ClawHub
Back to skill

Security audit

Familysearch

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it helps with genealogy using FamilySearch or local GEDCOM files, with some privacy cautions around family-history data and OAuth tokens.

Install only if you are comfortable using FamilySearch and handling family-history data through this skill. Prefer offline GEDCOM mode for private research, and use API mode only when you intend to send names, dates, places, or person IDs to FamilySearch. Store only OAuth tokens, not usernames or passwords, and avoid including sensitive details about living people unless necessary.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (13)

Tainted flow: 'req' from os.environ.get (line 47, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/familysearch.py (reported line 52)May include surrounding context.

python
"Accept": accept,
    })
    try:
        with urllib.request.urlopen(req) as resp:
            return json.loads(resp.read())
    except urllib.error.HTTPError as e:
        print(f"HTTP {e.code}: {e.reason}", file=sys.stderr)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md
os: [macos, linux]
credentials:
  - name: FamilySearch OAuth Token
    description: OAuth 2.0 access token for FamilySearch API (required for API mode only; GEDCOM mode works offline)
    required: false
bins:
  - python3

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/familysearch.py (reported line 12)May include surrounding context.

python
os: [macos, linux]
credentials:
  - name: FamilySearch OAuth Token
    description: OAuth 2.0 access token for FamilySearch API (required for API mode only; GEDCOM mode works offline)
    required: false
bins:
  - python3

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
1. **FamilySearch Account** — Free at <https://www.familysearch.org>
2. **Developer App Key** — Register at <https://www.familysearch.org/developers/>
3. **OAuth 2.0 Access Token** — Via authentication flow below

Store credentials:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/familysearch.py (reported line 15)May include surrounding context.

python
"""Retrieve FamilySearch access token. Checks (in order):
    1. --token CLI arg (via FAMILYSEARCH_TOKEN_ARG, set by caller)
    2. FAMILYSEARCH_TOKEN environment variable
    3. macOS Keychain (if 'security' binary available)
    """
    import os, shutil

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/familysearch.py (reported line 24)May include surrounding context.

python
"""Retrieve FamilySearch access token. Checks (in order):
    1. --token CLI arg (via FAMILYSEARCH_TOKEN_ARG, set by caller)
    2. FAMILYSEARCH_TOKEN environment variable
    3. macOS Keychain (if 'security' binary available)
    """
    import os, shutil

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/familysearch.py (reported line 57)May include surrounding context.

python
"""Retrieve FamilySearch access token. Checks (in order):
    1. --token CLI arg (via FAMILYSEARCH_TOKEN_ARG, set by caller)
    2. FAMILYSEARCH_TOKEN environment variable
    3. macOS Keychain (if 'security' binary available)
    """
    import os, shutil

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger list includes broad phrases like "family tree" and "genealogy," which can cause the skill to activate in situations where the user did not intend to invoke external genealogy tooling or process sensitive family-history data. Over-broad invocation increases the chance of unintended data exposure or unnecessary prompting for credentials/files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill handles highly sensitive family-history information and can transmit it to FamilySearch in live API mode, but it does not clearly warn users about that distinction. Without an explicit privacy notice and consent step, users may unknowingly share personal or familial data with a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

  1. User logs in, grants access
  2. Exchange code for token:
bash
curl -X POST "https://ident.familysearch.org/cis-web/oauth2/v3/token" \
  -d "grant_type=authorization_code&code={AUTH_CODE}&client_id={APP_KEY}"
  1. Store returned access_token in Keychain

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/familysearch.py (reported line 27)May include surrounding context.

python
# 2. macOS Keychain fallback
    if shutil.which("security"):
        try:
            result = subprocess.run(
                ["security", "find-generic-password", "-a", "familysearch-token",
                 "-s", "openclaw-familysearch-token", "-w"],
                capture_output=True, text=True, check=True

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code makes authenticated HTTP requests to the FamilySearch API and sends user-supplied search terms and person identifiers over the network, but there is no confirmation prompt or explicit user-facing warning about transmitting potentially sensitive family-history data. Although the module docstring describes API helper behavior, it does not disclose the privacy impact of sending personal data to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code reads a GEDCOM file and outputs personally sensitive genealogical details such as full names, sex, birth dates/places, death details, and family relationships. While the file purpose is genealogical querying, there is no user-facing warning, comment, or docstring disclosing that potentially sensitive personal data from the supplied file will be displayed in clear text.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.