Security audit

Pulse TODO

Security checks for vulnerabilities and agentic risk

Overview

This task-management skill is not malicious, but it asks agents to persist tasks, alter schedules and heartbeat behavior, and scan memory files with too little user control.

Install only if you want an agent to maintain a persistent TODO.md and synchronize reminders with OpenClaw cron. Before use, narrow the trigger phrases, require confirmation before cron or HEARTBEAT.md changes, back up existing TODO.md and HEARTBEAT.md, and allow memory or strategy-file migration only from specific files you approve.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Note

Location: SKILL.md:92
Finding: Overbroad Access to Persistent Agent Strategy and Memory Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:92-96` **Vulnerability Type**: Excessive access to persistent agent state **Risk Level**: Low ### Vulnerable Code ```markdown ### 1. Read your strategic goals Check SOUL.md, MEMORY.md, or wherever your north star / strategic direction is defined. If you don't have one, ask your human: "What's the most important thing we're working toward?" ``` ### Technical Analysis The skill instructs the agent to inspect `SOUL.md`, `MEMORY.md`, or an unspecified alternative location containing strategic direction. This broad instruction does not constrain access to task-specific sections or named, user-approved files. Reading persistent identity and memory files exceeds the minimum access necessary to select an item from `TODO.md`. These files can contain private historical context, operational rules, strategic information, or secrets accidentally stored in agent memory. Loading such content into the active context also makes it available to later instructions and tools used during the same session. The package does not contain code that bypasses operating-system permissions, transmit the information remotely, or elevate system privileges. The risk is therefore limited to excessive use of the agent's existing file-access authority. ### Attack Path 1. A user invokes the skill to determine which task should be handled next. 2. The skill directs the agent to inspect `SOUL.md`, `MEMORY.md`, or another strategy file. 3. The agent reads persistent content unrelated to the requested TODO operation. 4. Sensitive historical or strategic information enters the active model context. 5. That information may influence task selection or be reproduced in subsequent task records or responses. ### Impact Assessment An invocation can expose persistent agent identity, memory, or strategy data to the current execution context. The accessible scope is bounded by the files the hosting agent can already read; this instructio ...[truncated 309 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Use `TODO.md` as the default and exclusive input for task selection. 2. Remove the generic instruction to search `SOUL.md`, `MEMORY.md`, or unspecified strategy locations. 3. If strategic context is necessary, require explicit user approval and identify the precise file and section before reading it. 4. Permit users to supply a dedicated, minimally scoped goals file rather than granting access to general memory. 5. Extract only task-relevant fields and prevent credentials, tokens, personal information, or unrelated historical content from being copied into `TODO.md`. 6. Document which files the skill may read and require confirmation before expanding that allowlist. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

Location: setup.md:30
Finding: Unrestricted Task Migration from Memory and Persistent Scheduler State<![CDATA[ ## Vulnerability Details **File Location**: `setup.md:30-37` **Vulnerability Type**: Excessive access to persistent memory and scheduler configuration **Risk Level**: Low ### Vulnerable Code ```markdown ### 3. Migrate Existing Tasks Scan these sources for tasks that should move into TODO.md: - **Old HEARTBEAT.md** — any checklist items → move to appropriate section - **Cron jobs** (`~/.openclaw/cron/jobs.json`) — add corresponding entries to 🔄 with `cron: <job-name>` attribute - **Memory files** — any "TODO" or "need to do" mentions → add if still relevant - **Old TODO.md** — reformat existing items into the five sections ``` ### Technical Analysis The setup procedure tells the agent to scan memory files without specifying an allowlist, a bounded directory, or a user-approval step. It also reads persistent scheduler configuration from `~/.openclaw/cron/jobs.json` and migrates information into a workspace TODO file. Searching broadly for phrases such as `TODO` or `need to do` can capture unrelated historical notes, private context, or text that merely resembles a task. Copying that content into `TODO.md` changes its audience and persistence characteristics. Scheduler metadata may similarly reveal recurring operational activities that are not required for the current workspace. The documented operation relies on permissions already held by OpenClaw and does not demonstrate an operating-system permission bypass. No remote transmission, executable payload, or hidden persistence mechanism was found. ### Attack Path 1. The user follows the first-time setup or migration procedure. 2. The agent scans old heartbeat data, scheduler configuration, memory files, and an existing TODO file. 3. Broad textual matching identifies content containing `TODO` or `need to do`, including potentially unrelated or sensitive records. 4. The agent copies selected content or scheduler metadata into the workspace `TODO.md`. 5. The migrated information becomes persisten ...[truncated 606 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace broad memory scanning with an explicit allowlist of user-selected files. 2. Require confirmation before reading `~/.openclaw/cron/jobs.json` or any persistent memory source. 3. Show a migration preview and require approval before writing discovered items into `TODO.md`. 4. Parse only clearly designated task sections instead of matching generic phrases across entire files. 5. Redact credentials, tokens, personal information, URLs containing secrets, and unrelated contextual material before migration. 6. Record only the minimum scheduler fields needed for synchronization, such as an approved job name and schedule. 7. Keep memory migration disabled by default and document the exact files and data fields that will be accessed. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger list is extremely broad and includes common conversational phrases like 'remember', 'don't forget', 'what should I do', and 'schedule', which can cause unintended invocation during normal dialogue. In this skill, unintended invocation is risky because the skill is authorized to persist data in TODO.md and drive follow-up automation, so accidental matches can create or alter durable tasks without clear user intent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs the agent to immediately modify TODO.md and create, update, or delete cron jobs, but it does not require transparent user notice or confirmation for these persistent side effects. Because cron jobs and task files outlive the current conversation and can trigger future automated actions, silent persistence can surprise users, create unwanted reminders, or be abused through prompt-triggered state changes.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The setup instructions direct the agent/user to create or replace `TODO.md` in the workspace and to merge existing tasks, but they do not include safeguards such as backup, confirmation, or explicit warnings about possible overwrite or data-loss risks. In an agent context, filesystem-modifying instructions without consent checks can alter user state unexpectedly or destroy task data if followed automatically.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instructions tell the operator/agent to remove items from `HEARTBEAT.md` and replace existing workflow logic with a single line, but they do not warn that this changes runtime behavior and may disable existing checks or automations. In a heartbeat-driven agent system, silent modification of scheduler/configuration files can disrupt monitoring, task execution, or user-customized workflows.

Natural-Language Policy Violations

Low

Confidence: 96% confidence
Finding: The instructional content in this template is entirely in Chinese, which imposes a specific language on users without offering any language or locale choice. The policy explicitly flags language-forcing behavior as a natural-language policy violation unless the locale constraint is documented and justified.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The prescribed TODO structure requires section headings in Chinese (`有人在等我`, `有 deadline`, `承诺了要做`, `有空就做`, `定时任务`) without offering a language choice. This can violate language/locale policy because the skill dictates a specific language format rather than letting the user opt in or choose an alternative.

Static analysis

No suspicious patterns detected.