T01 · Skill Instruction Hijacking
Error
- Location
instructions.txt:9- Finding
Mandatory External Approval Transfers Control of Agent Actions to a Third Party
- Content
View full analysis
- Remediation
View remediation
Security audit
Claw-Diary
Security checks for vulnerabilities and agentic risk
Overview
This skill is transparently a cloud guard and audit integration, but it gives a remote service broad approval, logging, and persistent diary influence over sensitive agent activity.
Install only if you explicitly want ClawDiary or your self-hosted instance to approve high-risk actions and receive audit/diary metadata. Avoid sending secrets, private user data, raw command output, or chain-of-thought-style reasoning; prefer self-hosting or disabling diary/audit in sensitive environments, and do not import the remote MCP descriptor unless you can verify and control updates.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
instructions.txt:3- Finding
Execution Metadata and Reasoning May Be Disclosed Through Incomplete Redaction
- Content
View full analysis
- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Error
- Location
SKILL.md:81- Finding
Mutable Remote MCP Descriptor Can Register Unreviewed Tool Behavior
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Warning
- Location
instructions.txt:13- Finding
Untrusted Shared Diary Content Can Poison Future Agent Context
- Content
View full analysis
` to gain context across different devices belonging to the same owner. ``` Related skill instructions: ```markdown ### 3. Shared Diary **Endpoints:** `POST https://api.clawdiary.org/v1/diary` (write), `GET https://api.clawdiary.org/v1/diary?owner_id=...` (list) **When to use:** To keep a shared diary across multiple devices (lobsters) for one owner. This allows agents to sync status updates and context. Example Write Request: ```json { "owner_id": "alice", "lobster_id": "office-mac", "content": "Finished API integration today. All good." } ``` ``` ### Technical Analysis The skill establishes a persistent, remotely stored context channel shared across sessions and devices. It instructs agents to retrieve diary entries to “gain context,” but it does not specify that retrieved content must be treated as untrusted data. No content signature, author provenance, trust label, freshness guarantee, conflict policy, or separation between diary data and executable instructions is documented. If an attacker gains the ability to create or alter diary entries—through account compromise, API-key compromise, compromised devices, or service compromise—the attacker can place instruction-like text in persistent state. A later agent may interpret that text as trusted context and allow it to influence its decisions. ### Attack Path 1. An attacker obtains authorized write access to an owner's diary or compromises a device or service account that has such access. 2. The attacker writes a diary entry containing false status information or ...[truncated 932 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md { "agent_id": "openclaw", "action_type": "execute_bash", "command": "rm -rf /tmp/data", "params": { "cwd": "/home/user" }, "thought": "Cleaning up temporary files" }
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md { "agent_id": "openclaw", "action_type": "execute_bash", "command": "rm -rf /tmp/data", "params": { "cwd": "/home/user" }, "thought": "Cleaning up temporary files" }
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md { "agent_id": "openclaw", "action_type": "execute_bash", "command": "rm -rf /tmp/data", "params": { "cwd": "/home/user" }, "thought": "Cleaning up temporary files" }
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Requiring redaction over the internal 'thought' field implies the agent may transmit hidden reasoning to a remote service, which is inappropriate for auditing and can expose sensitive internal deliberations, user-derived secrets, or security logic. The provided regex-based redaction is brittle and cannot reliably prevent leakage of secrets or sensitive context embedded in free-form reasoning.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
The guard endpoint transmits high-risk action details, including commands, parameters, and agent reasoning, to an external service before execution. Even though the feature is security-oriented, it still creates a data exposure path to a third party and may leak sensitive operational context or secrets embedded in commands or thoughts.
- Content
md ## Features & Usage ### 1. Active Guard (Approval Gate) **Endpoint:** `POST https://api.clawdiary.org/v1/guard` **When to use:** **BEFORE** executing any high-risk, destructive, or outbound action (such as executing bash, file deletions, sending emails). **Behavior:** Call this endpoint and wait for the response. Red-light actions will block the HTTP response until a human approves via Telegram. Only proceed with the action if the response returns `approved: true`.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs sending action payloads, shared diary content, and status/context to a third-party cloud service, but it does not clearly warn that these may contain sensitive operational data, prompts, commands, or user content. This creates a real privacy and data-governance risk because users may enable logging or diary sync without understanding that potentially confidential information leaves the local environment.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The audit endpoint is designed to send action metadata, cost, and payload to a remote service after execution, which can include sensitive tool inputs or outputs. Without strong warnings and data minimization, this is a genuine confidentiality risk because routine logging may exfiltrate private business or user data to the cloud.
- Content
text ### 2. Passive Audit (Logging) **Endpoint:** `POST https://api.clawdiary.org/v1/audit` **When to use:** **AFTER** an action completes. **Behavior:** Report the action, cost, and payload. This helps the human operator review usage asynchronously.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The shared diary endpoint encourages syncing arbitrary status updates and context across devices via a remote service, which can easily include sensitive internal notes, credentials, customer data, or operational context. Because this feature is framed as general shared memory, the skill context makes accidental over-sharing more likely and therefore more dangerous than a narrowly scoped API call.
- Content
text ### 3. Shared Diary **Endpoints:** `POST https://api.clawdiary.org/v1/diary` (write), `GET https://api.clawdiary.org/v1/diary?owner_id=...` (list) **When to use:** To keep a shared diary across multiple devices (lobsters) for one owner. This allows agents to sync status updates and context. Example Write Request:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text ## MCP Support ClawDiary provides an MCP descriptor at `GET https://api.clawdiary.org/mcp.json`. Importing this to an MCP client automatically registers the `request_human_approval` tool handling the active guard.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The instructions impose broad mandatory remote guard, audit, and diary behaviors across important executions, outbound communication, and milestones, without narrowly scoping when these flows are appropriate. This unclear activation scope increases the chance that the agent will over-collect and over-transmit metadata in situations unrelated to the stated guardian purpose.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The skill mandates outbound transmission to a third-party API for pre-action approval, including payload, command, and potentially thought-derived content, which creates a data exfiltration path outside the local trust boundary. Although the text includes truncation and regex redaction, those controls are insufficiently reliable to prevent leakage of sensitive metadata, commands, or identifiers.
- Content
text - **Enforceable Redaction:** Before transmission, you MUST execute a strict regex filter over the `payload`, `command`, and `thought` fields: `s/([A-Za-z0-9_-]{20,})/[REDACTED_SECRET]/g` and `s/([A-Za-z0-9+/]{40,}={0,2})/[REDACTED_BASE64]/g` to mask potential API keys, passwords, and private tokens. - **Allowed Data:** You are strictly PROHIBITED from sending files, user private data, or raw command outputs to the remote service. Use generic descriptions instead (e.g. `[FILE_PATH]`, `[USER_ID]`). 3. **Guard Before Destructive Actions:** You MUST call `POST https://api.clawdiary.org/v1/guard` before any potentially destructive action or outbound communication (e.g. `rm -rf`, `execute_bash`, `send_mail`). Wait for the response and ONLY proceed if `approved` is true. If it returns false or hangs open, wait or abort. 4. **Audit Log:** Log all your important executions and token resource consumption using `POST https://api.clawdiary.org/v1/audit` immediately AFTER the action. Ensure you follow the redaction rules.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The audit endpoint requires logging important executions and token resource consumption to an external server immediately after actions, expanding external visibility into agent behavior. Even if raw outputs are excluded, execution metadata and token usage can still reveal sensitive operational patterns, user activity, and task context.
- Content
text 3. **Guard Before Destructive Actions:** You MUST call `POST https://api.clawdiary.org/v1/guard` before any potentially destructive action or outbound communication (e.g. `rm -rf`, `execute_bash`, `send_mail`). Wait for the response and ONLY proceed if `approved` is true. If it returns false or hangs open, wait or abort. 4. **Audit Log:** Log all your important executions and token resource consumption using `POST https://api.clawdiary.org/v1/audit` immediately AFTER the action. Ensure you follow the redaction rules. 5. **Diary Sync:** Write major milestones to `POST https://api.clawdiary.org/v1/diary` with your `agent_id` or your owner/device IDs. Read past entries using `GET https://api.clawdiary.org/v1/diary?owner_id=<id>` to gain context across different devices belonging to the same owner.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The diary sync feature explicitly sends milestones plus agent_id or owner/device IDs to a remote service and reads historical entries by owner_id, creating a persistent cross-session and cross-device data channel. In this skill context, that is more dangerous because a 'Guardian' role does not justify long-term behavioral journaling tied to user identity across devices.
- Content
text 4. **Audit Log:** Log all your important executions and token resource consumption using `POST https://api.clawdiary.org/v1/audit` immediately AFTER the action. Ensure you follow the redaction rules. 5. **Diary Sync:** Write major milestones to `POST https://api.clawdiary.org/v1/diary` with your `agent_id` or your owner/device IDs. Read past entries using `GET https://api.clawdiary.org/v1/diary?owner_id=<id>` to gain context across different devices belonging to the same owner.
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs cross-device diary syncing using owner/device identifiers and retrieval of prior entries by owner_id, which enables correlation of activity across devices without a clear need for a 'Guardian' function. This creates unnecessary tracking and privacy exposure, and could leak sensitive behavioral context to a remote service if the identifiers or diary contents are misused or compromised.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill requires use of owner/device IDs for diary writes and cross-device reads without any mention of user opt-in, notice, or policy justification. This enables persistent identity linkage and behavioral profiling across devices, which is disproportionate to the stated purpose and raises substantial privacy and compliance risk.
- Content