Security audit

Buddy

Security checks for vulnerabilities and agentic risk

Overview

This is a local chat companion skill with disclosed local state, and the issues found are bounded usability/privacy and state-file robustness risks rather than hidden or harmful behavior.

Install only if you want passive companion reactions in chat and local state retained across sessions. Avoid passing untrusted custom names or attributes until JSON encoding is fixed, and review or delete ~/.openclaw/workspace/buddy-state.json if you want to clear retained companion data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/state.sh:108
Finding: Persistent JSON State Injection Through Unescaped Hatch Parameters
Content: View full analysis
"$STATE_FILE" <
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The code does partially align with the description in that it reacts to chat messages and includes celebratory and error/sympathetic responses. However, the declared experience emphasizes a persistent virtual ASCII companion with hatching, cute sprite reactions, and growth over time, none of which are present in this code chunk. Instead, the script only performs keyword matching on a single message and returns a simple reaction_type|reaction_text pair. It also includes several reaction categories not mentioned in the description (greeting, thanks, snack, joke). This makes the implemented behavior materially narrower and somewhat different from the declared purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The invocation rules are ambiguous, including reacting whenever a companion is mentioned and performing periodic idle presence. Poorly bounded activation conditions increase the chance that the skill will inject itself into unrelated conversations, which can lead to unintended behavior, state persistence, and interference with higher-priority tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill reacts to very common phrases like 'hi', 'help', 'thanks', 'bug', and food words, which can cause unsolicited activation during ordinary conversation. In an agent environment, broad natural-language triggers can create prompt-hijacking of the interaction flow, unexpected state changes, and repeated output or file writes without a deliberate user command.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill persists conversation-derived data to '~/.openclaw/workspace/buddy-state.json' across sessions without a prominent consent or privacy notice. Even if the stored fields seem harmless, names, interaction stats, moods, and generated personality text are derived from user interactions and can create privacy, retention, and cross-session context leakage risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The delete branch irreversibly removes the user's buddy state file with rm and only reports deleted afterward. There is no confirmation prompt, pre-action warning, or other user disclosure at the point of this destructive operation.
Content: No source excerpt is available for this finding.