other
Error
- Location
SKILL.md:11- Finding
Automatic External Disclosure of Personal and Business Information Without Per-Item Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
Deepvista Openclaw
Security checks for vulnerabilities and agentic risk
Overview
This skill openly saves conversation content to an external DeepVista knowledge base, but it does so automatically for broad personal and business categories without clear user consent or review.
Review before installing. This skill may be useful only if you deliberately want automatic DeepVista memory capture, but you should treat it as able to store personal, meeting, relationship, planning, and business-strategy details externally. Prefer a version that requires explicit opt-in and per-note confirmation, never asks for authentication codes in chat, and documents safe CLI invocation without shell interpolation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:36- Finding
Shell Command Injection Through Unsafely Interpolated Conversation Content
- Content
View full analysis
" ``` For longer structured content (meeting notes, analyses, multi-point insights): ```bash deepvista notes create --title "" --content "<markdown content>" ``` ``` ### Technical Analysis The documented command templates place text derived from conversations directly inside shell command arguments. Enclosing attacker-controlled input in double quotes is not sufficient shell escaping. In common shells, double-quoted strings still permit command substitution using `$(...)` or backticks. Embedded quotation marks can also terminate the intended argument and introduce additional shell syntax if the command is assembled as a string. Consequently, an agent or integration that follows these templates through a shell may execute conversation-supplied syntax before or alongside the intended `deepvista` command. The risk is increased by the skill's direction to preserve the user's original wording, since potentially dangerous metacharacters may be retained. The vulnerability applies when the command is executed through a shell after textual interpolation. It can be avoided if the implementation invokes the executable directly with a properly separated argument array and no shell evaluation, but the skill does not require that safe execution model. ### Attack Path 1. An attacker provides a statement that appears eligible for automatic capture. 2. The statement contains shell syntax, such as command substitution, backticks, an embedded quote, or shell control operators. 3. The agent preserves the supplied wording and substitutes it for `<text>`, `<title>`, or `<markdown content>`. 4. The resulting command string is passed to a shell. 5. The shell evaluates the injected syntax while pro ...[truncated 1040 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:70- Finding
Authentication Code Requested Through the Conversation Channel
- Content
View full analysis
DeepVista auth expired. Please run: `deepvista auth login` and share the code. ``` ### Technical Analysis The skill instructs the user to share a code produced by an authentication flow in the conversation. It does not establish that the code is non-sensitive, explain its purpose, constrain how the agent may use it, or prevent it from being retained in chat logs or external notes. Login, device-verification, authorization, and recovery codes should be treated as sensitive unless the authentication protocol explicitly guarantees otherwise. Such codes may temporarily authorize a session or account. Transmitting them through an agent conversation unnecessarily expands the number of systems and people that may access the authentication material. This instruction also conflicts with the skill's stated prohibition on capturing tokens and secrets: asking for the code places potentially sensitive authentication material into the conversation before any reliable protection or classification can be applied. ### Attack Path 1. The DeepVista authentication token expires. 2. The agent follows the skill and asks the user to run `deepvista auth login` and share the resulting code. 3. The user pastes the authentication or verification code into the conversation. 4. The code is retained in chat history, telemetry, logs, or other systems that process the conversation. 5. A party with access to the conversation may use the code during its validity period, depending on the DeepVista authentication protocol. 6. If the code is accidentally classified as capturable content, it may also be persisted beyond the immediate authentication exchange. ### Impact Assessment If the requested value is an authorization-capable login or device code, misu ...[truncated 521 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill advertises broad, automatic capture whenever a user shares facts about themselves, work, decisions, or plans, which creates an overbroad trigger for sending conversational content to an external system. In a chat agent context, this makes accidental collection and disclosure of sensitive personal or business information very likely, especially because the categories are expansive and normal conversation will frequently match them.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill instructs the agent to automatically transmit user conversation content to DeepVista without a user-facing privacy notice or consent flow. This creates a direct data exfiltration path from conversation context to an external knowledge base, where users may not reasonably expect persistence, sharing, or later retrieval.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Automatically capturing personal and professional information to an external store without confirmation is a natural-language data leakage vulnerability. Users often reveal sensitive facts incidentally during conversation, and this instruction causes those disclosures to be persisted and transmitted without validating sensitivity, necessity, or permission.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The listed 'ALWAYS capture' categories include broad classes of potentially sensitive information such as relationships, plans, meeting highlights, strategy decisions, and important dates. In this skill's context, those categories substantially increase danger because they normalize persistent logging of exactly the kinds of personal and organizational data that can cause privacy, confidentiality, and competitive harm if stored or later accessed improperly.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
The instruction to save information 'without asking for confirmation' gives the agent autonomous authority to make privacy-impacting decisions on the user's behalf. While autonomy alone is not always unsafe, here it directly governs external data transfer and persistence, making mistakes or overcollection materially harmful.
- Content
md ## Overview This skill enables automatic knowledge capture from OpenClaw conversations into DeepVista. When the user shares notable information during a conversation, save it to DeepVista without asking for confirmation. ## Prerequisites
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The 'no confirmation needed' rule removes a key human checkpoint for broad categories of user information. In the context of a memory/knowledge-base integration skill, that autonomy materially increases the chance of privacy violations, inaccurate records, and storage of confidential content that the user did not intend to persist.
- Content
md ## Auto-Capture Rules ### ALWAYS capture (no confirmation needed): - Personal or professional facts: role, company, team, background - Decisions made or conclusions reached