Security audit

PV_38

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to track viral topics, but it also directs the agent to automatically save user preferences and decisions across sessions without clear consent or controls.

Review this before installing if you do not want the agent to keep cross-session memory. Use it only if you are comfortable with local storage of preferences and decisions, and avoid sharing sensitive personal, financial, health, credential, or confidential information unless the publisher adds opt-in, review, deletion, and disable controls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The documented functionality materially exceeds the stated purpose of a hot-topic/viral-following skill by introducing persistent local storage of user preferences, decisions, and other session-derived data. This creates an unjustified data collection surface and increases privacy and compliance risk, especially because the memory system is framed as automatic and always-on.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Automatically persisting user preferences, decisions, and session context is not necessary for a skill whose stated role is tracking trends and following viral content. Collecting and retaining extra user data without a clear functional need violates data minimization principles and can expose sensitive behavioral information if the local store is accessed by other users or processes.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill advertises persistent memory capability but does not provide a clear warning that user information will be written to local disk under ~/.openclaw/pv_palace/. Users may reasonably assume conversational context is ephemeral, so silent disk persistence can lead to unexpected privacy exposure and policy violations.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The automatic workflow instructs storing user preferences and important decisions without confirmation or a privacy notice at the point of collection. This makes it likely that personally sensitive information will be saved implicitly, which is especially risky across sessions because the user may not realize the data remains available later.

Ssd 3

Medium

Confidence: 95% confidence
Finding: An instruction that the digital worker automatically remembers user preferences, decisions, and important information across sessions establishes persistent retention without any apparent sensitivity gating. Because user conversations often contain confidential or regulated data, automatic long-term retention increases the chance of storing secrets or personal information that should not be kept.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The workflow explicitly directs the agent to store user preferences and decisions automatically, with no checks for sensitivity, necessity, or consent. In context, this is more dangerous because the skill's core purpose does not require such retention, making the data collection disproportionate and likely to capture unnecessary personal information.

Static analysis

No suspicious patterns detected.