Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to do what it says: fetch public English Wikipedia trivia, store a local cache and preferences, and optionally set up scheduled delivery.
Install this if you want English Wikipedia DYK facts and are comfortable with the skill keeping local cache/preferences in ~/.openclaw. If you enable automatic delivery or preferences, it may create OpenClaw cron jobs for message delivery and background refresh; review and remove those schedules if you no longer want recurring facts.
Beyond fetching facts, the skill accepts external JSON/file input for tag enrichment and writes tags back into a local cache, which is materially different from the declared read-only trivia behavior. Hidden state mutation and input-processing logic expand the attack surface and make downstream behavior harder to audit.
Beyond fetching facts, the skill accepts external JSON/file input for tag enrichment and writes tags back into a local cache, which is materially different from the declared read-only trivia behavior. Hidden state mutation and input-processing logic expand the attack surface and make downstream behavior harder to audit.
The skill performs file reads/writes, network fetching, and scheduling-related actions but does not declare any explicit tool scope or permissions boundary. That makes the real capability surface larger than the manifest suggests, increasing the chance that an agent or reviewer will authorize the skill without understanding that it can access local state and external resources.
The description explicitly states that the skill fetches English Wikipedia's 'Did you know?' facts, which imposes a language choice in the skill behavior. The file does not indicate that users can choose another language or explicitly opt into English-only content.
The invocation guidance says to use this skill when the user asks for an interesting fact, wants daily trivia delivered automatically, or wants to customise which kinds of facts they see. Phrases like 'interesting fact' and 'customise which kinds of facts they see' are broad natural-language intents that can overlap with many general conversations, and the file does not give exclusion conditions or narrower trigger constraints.
The skill instructs the agent to inspect session context for platform and chat ID and then create scheduled jobs that message that destination. Accessing contextual identifiers and automating outbound delivery goes beyond a narrow fact-fetching role and could be abused to send unwanted messages or persist behavior the user did not fully understand.
The manifest says the skill fetches English Wikipedia DYK facts, caches them locally, and serves them one at a time. The refresh workflow adds a separate content-classification pipeline using local vocabularies and temp files to annotate facts, which is an additional capability not disclosed in the stated purpose.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Fetches the latest hooks from Wikipedia and appends them to `~/.openclaw/dyk-facts.json` with `"tags": null`. No-op if a refresh isn't due yet. If it exits non-zero, stop and report the error.
## Write tags to the cache
Tagging is a two-step process: the agent reads the untagged hooks and assigns tags itself, then writes the results to a temporary JSON file and applies them to the cache using:
This code performs a file write via save_store(store), which changes persisted skill data. Although the module docstring says it merges tags into the cache, there is no user-facing print/log message, confirmation prompt, or inline warning near the write operation to disclose that the local store will be modified.
No suspicious patterns detected.