Daily Notes

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:57 AM UTC
• Version: 1.2.0

Overview

This note-taking skill is local and not malicious, but it tells the agent to automatically save ordinary personal messages, which needs careful review before installation.

Install only if you want a journaling skill that may automatically save casual thoughts and image references locally. Avoid using it for private, credential, medical, financial, or identity information unless you are comfortable with raw local retention, and prefer a version that requires explicit confirmation before saving or deleting notes and images.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:34

Finding

Automatic Persistent Capture of Ordinary User Messages

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:34
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Instruction

markdown

Any user message, regardless of whether it has a clear purpose, should be treated as worth recording.

Technical Analysis

The skill instructs the hosting agent to treat ordinary user messages as content that should be recorded, even when the user has not explicitly requested note creation. This changes the agent's default behavior from responding to conversation to persistently capturing it.

The surrounding operational instructions specify that note content is appended to ~/.openclaw/workspace/notes-data/notes.json and that original statements should be preserved. When the host follows these instructions, casual messages can therefore become persistent records without informed, per-message consent.

The Python module does not itself implement automatic capture; the behavior is delegated to the agent through SKILL.md. Nevertheless, instruction-driven behavior is part of the skill's effective execution model.

Attack Path

1. The daily-notes skill is loaded into an agent session.
2. A user sends an ordinary message that does not explicitly request note creation.
3. The quoted instruction causes the agent to classify the message as worth recording.
4. Following the documented record operation, the agent stores the message and inferred metadata in ~/.openclaw/workspace/notes-data/notes.json.
5. The captured content persists across sessions until it is deleted or archived.

This path does not require code execution, elevated system privileges, or network access; it relies on the host agent obeying the skill instructions.

Impact Assessment

The affected scope is the user's local notes workspace and any conversation content available to the agent while the skill is active. Potentially sensitive thoughts, health details, financial ...[truncated 376 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction that treats every user message as recordable by default.
2. Require an explicit note-taking command or an affirmative confirmation before each persistent write.
3. Clearly disclose the destination file and the categories of metadata that will be stored.
4. Add a sensitivity check for health, financial, credential, identity, and other private information, and require additional confirmation before storing such content.
5. Provide configurable retention limits and straightforward review, export, and deletion controls.
6. Default to no persistence when user intent is ambiguous.
7. Require confirmation before permanent deletion of notes or associated images.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list includes extremely common words and phrases such as 'note', 'record', 'idea', 'thought', and broad Chinese equivalents, which makes accidental invocation likely during ordinary conversation. In the context of a note-taking skill that persists data to disk, overbroad activation creates a real risk of unintended collection and storage of user content without clear consent.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The proactive capture rule explicitly states that any user message without a clear task purpose should be treated as worth recording, and that thoughts, feelings, and intentions should be automatically stored. This is dangerous because it turns ordinary conversational content into persistent records by default, greatly increasing the chance of privacy-invasive collection beyond user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill behavior causes messages to be written persistently to notes.json, but the user-facing description and capture flow do not prominently warn that conversational content may be stored on disk automatically. Because the stored data includes thoughts, feelings, intentions, and image associations, the lack of disclosure materially increases privacy and consent risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to retain essentially all non-task utterances, including personal thoughts, feelings, and intentions. This creates a broad surveillance-like persistence mechanism that can capture sensitive personal data far beyond what is necessary for the feature, especially because the storage is automatic rather than user-directed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The delete operation states that associated images may be deleted with the note, but there is no clear user warning or confirmation requirement around this potentially irreversible data loss. In a skill that supports multi-image attachment, users may reasonably expect note deletion and file deletion to be separate actions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction to preserve the user's original content faithfully increases the risk that sensitive or regulated information will be stored verbatim, including secrets, personal identifiers, health details, or financial information. In a persistent note system, raw-content retention without minimization or sanitization meaningfully raises exposure risk if the data is later accessed, synced, or mishandled.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The only user-facing instruction string is written in Chinese and indicates the skill should operate according to SKILL.md rules, but there is no indication that the user can choose another language or that the skill is intentionally region-specific. This is a natural-language locale policy concern because it imposes a specific language by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

The file states that triggers are available in both Chinese and English, effectively broadening activation across languages by default. While not inherently unsafe, this is a language-policy concern because it expands behavior without documenting user choice or preference controls.

Content

No source excerpt is available for this finding.