Security audit

RetainCraft — FSRS-5 Spaced Repetition AI Learning Tutor

Security checks for vulnerabilities and agentic risk

Overview

RetainCraft is a coherent learning assistant, but it warrants review because it can create persistent OpenClaw reminders and infer messaging targets from session metadata.

Review the reminder behavior before installing. This skill stores study progress under ~/learn, uses web search for tutoring and fact-checking, and can set persistent daily and weekly OpenClaw reminders using detected messaging targets. Install only if you are comfortable with that storage, search exposure, and scheduled notification behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
md
python3 scripts/srs.py record-test <topic> <total> <correct>

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.
md
python3 scripts/srs.py record-test <topic> <total> <correct>

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
md
python3 scripts/srs.py record-test <topic> <total> <correct>

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.
md
python3 scripts/srs.py record-test <topic> <total> <correct>

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.
md
python3 scripts/srs.py record-test <topic> <total> <correct>

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.
md
python3 scripts/srs.py record-test <topic> <total> <correct>

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.
md
python3 scripts/srs.py record-test <topic> <total> <correct>

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 370)May include surrounding context.
md
python3 scripts/srs.py record-test <topic> <total> <correct>

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 371)May include surrounding context.
md
python3 scripts/srs.py record-test <topic> <total> <correct>

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 395)May include surrounding context.
md
python3 scripts/srs.py record-test <topic> <total> <correct>

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 396)May include surrounding context.
md
python3 scripts/srs.py record-test <topic> <total> <correct>

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 468)May include surrounding context.
md
python3 scripts/srs.py record-test <topic> <total> <correct>

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to perform file read/write operations under ~/learn/, execute Python scripts, use web search, and interact with platform reminder mechanisms, but it does not declare a formal tool scope such as permissions or allowed-tools in the skill manifest. This creates a mismatch between documented behavior and enforceable policy, increasing the risk that a host agent grants broader capabilities than intended or that users are not clearly protected by platform-level restrictions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The JSON templates use Chinese for names and instructional prompts throughout, which imposes a specific language/locale in natural-language content. There is no indication that users may choose another language or that the file is intentionally limited to a Chinese-only regional context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The workflow specifies confirmations such as replying "我同意" and "继续" and the full operational guidance is written only in Chinese. This can amount to a language/locale policy issue if the skill forces a specific language without explicit user opt-in or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow mandates automatic web searches using user goals and topics during planning, but does not warn that those prompts may be transmitted to external services. If users study sensitive subjects such as medical conditions, legal issues, exams, or career transitions, this can leak personal intent and contextual data to third parties.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes a local evidence-based learning assistant centered on FSRS-5/SM-2, active recall, and reports, but this document requires web_search and even web_fetch before answering almost any knowledge question, generating tests, planning paths, or recommending resources. That turns the skill into a general web-research and content-verification agent, a materially broader behavior than the manifest advertises.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document directs the assistant to update persistent memory systems automatically at the end of learning interactions, but does not present a user-facing warning or consent step for storing learning history and profile data. This creates a privacy vulnerability because users may unknowingly disclose sensitive interests, deficiencies, schedules, and performance records into durable storage.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire skill file is written as Chinese-only operational content and examples, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: append_learning_log flattens the supplied details into each log entry, and cmd_rate writes concept and rating as top-level fields. However, cmd_optimize_params documents and implements extraction via entry.get("details", {}), causing the stated use of review history for rating distribution and per-concept histories to diverge from what the code actually reads.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill's declared purpose is local spaced-repetition learning, but this section adds external cron management and delivery-target handling, which materially expands its authority and persistence. Capability mismatch is dangerous in agent skills because users may grant trust based on the benign description while the code can establish ongoing scheduled behaviors outside the core learning function.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/srs.py (reported line 2238)May include surrounding context.
python
setup-reminder falls back to REMINDER_REQUIRED output. """ try: result = subprocess.run( ["openclaw", "--version"], capture_output=True, text=True, timeout=5 )

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/srs.py (reported line 2258)May include surrounding context.
python
True if the cron job exists, False otherwise """ try: result = subprocess.run( ["openclaw", "cron", "list", "--json"], capture_output=True, text=True,

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The code inspects OpenClaw session metadata and extracts channel/chat IDs from session keys, which is a form of metadata harvesting not obviously necessary for spaced repetition. In a multi-platform agent ecosystem, this can expose communication endpoints and enable later redirection of messages or reminders without the user manually specifying a destination.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 75% confidence
Finding: The code queries openclaw sessions --json and parses session keys to recover channel provider and chat IDs, exposing messaging metadata beyond what a local study scheduler strictly needs. In an agent-skill context, harvesting delivery targets increases the blast radius of the skill because it can silently learn where to send messages and later reconfigure reminders to those targets.
Content: Scanner excerpt · scripts/srs.py (reported line 2294)May include surrounding context.
python
in isolated sessions when multiple channels are configured. """ try: result = subprocess.run( ["openclaw", "sessions", "--json"], capture_output=True, text=True,

Static analysis

No suspicious patterns detected.