Security audit

Pulse TODO

Security checks for vulnerabilities and agentic risk

Overview

This task-management skill is not malicious, but it asks agents to persist tasks, alter schedules and heartbeat behavior, and scan memory files with too little user control.

Install only if you want an agent to maintain a persistent TODO.md and synchronize reminders with OpenClaw cron. Before use, narrow the trigger phrases, require confirmation before cron or HEARTBEAT.md changes, back up existing TODO.md and HEARTBEAT.md, and allow memory or strategy-file migration only from specific files you approve.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Note

Location: SKILL.md:92
Finding: Overbroad Access to Persistent Agent Strategy and Memory Files
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

Location: setup.md:30
Finding: Unrestricted Task Migration from Memory and Persistent Scheduler State
Content: View full analysis
` attribute - **Memory files** — any "TODO" or "need to do" mentions → add if still relevant - **Old TODO.md** — reformat existing items into the five sections ``` ### Technical Analysis The setup procedure tells the agent to scan memory files without specifying an allowlist, a bounded directory, or a user-approval step. It also reads persistent scheduler configuration from `~/.openclaw/cron/jobs.json` and migrates information into a workspace TODO file. Searching broadly for phrases such as `TODO` or `need to do` can capture unrelated historical notes, private context, or text that merely resembles a task. Copying that content into `TODO.md` changes its audience and persistence characteristics. Scheduler metadata may similarly reveal recurring operational activities that are not required for the current workspace. The documented operation relies on permissions already held by OpenClaw and does not demonstrate an operating-system permission bypass. No remote transmission, executable payload, or hidden persistence mechanism was found. ### Attack Path 1. The user follows the first-time setup or migration procedure. 2. The agent scans old heartbeat data, scheduler configuration, memory files, and an existing TODO file. 3. Broad textual matching identifies content containing `TODO` or `need to do`, including potentially unrelated or sensitive records. 4. The agent copies selected content or scheduler metadata into the workspace `TODO.md`. 5. The migrated information becomes persisten ...[truncated 606 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list is extremely broad and includes common conversational phrases like 'remember', 'don't forget', 'what should I do', and 'schedule', which can cause unintended invocation during normal dialogue. In this skill, unintended invocation is risky because the skill is authorized to persist data in TODO.md and drive follow-up automation, so accidental matches can create or alter durable tasks without clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to immediately modify TODO.md and create, update, or delete cron jobs, but it does not require transparent user notice or confirmation for these persistent side effects. Because cron jobs and task files outlive the current conversation and can trigger future automated actions, silent persistence can surprise users, create unwanted reminders, or be abused through prompt-triggered state changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The setup instructions direct the agent/user to create or replace TODO.md in the workspace and to merge existing tasks, but they do not include safeguards such as backup, confirmation, or explicit warnings about possible overwrite or data-loss risks. In an agent context, filesystem-modifying instructions without consent checks can alter user state unexpectedly or destroy task data if followed automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions tell the operator/agent to remove items from HEARTBEAT.md and replace existing workflow logic with a single line, but they do not warn that this changes runtime behavior and may disable existing checks or automations. In a heartbeat-driven agent system, silent modification of scheduler/configuration files can disrupt monitoring, task execution, or user-customized workflows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instructional content in this template is entirely in Chinese, which imposes a specific language on users without offering any language or locale choice. The policy explicitly flags language-forcing behavior as a natural-language policy violation unless the locale constraint is documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The prescribed TODO structure requires section headings in Chinese (有人在等我, 有 deadline, 承诺了要做, 有空就做, 定时任务) without offering a language choice. This can violate language/locale policy because the skill dictates a specific language format rather than letting the user opt in or choose an alternative.
Content: No source excerpt is available for this finding.