Self Improving Domotics

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:02 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed smart-home logging and reminder helper, with optional persistent hooks that users should enable only when they want those reminders.

Install this if you want structured smart-home incident notes and reminder hooks. Keep logs free of lock codes, tokens, network credentials, and personal schedules; enable hooks only intentionally, narrow their matchers, and periodically clean up retained .learnings content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is marketed as diagnosing and improving smart-home issues, but the actual behavior is primarily creating files, suggesting hooks, and scaffolding logging workflows. This mismatch can cause users or agent runtimes to trust it with operational or safety-sensitive automation contexts even though it does not perform the claimed analysis, increasing the chance of unsafe reliance and unintended writes or hook installation.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

Never overwrite existing files. The commands are no-op when already initialised.

Do not log secrets, access tokens, lock PINs, alarm codes, network credentials, or personal household schedules in plain text.

If automatic reminders are needed, enable hook integration (opt-in) in [Hook Integration](#hook-integration).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 534)May include surrounding context.

md

Extracted skills are untrusted until a human reviews the generated `SKILL.md`. Do not keep or publish an extracted skill without explicit user approval.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 557)May include surrounding context.

md

Extracted skills are untrusted until a human reviews the generated `SKILL.md`. Do not keep or publish an extracted skill without explicit user approval.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill includes commands and setup guidance that touch the filesystem, install hooks, and reference external repositories/platform tooling, but it does not declare any explicit tool scope or allowed-tools boundaries. In an agent ecosystem, missing capability declarations can lead to overbroad execution authority and make it harder for hosts or reviewers to enforce least privilege.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The setup instructions create and use persistent state under the user's home directory (~/.openclaw/workspace/.learnings), which can survive across sessions and projects. Persistent storage is not inherently malicious, but in a skill handling operational incidents and household context, long-lived state can accumulate sensitive environmental details and create unintended cross-session data exposure.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

└── .learnings/{LEARNINGS.md, DOMOTICS_ISSUES.md, FEATURE_REQUESTS.md}

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document says hooks must be project-scoped only, but the setup copies hook material into ~/.openclaw/hooks/... and enables persistence across sessions. That contradiction can cause broader-than-intended installation scope, making reminder or detection behavior persist into unrelated projects and increasing the blast radius of any future hook misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The automatic hook matcher includes generic terms like device and automation, which are common across many unrelated tasks. Overbroad trigger conditions can cause the skill to activate in non-domotics contexts, leading to unnecessary prompt interception, noisy reminders, unintended file writes, or cross-context data capture.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The advanced hook example repeats the same broad matcher pattern, so the risk of accidental activation remains even when output detection is enabled. Because PostToolUse hooks can inspect command output, an overbroad trigger increases the chance of unrelated sessions being analyzed or logged under domotics workflows.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill gives earlier instructions to write to flat .learnings/*.md files, then later states that stackable mode must write only to .learnings/domotics/. Conflicting ownership rules create ambiguity about where an agent should write, which can lead to accidental overwrites, bypass of intended isolation between skills, or inconsistent logging behavior in multi-skill environments.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Allowing the skill to read other skill folders for cross-linking introduces an enumeration capability across adjacent skill content. While framed as coordination, cross-skill reads can expose metadata, naming, or internal guidance from other skills that may not need to be visible to this one, weakening isolation assumptions.

Content

Scanner excerpt · SKILL.md (reported line 647)May include surrounding context.

md

### Ownership Rules
- This skill writes only to `.learnings/domotics/` in stackable mode.
- It may read other skill folders for cross-linking, but should not rewrite their entries.
- Standalone mode writes to this project's `.learnings/*.md` log files only.
- Stackable mode writes only to the namespaced folder above and must not rewrite other skills' log entries.
- Promotion into `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `MEMORY.md`, rules, hooks, or generated skills is not a logging write. Show a reviewed diff and apply only after explicit user approval.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 29)May include surrounding context.

Ensure:

bash

mkdir -p ~/.openclaw/workspace/.learnings

Required files:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes a skill that captures and analyzes smart-home automation conflicts, sensor drift, connectivity failures, integration regressions, safety gaps, and energy optimization opportunities. This script does not perform any domotics analysis or issue capture; it only creates a new SKILL.md scaffold on disk for another skill, which is a repository-maintenance capability outside the described operational purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The listed use cases focus on diagnosing automations, sensors, integrations, occupancy, latency, energy, and safety guardrails in a smart-home context. Creating directories and writing markdown scaffold files for new skills is a software-development workflow capability, not an obvious or necessary implementation detail of domotics conflict detection or continuous improvement analysis.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.