Listonic

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:29 PM UTC
• Version: 1.0.1

Overview

The skill appears to do the advertised Listonic shopping-list work, but it stores account credentials/tokens in plaintext without permission hardening and exposes destructive actions without built-in safeguards.

Review before installing. Use token mode instead of email/password when possible, restrict ~/.openclaw/credentials/listonic and config.json permissions manually, rotate/revoke Listonic tokens if exposed, and only allow delete commands after an explicit user confirmation with the resolved list or item.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/listonic.py:42

Finding

Credential Configuration File May Be Stored with Unsafe Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/listonic.py, lines 42–44
Vulnerability Type: Insecure storage permissions for authentication credentials
Risk Level: Medium

python

def _save_config(cfg: dict[str, Any]) -> None:
    CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True)
    CONFIG_PATH.write_text(json.dumps(cfg, indent=2) + "\n")

Technical Analysis

The configuration file can contain a Listonic email and password, OAuth access token, refresh token, and client authentication values. The code creates the credential directory and writes the file without explicitly enforcing restrictive filesystem permissions.

Consequently, permissions depend on the process umask. In addition, rewriting an existing file does not correct permissions that are already overly permissive. On a multi-user system, another local user may therefore be able to read the credentials.

The credential-path access itself is necessary for the Skill's declared Listonic functionality. The weakness is not that credentials are accessed, but that least-privilege permissions are not enforced when sensitive data is persisted.

Attack Path

1. A user creates the Listonic configuration or authenticates using token or email/password mode.
2. During authentication or token refresh, _save_config writes credentials and updated tokens to ~/.openclaw/credentials/listonic/config.json.
3. A permissive umask, permissive parent-directory permissions, or pre-existing unsafe file permissions leave the file readable by another local account.
4. A local attacker reads and copies the password, access token, or refresh token.
5. The attacker authenticates to Listonic and performs operations allowed by the compromised account.

This path requires local filesystem access under an account capable of traversing the relevant directories and reading the insufficiently protected file.

Impact Assessment

Successful exploitation may disclose the victim's Listonic password or ...[truncated 367 chars]

Remediation

View remediation

Remediation Suggestions

• Create ~/.openclaw/credentials/listonic with mode 0700.
• Create and maintain config.json with mode 0600.
• Correct unsafe permissions on existing directories and files rather than relying only on creation-time modes.
• Write updates atomically using a temporary file in the same directory:
  1. Create the temporary file with mode 0600.
  2. Write and flush the serialized configuration.
  3. Call fsync where durability is required.
  4. Replace the destination using os.replace.
• Validate that the destination is a regular file and avoid following attacker-controlled symbolic links where the threat model includes untrusted local users.
• Prefer a platform credential store or secret manager over a plaintext JSON file when available.
• Document the required file permissions in README.md and SKILL.md.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill instructs users to store refresh/access tokens in a local config file and explicitly mentions persisting updated tokens back to disk. These long-lived credentials can grant ongoing account access if the file is exposed through local compromise, overbroad file permissions, logs, backups, or other skills with file-read capability.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

}

text

Tip: the script now auto-refreshes access tokens and persists updated tokens back to config.
It also accepts `refresh_token` / `access_token` keys if you paste raw OAuth payload JSON.

Optional (advanced):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/listonic.py (reported line 195)May include surrounding context.

python

try:
            _save_config(cfg)
        except OSError:
            # Non-fatal: continue with working access token
            pass

    return access

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/listonic.py (reported line 207)May include surrounding context.

python

try:
            _save_config(cfg)
        except OSError:
            # Non-fatal: continue with working access token
            pass

    return access

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/listonic.py (reported line 288)May include surrounding context.

python

extra_headers=extra_headers,
    )

    # Access token can expire during long-running automations; refresh once and retry.
    if status == 401 and _RUNTIME_CFG and _RUNTIME_CFG.get("refreshToken"):
        refreshed = _refresh_access_token(_RUNTIME_CFG)
        if refreshed:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises capabilities that clearly involve file reads/writes and network access, but it does not declare any explicit tool scope or permission boundaries. That increases risk because an agent or runtime may execute the skill with broader privileges than users expect, especially since it reads credentials from disk and calls an unofficial remote API.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill establishes persistent session material under ~/.openclaw/credentials/listonic/config.json, creating durable local authentication state. Persistent credentials are a security concern in a multi-skill or multi-user environment because they expand the window of compromise and may be accessible to unrelated processes or future executions.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

## Setup

Create `~/.openclaw/credentials/listonic/config.json` using **one** auth mode.

### Recommended: token mode (works with Google sign-in)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill persists authentication material to a local config file, and the same config format explicitly allows storing email/password as well as access and refresh tokens. Writing secrets to disk without any warning, secure-storage integration, or file-permission hardening increases the chance of credential theft from other local users, backups, logs, or malware on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The delete-list command performs an irreversible remote deletion immediately after argument parsing, with no confirmation prompt, dry-run, or explicit force flag. In an agent/automation context, a mistaken list name match, prompt injection, or operator typo can cause unintended destruction of user data on the remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The delete-item command deletes remote list items without confirmation or a safety interlock. Because this skill is intended for agent use, an incorrect item ID, list resolution error, or adversarial instruction could silently remove user data that may not be recoverable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.