Security audit

Mood Logger

Security checks for vulnerabilities and agentic risk

Overview

This mood journal skill is related to its stated purpose, but it includes recurring reporting and a hard-coded WeChat recipient that could expose sensitive mood notes.

Install only if you are comfortable storing mood records in the hard-coded Obsidian/iCloud path and do not enable the weekly cron sender without replacing and verifying the recipient. Review or remove the report-sending cron instructions, avoid /tmp report output for private data, and prefer manual local report generation unless recurring external delivery is explicitly intended.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:122
Finding: Hard-Coded WeChat Recipient Can Cause Unauthorized Disclosure of Sensitive Mood Reports
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cron_send_report.sh:7
Finding: Predictable Temporary File Exposes Mood Reports and Permits Symlink-Based File Overwrite
Content: View full analysis
/dev/null) # Send to WeChat (through the OpenClaw messaging system) # Note: A webhook or messaging proxy must be configured echo "$REPORT" > /tmp/weekly_mood_report.txt # Output the generated report cat /tmp/weekly_mood_report.txt ``` ### Technical Analysis The shell wrapper writes the complete mood report to the fixed path `/tmp/weekly_mood_report.txt`. The file is created through ordinary shell redirection without secure exclusive creation, restrictive permissions, ownership validation, or cleanup. A shared temporary directory such as `/tmp` is generally writable by unprivileged local users. A predictable filename creates two related risks: 1. **Confidentiality exposure:** Depending on the cron user's `umask`, the resulting file may be readable by other local users. It remains on disk after execution and can contain mood scores, tags, trends, and personal note excerpts. 2. **Symlink-based overwrite:** An attacker with local access may create `/tmp/weekly_mood_report.txt` as a symbolic link before the scheduled task runs. Shell redirection follows symbolic links and truncates the target if the cron user has permission to write it. The overwrite is limited to files writable by the account running the scheduled task. There is no evidence that this script runs as root, so system-level privilege escalation is not established. Nevertheless, it can overwrite files within the scheduled task user's authority. ### Attack Path #### Confidentiality Path 1. The weekly script runs under cron. 2. The complete report is written to `/tmp/weekly_mood_report.txt`. 3. The file remains after the script exits. 4. Another local ...[truncated 1062 chars]
Remediation: View remediation
"$REPORT_FILE" ``` 3. Set `umask 077` before creating files containing report data. 4. Use `printf` instead of `echo` for predictable handling of report content. 5. Delete the report immediately after use with an `EXIT` trap. 6. Do not reuse a globally predictable filename. 7. Where possible, place temporary data in a private runtime directory owned by the current user. 8. Ensure the scheduled task runs as the ordinary user who owns the mood records, never as root or another privileged account. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill context is personal mood journaling into Obsidian, but the documentation also describes reading historical entries and producing aggregate analytics, which are materially different capabilities. In a privacy-sensitive context, hidden analysis features increase risk because they expand access from one new entry to potentially all prior emotional records.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill context is personal mood journaling into Obsidian, but the documentation also describes reading historical entries and producing aggregate analytics, which are materially different capabilities. In a privacy-sensitive context, hidden analysis features increase risk because they expand access from one new entry to potentially all prior emotional records.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill context is personal mood journaling into Obsidian, but the documentation also describes reading historical entries and producing aggregate analytics, which are materially different capabilities. In a privacy-sensitive context, hidden analysis features increase risk because they expand access from one new entry to potentially all prior emotional records.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill includes scheduled sending of weekly mood reports to a WeChat recipient, which is an outbound messaging capability unrelated to basic local mood logging. Because mood records are intimate personal data, automatic transmission to an external channel materially increases confidentiality risk and could leak private summaries without ongoing user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The weekly automation section lacks a clear warning that private mood summaries will be automatically generated and transmitted to an external messaging channel. In a mental-health journaling context, silent or poorly disclosed exfiltration of summaries is particularly dangerous because users may not expect recurring disclosure of aggregated personal reflections.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script's documented behavior generates and sends a weekly mood report, which materially differs from the manifest's stated purpose of logging daily mood entries via log_mood.py. This capability mismatch is dangerous because it can hide undeclared data processing and sharing behavior from users and reviewers, especially for sensitive mental-health data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This is a true arbitrary file-write issue: the script opens whatever path is supplied in --output and writes attacker-controlled report content there. Within an agent skill, that capability exceeds the declared mood-logging purpose and can be leveraged to tamper with local files, create misleading artifacts, or clobber important data, especially because the skill already has access to personal journal content.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documentation directs use of shell commands and implies file read/write behavior, but the manifest declares no explicit tool scope or permissions. This weakens security boundaries and reviewability because a skill that can read, write, and execute shell actions is being presented without transparent capability declaration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs saving mood logs into an Obsidian vault located in a cloud-synced iCloud directory, but gives no warning that sensitive emotional data will persist on disk and may sync to cloud services. In this context, omission of that privacy notice can cause users to disclose intimate information without understanding storage and retention implications.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest description, headings, parameters, examples, and output format are all presented in Chinese, with no indication that other languages are supported or that Chinese is required for a region-specific reason. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest frames the skill as a daily mood logger, but later sections add weekly reporting and automated sending capabilities. This is a security-relevant inconsistency because it obscures the true operational scope of a skill handling highly sensitive personal information.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The cron creation command establishes a persistent scheduled task that will continue running beyond the current session. Persistence is security-relevant here because it enables ongoing access, report generation, and possible data transmission on a recurring basis without repeated user initiation.
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
设置命令：

bash
openclaw cron create --name "mood-weekly-report" \ --schedule "0 9 * * 0" \ --command "python3 ~/.openclaw/workspace/skills/mood-logger/scripts/send_weekly_report.py" \ --channel openclaw-weixin \

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documented use of OpenClaw cron and system cron adds recurring autonomous execution, which is materially more powerful than a simple on-demand mood logger. Persistent scheduled execution can continue processing sensitive user data without active user awareness, making misuse or accidental over-collection more likely.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 72% confidence
Finding: This duplicate finding points to the same scheduled OpenClaw cron setup, which creates persistent autonomous behavior. Even if intended as convenience documentation, persistence in a skill handling mood data raises privacy and user-awareness concerns because the task may continue operating regularly without fresh approval.
Content: Scanner excerpt · WEEKLY_REPORT_SETUP.md (reported line 8)May include surrounding context.
当 OpenClaw CLI 可用时，运行：

bash
openclaw cron create mood-weekly-report \ --schedule "0 9 * * 0" \ --task "每周心情周报" \ --command "生成并发送上周的心情周报"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 72% confidence
Finding: This duplicate finding points to the same scheduled OpenClaw cron setup, which creates persistent autonomous behavior. Even if intended as convenience documentation, persistence in a skill handling mood data raises privacy and user-awareness concerns because the task may continue operating regularly without fresh approval.
Content: Scanner excerpt · WEEKLY_REPORT_SETUP.md (reported line 8)May include surrounding context.
当 OpenClaw CLI 可用时,运行:

bash
openclaw cron create mood-weekly-report \ --schedule "0 9 * * 0" \ --task "每周心情周报" \ --command "生成并发送上周的心情周报"

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup document introduces a weekly report generation and sending workflow that goes beyond the declared skill scope of only logging daily moods to Obsidian. Scope expansion around emotional-history summaries increases privacy risk because it enables secondary processing and possible disclosure of sensitive mood data without clear user consent or manifest disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instructions schedule automatic generation and sending of a weekly mood report but do not warn that mood logs are sensitive personal data or explain who receives the report. This omission can lead users to enable automated disclosure of emotional-health information without informed consent.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: The crontab instructions establish a persistent scheduled task, causing the skill's reporting behavior to survive beyond the current session. Persistence is risky here because it automates repeated access to sensitive mood-history data and may continue unnoticed after the user forgets it was installed.
Content: Scanner excerpt · WEEKLY_REPORT_SETUP.md (reported line 20)May include surrounding context.
bash
# 编辑 crontab crontab -e # 添加以下行（每周日 9:00 运行） 0 9 * * 0 cd /home/loong/.openclaw/workspace && python3 ~/.openclaw/workspace/skills/mood-logger/scripts/weekly_mood_report.py >> /tmp/mood_report.log 2>&1

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest describes a narrowly scoped skill for recording daily mood entries using a fixed-format logging script. This file instead automates weekly report generation and output handling, which is a distinct reporting capability not mentioned in the skill description.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The inline documentation says the script sends the weekly report to WeChat through an OpenClaw messaging system. In reality, the implemented behavior is only to save the report under /tmp and display it with cat, with no messaging or webhook invocation present.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script writes a mood report, which is likely sensitive personal data, to a predictable file in /tmp. Temporary directories are broadly accessible in many environments, and using a fixed filename increases the risk of unintended disclosure, race conditions, or symlink-based file clobbering if another local user or process can interact with that path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The docstring and user-facing descriptions are entirely in Chinese, with no indication that the skill supports other languages or that Chinese is a required locale. This creates a natural-language policy issue because it imposes a specific language on users without opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file adds report-generation and sending orchestration that is not justified by the stated purpose of simple mood entry recording. Because mood data is highly sensitive, undisclosed reporting functionality increases the risk of privacy violations, unexpected data disclosure, and expansion of access beyond what the user intended.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code invokes weekly_mood_report.py instead of the manifest-declared log_mood.py workflow, indicating the skill performs a different operation than advertised. In a mood-logging context, this is security-relevant because users may believe they are only storing entries while the skill can instead aggregate sensitive data into reports for other uses.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/send_weekly_report.py (reported line 22)May include surrounding context.
python
def main(): # 生成周报 result = subprocess.run( [sys.executable, REPORT_SCRIPT], capture_output=True, text=True,

Static analysis

No suspicious patterns detected.