ClawHub
Back to skill

Security audit

Study Buddy

Security checks for vulnerabilities and agentic risk

Overview

This study skill stores flashcards and review progress locally as expected, with no evidence of hidden execution, exfiltration, or system-level persistence.

Install only if you are comfortable with generated flashcards and review history being stored on this machine in ~/.openclaw/study-buddy/decks/. Avoid using it for highly sensitive notes on shared systems, and be deliberate when importing deck files or deleting decks.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill claims to be an interactive study assistant for notes, PDFs, photos, text, and URLs, but the documented behavior includes persistent local storage, arbitrary import/export paths, and deck deletion. This mismatch can mislead users and reviewers about the real capabilities of the skill, hiding higher-risk file operations that could expose, overwrite, import, or delete local data.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill documents filesystem write operations via `scripts/deck_manager.py` but does not declare any explicit tool scope or permissions boundary. This increases the chance the skill can write persistent data without clear authorization controls, making accidental or unauthorized local data modification more likely.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The trigger phrases are broad enough to match ordinary conversation such as 'study', 'review', or 'help me memorize', which can cause the skill to activate unexpectedly. In this skill's context, unintended activation is more dangerous because it can lead to persistent storage actions or file-management operations being surfaced without the user intentionally invoking this specific capability.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill states that decks, cards, and review history are stored locally in `~/.openclaw/study-buddy/decks/` but provides no user-facing warning about retention. Users may supply sensitive study materials or personal notes without realizing they will persist on disk, creating privacy and confidentiality risks, especially on shared systems.

Static analysis

No suspicious patterns detected.