Security audit

Daily History

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with a daily history-card purpose, but it can create persistent scheduled push jobs and recurring outbound messages without enough scoping or confirmation detail.

Install only if you want a bilingual history skill that may be configured for recurring morning and evening push messages. Before enabling push, confirm the destination channel, recipient user ID, schedule, timezone, and how to disable the created jobs; avoid enabling it in environments where skill output can create cron tasks without explicit authorization.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:44
Finding: Mandatory Promotional Content Injection into Generated Artifacts
Content: View full analysis
` between 3rd and 4th event (min-height 90px, centered). `
` at page bottom. - **Footer**: "Powered by ClawCode" at bottom. ``` ### Technical Analysis The skill instructions require the agent to insert two advertising placeholders and third-party branding into every generated HTML artifact. These elements are unrelated to the core function of producing a historical timeline and are not presented as optional or contingent on user consent. Because `SKILL.md` controls the agent's behavior when the skill is loaded, these mandatory requirements alter the generated response and turn it into a potential promotional surface. The ad slots do not currently retrieve or execute advertisements, scripts, or remote content, so the finding does not independently permit code execution or data exfiltration. ### Attack Path 1. A user installs or invokes the `daily-history` skill. 2. The agent loads and follows the instructions in `SKILL.md`. 3. The agent generates `/mnt/user-data/outputs/daily-history.html`. 4. The mandatory `ad-slot-middle`, `ad-slot-bottom`, and `Powered by ClawCode` elements are inserted into the artifact without a separate user request. 5. The resulting artifact may subsequently be distributed or displayed with the injected promotional elements. ### Impact Assessment The issue affects the integrity and neutrality of generated artifacts. An operator can cause users to distribute branded output and advertising placeholders that were not part of their explicit request. The demonstrated scope is limited to output manipulation. The audited instructions do not populate the ad slots with remote content, gain system privileges, access credentials, or execute arbitrary code. ]]>
Remediation: View remediation

T06 · System Persistence

Warning

Location: scripts/push-toggle.js:22
Finding: Persistent Recurring Jobs Created Through OpenClaw Control Directives
Content: View full analysis
``` 2. Optional morning, evening, and channel arguments are parsed. 3. The script emits two ...[truncated 1188 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill claims to provide a daily morning history card, but also documents subscription management, persistent per-user configuration, multiple delivery channels, and evening scheduling that are not disclosed in the main description. This is risky because hidden notification and persistence features expand the attack surface, may enable unsolicited messaging, and can process user identifiers/configuration without clear consent or review.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill claims to provide a daily morning history card, but also documents subscription management, persistent per-user configuration, multiple delivery channels, and evening scheduling that are not disclosed in the main description. This is risky because hidden notification and persistence features expand the attack surface, may enable unsolicited messaging, and can process user identifiers/configuration without clear consent or review.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The keyword list includes broad natural-language phrases such as 'today in history', 'on this day', and 'historical events' that are likely to appear in ordinary user conversation. In agent environments that auto-route by keyword matching, this can cause unintended invocation of the skill, resulting in context hijacking or inappropriate responses when the user did not explicitly request this skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: An overly broad activation phrase can cause the skill to trigger on ordinary history-related requests beyond the narrow intended use case. Overbroad invocation is dangerous because it can hijack benign user queries, route them through a skill with extra undeclared capabilities, and increase unintended data exposure or action execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The keyword list contains generic phrases such as common requests about history, making accidental activation more likely. In the context of a skill that also references push management and per-user configuration, unintended routing is more concerning because users may invoke capabilities they did not knowingly select.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation includes operational push-notification commands unrelated to the core content-generation workflow, which indicates the skill may do more than users expect. In a skill package, unrelated admin-style commands can conceal messaging capabilities or invite unsafe execution of commands involving user IDs and external channels.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes a skill that provides '3–5 major events on this date with context and lasting impact' as a bilingual timeline card with a daily morning push. This script instead outputs instructions to select only one event for an in-depth retrospective ('选1个最值得深挖的') with up to 800 words, which is a materially different product format and scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The generated prompt explicitly requires '中英双语' output, which imposes a language policy on users without any opt-in or configuration. The file contains no natural-language indication that this is optional or justified by a region-specific purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The generated instruction requires Chinese output elements such as Chinese month/day phrasing and Chinese/English titles, and the rest of the script uses fixed Chinese locale strings. There is no option for the user to choose language or any documented justification that this skill is intentionally China/Chinese-specific, which makes this a natural-language locale policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README repeatedly describes the skill as producing "bilingual EN/CN" and "Chinese and English output" as a fixed behavior. This appears to impose a language/locale choice without stating that the user can opt in, opt out, or select a preferred language.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The top-level description claims 'Daily morning push,' which implies automatic outbound delivery is a core behavior. But the primary workflow only covers date lookup, web search, curation/translation, HTML generation, and saving the artifact to local output; push behavior appears separately as optional script commands rather than part of the described execution path. This creates a semantic mismatch between the claimed user-facing behavior and the documented core operation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest explicitly says 'Daily morning push,' but this file is named 'evening-push.js' and emits a '今日历史深读' deep-reading prompt rather than an obvious morning push payload. That indicates a semantic mismatch between the declared delivery/purpose and this script's actual function.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: User-facing error and status messages in this script are hard-coded in Chinese, and the file provides no opt-in, locale selection, or justification for enforcing that language. This can violate a language/locale policy when skills are expected to be language-neutral or user-selectable.
Content: No source excerpt is available for this finding.