Back to skill

Security audit

自我复盘

Security checks across malware telemetry and agentic risk

Overview

This self-reflection skill stores local Markdown notes and can optionally set up daily reminders, but the behavior is mostly disclosed, local, and aligned with its stated purpose.

Install this only if you want OpenClaw to keep ongoing local reflection and memory notes. Review ~/.openclaw/workspace/reflections and ~/.openclaw/workspace/memory for sensitive content, avoid storing secrets there, and enable the launchd schedule only if you intentionally want daily background execution.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (15)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
with open(PLIST_FILE, "w") as f:
        f.write(plist_content)
    
    result = os.system(f"launchctl load '{PLIST_FILE}' 2>/dev/null")
    if result == 0:
        print(f"✅ 定时任务已设置:每天 {hour:02d}:{minute:02d} 执行")
    else:
Confidence
89% confidence
Finding
result = os.system(f"launchctl load '{PLIST_FILE}' 2>/dev/null")

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
def remove_launchd():
    """删除已有的 launchd 定时任务"""
    if os.path.exists(PLIST_FILE):
        os.system(f"launchctl unload '{PLIST_FILE}' 2>/dev/null")
        os.remove(PLIST_FILE)
        print("已删除定时任务")
Confidence
88% confidence
Finding
os.system(f"launchctl unload '{PLIST_FILE}' 2>/dev/null")

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
This script sets up autonomous, scheduled execution of multiple data-processing tasks every night, which expands the skill from user-triggered reflection logging into ongoing background monitoring and analysis. In a self-reflection skill, that broader behavior increases privacy and consent risk because collection, reminders, and behavioral pattern detection can occur without an explicit per-use user action or clear runtime notice.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The code writes daily chat records into ~/.openclaw/workspace/memory and defines scheduling-related files, while the skill description says it should write reflections into reflections/. This mismatch indicates capability creep and hidden data collection/persistence beyond the declared purpose, which raises trust and privacy concerns.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
This function removes a persistent launchd job, showing that the skill is actively managing OS-level scheduled tasks. Persistence mechanisms are sensitive because they survive across sessions and are not justified by the stated goal of recording reflections, making the skill more dangerous in context.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
This block writes a LaunchAgent plist and loads it with launchctl, creating persistent OS automation. For a self-reflection skill, this is a substantial and undeclared expansion of authority that could be abused to run code regularly without the user's ongoing awareness.

Intent-Code Divergence

Medium
Confidence
78% confidence
Finding
The module describes itself as generating daily chat records, which conflicts with the stated self-reflection behavior. This inconsistency is dangerous because it obscures the true data handling scope and can mislead reviewers and users about what content is being stored.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrases include broad everyday terms like '总结经验' and '自我提升', making accidental activation likely in normal conversation. When combined with automatic file writes, a benign discussion can unexpectedly cause persistence of user content or agent-generated summaries.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill says to proactively write after tasks, mistakes, or learning, but does not define clear boundaries for when automatic triggering should or should not occur. This ambiguity increases the chance of over-collection and silent persistence of content outside the user's expectations.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill instructs automatic persistence of reflections to local files without clearly warning users that conversation-derived content will be stored on disk. This can expose sensitive personal, project, or credential-adjacent information through unexpected retention.

Missing User Warnings

High
Confidence
98% confidence
Finding
Automated daily chat log generation materially increases retention scope by saving conversation history to memory/YYYY-MM-DD.md without an explicit warning at the point of collection. Persistent logs can later be read, searched, or exfiltrated, amplifying privacy and data-minimization risks.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The auto-reminder rules analyze user wording such as corrections or denials and may trigger record/reminder flows based on conversation content, but the skill does not clearly disclose that such analysis occurs. This creates a covert monitoring concern even if the resulting action is 'only' a reminder.

Ssd 3

Medium
Confidence
95% confidence
Finding
Mandating daily chat logs semantically instructs retention of user-provided conversation content, which may include sensitive operational, personal, or proprietary information. The danger is heightened because retention is normalized as part of routine operation rather than an exceptional, consented action.

Ssd 3

Medium
Confidence
94% confidence
Finding
The description directs the agent to persist task outcomes, mistakes, and learned content after interactions, creating a standing instruction to retain user- and task-derived data. Even when framed as self-improvement, this can accumulate sensitive information over time without clear user awareness or minimization.

Ssd 3

Medium
Confidence
97% confidence
Finding
Explicit automation of daily conversation logging increases the likelihood of broad, ongoing retention and turns ad hoc note-taking into systematic surveillance of chat content. In context, this is more dangerous because the skill is framed as a benign reflection aid, reducing the chance users will anticipate persistent storage.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.