshot and screencast files can expose extremely sensitive employee information, including on-screen secrets, personal communications, customer data, and other non-time-tracking content. Because the skill is presented as a simple metrics/worklog integration, this hidden surveillance capability is disproportionate and dangerous in context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README explicitly promotes access to employee monitoring data such as worklogs, screenshots, screencasts, payroll, and productivity metrics, but provides no warning about the sensitivity of that data or the need for authorization, consent, and least-privilege handling. In a workforce analytics skill, this omission increases the chance that operators will expose or mishandle highly sensitive employee data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

  1. Use the TimeDoctor Login API endpoint to get a JWT token:
    bash
    curl -X POST https://api2.timedoctor.com/api/1.0/login \
  -H "Content-Type: application/json" \
  -d '{"email": "your@email.com", "password": "your-password"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README instructs users to persist a long-lived JWT token in shell startup files, which can expose credentials to local users, backups, shell history workflows, and accidental disclosure through dotfile syncing. Because the token remains valid for months, compromise of the profile file can grant prolonged API access to sensitive company and employee data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill explicitly instructs use of environment variables for tokens and a Python CLI that performs network access, but the manifest does not declare any corresponding tool scope or permissions. This creates a transparency and policy gap: an agent or reviewer cannot accurately constrain what the skill is allowed to access, increasing the risk of unintended secret exposure or unauthorized external calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The examples normalize copying and exporting a long-lived JWT token valid for months, but provide no warning that the token is effectively a bearer secret granting account access. This encourages insecure handling such as shell history retention, transcript leakage, and accidental exposure to other tools or users on the system.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The top-level description frames the skill as simple time-tracking and productivity retrieval, but the documented commands also include payroll and screenshot/screencast access. That mismatch can mislead users and reviewers about the actual sensitivity of accessible data, causing consent and authorization failures for highly sensitive employee information.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Exposing get_files for screenshots/screencasts introduces surveillance access that goes well beyond ordinary worklog/statistics retrieval. In the context of an employee-monitoring platform, screenshot data may capture private messages, credentials, financial information, or unrelated personal content, making misuse significantly more harmful.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The generic GET helper is used throughout the CLI to request sensitive organizational data such as payroll, screenshots, worklogs, work-life statistics, and user records, yet the tool provides no runtime disclosure that these commands will access and transmit monitoring or personnel data. Aside from terse internal docstrings, there is no confirmation prompt, visible warning, or privacy-oriented notice for these sensitive network operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest frames the skill as simple scripts to pull reporting data, which implies a read-oriented integration. The login function expands behavior into handling raw user credentials and obtaining JWTs from the remote service, which is a distinct authentication capability not mentioned in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code file performs a network POST that sends the user's email and password to a remote service, but the execution path provides no confirmation prompt, visible warning, or user-facing disclosure beyond a terse docstring. Because credential transmission is safety-relevant and the file contains no explicit warning in comments or runtime output, it meets the missing-warning criteria for code files.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified as httpx>=0.27.0, which allows future, unreviewed versions to be installed and makes builds non-reproducible. This increases supply-chain risk and can also allow installation of versions with breaking changes or newly introduced vulnerabilities without explicit review.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
httpx>=0.27.0

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
84% confidence
Finding

Because httpx is not pinned, it is not possible to verify from this manifest alone whether the installed version is affected by known advisories. In a skill that accesses employee time tracking and productivity data, uncertain dependency state weakens assurance around components that may handle authenticated API traffic and sensitive business information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.