ClawHub
Back to skill

Security audit

Familysearch

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it helps with genealogy using FamilySearch or local GEDCOM files, with some privacy cautions around family-history data and OAuth tokens.

Install only if you are comfortable using FamilySearch and handling family-history data through this skill. Prefer offline GEDCOM mode for private research, and use API mode only when you intend to send names, dates, places, or person IDs to FamilySearch. Store only OAuth tokens, not usernames or passwords, and avoid including sensitive details about living people unless necessary.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (13)

Tainted flow: 'req' from os.environ.get (line 47, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
"Accept": accept,
    })
    try:
        with urllib.request.urlopen(req) as resp:
            return json.loads(resp.read())
    except urllib.error.HTTPError as e:
        print(f"HTTP {e.code}: {e.reason}", file=sys.stderr)
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Credential Access

High
Category
Privilege Escalation
Content
os: [macos, linux]
credentials:
  - name: FamilySearch OAuth Token
    description: OAuth 2.0 access token for FamilySearch API (required for API mode only; GEDCOM mode works offline)
    required: false
bins:
  - python3
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
os: [macos, linux]
credentials:
  - name: FamilySearch OAuth Token
    description: OAuth 2.0 access token for FamilySearch API (required for API mode only; GEDCOM mode works offline)
    required: false
bins:
  - python3
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
1. **FamilySearch Account** — Free at <https://www.familysearch.org>
2. **Developer App Key** — Register at <https://www.familysearch.org/developers/>
3. **OAuth 2.0 Access Token** — Via authentication flow below

Store credentials:
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
"""Retrieve FamilySearch access token. Checks (in order):
    1. --token CLI arg (via FAMILYSEARCH_TOKEN_ARG, set by caller)
    2. FAMILYSEARCH_TOKEN environment variable
    3. macOS Keychain (if 'security' binary available)
    """
    import os, shutil
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
"""Retrieve FamilySearch access token. Checks (in order):
    1. --token CLI arg (via FAMILYSEARCH_TOKEN_ARG, set by caller)
    2. FAMILYSEARCH_TOKEN environment variable
    3. macOS Keychain (if 'security' binary available)
    """
    import os, shutil
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
"""Retrieve FamilySearch access token. Checks (in order):
    1. --token CLI arg (via FAMILYSEARCH_TOKEN_ARG, set by caller)
    2. FAMILYSEARCH_TOKEN environment variable
    3. macOS Keychain (if 'security' binary available)
    """
    import os, shutil
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list includes broad phrases like "family tree" and "genealogy," which can cause the skill to activate in situations where the user did not intend to invoke external genealogy tooling or process sensitive family-history data. Over-broad invocation increases the chance of unintended data exposure or unnecessary prompting for credentials/files.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill handles highly sensitive family-history information and can transmit it to FamilySearch in live API mode, but it does not clearly warn users about that distinction. Without an explicit privacy notice and consent step, users may unknowingly share personal or familial data with a third party.

External Transmission

Medium
Category
Data Exfiltration
Content
2. User logs in, grants access
3. Exchange code for token:
```bash
curl -X POST "https://ident.familysearch.org/cis-web/oauth2/v3/token" \
  -d "grant_type=authorization_code&code={AUTH_CODE}&client_id={APP_KEY}"
```
4. Store returned `access_token` in Keychain
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# 2. macOS Keychain fallback
    if shutil.which("security"):
        try:
            result = subprocess.run(
                ["security", "find-generic-password", "-a", "familysearch-token",
                 "-s", "openclaw-familysearch-token", "-w"],
                capture_output=True, text=True, check=True
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This code makes authenticated HTTP requests to the FamilySearch API and sends user-supplied search terms and person identifiers over the network, but there is no confirmation prompt or explicit user-facing warning about transmitting potentially sensitive family-history data. Although the module docstring describes API helper behavior, it does not disclose the privacy impact of sending personal data to an external service.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
This code reads a GEDCOM file and outputs personally sensitive genealogical details such as full names, sex, birth dates/places, death details, and family relationships. While the file purpose is genealogical querying, there is no user-facing warning, comment, or docstring disclosing that potentially sensitive personal data from the supplied file will be displayed in clear text.

Static analysis

No suspicious patterns detected.