Work Schedule Assistant

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:24 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed local work-schedule ledger with attachment archiving and optional daily reminders, with manageable privacy and rendering risks but no evidence of malicious behavior.

Install only if you want work messages, notes, history, and selected attachments stored persistently on this machine. Review cron setup before approving daily reminders, avoid saving secrets or highly sensitive documents, and be cautious with links or Markdown content added from untrusted messages.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/work_schedule.py:175

Finding

Persistent Markdown Injection Through Unescaped Schedule Data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/work_schedule.py:53

Finding

Schedule and Attachment Data May Be Created With Permissive Filesystem Permissions

Content

View full analysis

Iterator[dict[str, Path]]: target = paths() target["home"].mkdir(parents=True, exist_ok=True) ``` ```python atomic_write(target["data"], json.dumps(store, ensure_ascii=False, indent=2) + "\n") atomic_write(target["view"], render_markdown(store)) event["at"] = now_iso() with target["history"].open("a", encoding="utf-8") as handle: handle.write(json.dumps(event, ensure_ascii=False) + "\n") ``` ```python attachment_dir = target["home"] / "attachments" / args.id attachment_dir.mkdir(parents=True, exist_ok=True) destination = unique_attachment_path(attachment_dir, safe_filename(source.name)) shutil.copy2(source, destination) ``` ### Technical Analysis The schedule directory and attachment directories are created without explicit restrictive permission modes. Their effective permissions therefore depend on the process umask. The history file is also opened without explicitly enforcing a private file mode. Temporary files used by `atomic_write()` are normally created securely by `mkstemp()`, but the persistent directory hierarchy and append-only history file still rely on ambient filesystem configuration. Additionally, `shutil.copy2()` copies file metadata, including permission bits where supported. A source attachment that is readable by other local users may remain broadly readable after being copied into the persistent schedule directory. The stored data may include work schedules, meeting participants, locations, notes, original messages, history records, and attachment contents. These records can be sensitive even though the Skill documentation prohibits storing credentials. ### Attack Path 1. The Skill runs on a multi-user system under a p ...[truncated 1299 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill description understates or omits important operational behavior, notably setup of recurring reminders via cron/OpenClaw scheduled tasks. Undeclared persistence or scheduling capabilities are security-relevant because they let the skill establish ongoing execution beyond a single user request, which can surprise users and operators and expand blast radius if misused.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes shell, file, environment, and network-capable behavior but does not declare any explicit tool scope or permission boundaries. That makes the effective privilege surface ambiguous and increases the risk of overbroad access, especially because the skill processes user-supplied content into filesystem writes and attachment handling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger rules are broad enough to capture ordinary conversational scheduling language, including messages without explicit prefixes. This can cause unintended persistence of user content, accidental collection of sensitive work details, and unnecessary invocation of file-writing and attachment-related actions when the user's intent was ambiguous.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/setup_reminder.py (reported line 69)May include surrounding context.

python

if args.dry_run:
        print(json.dumps(command, ensure_ascii=False, indent=2))
        return
    result = subprocess.run(command, text=True, capture_output=True, check=False)
    if result.stdout:
        print(result.stdout, end="")
    if result.stderr:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file sets a default timezone of "Asia/Shanghai" and uses Chinese-only user-facing output and error text, such as the timezone validation error. This imposes a specific locale/language behavior on all users without offering a choice or documenting that the tool is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The argument validation errors are hard-coded in Chinese ("时间必须为 HH:MM", "时间超出范围") and the script also uses a Chinese default reminder name. This imposes a specific language on users with no opt-in or documented locale constraint, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/work_schedule.py (reported line 302)May include surrounding context.

python

"category": normalize_text(args.category) if args.category is not None else None,
        "notes": normalize_text(args.notes) if args.notes is not None else None,
    }
    provided = {key: value for key, value in changes.items() if getattr(args, key) is not None}
    if not provided:
        raise SystemExit("没有提供需要修改的字段")
    if args.priority is not None and args.priority not in PRIORITY_ORDER: