Family Ledger

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:20 PM UTC
• Version: 1.0.1

Overview

This family ledger skill is purpose-aligned, but it stores and edits sensitive shared household financial and identity-linked data without clear privacy or authorization boundaries.

Review this skill before installing. It is not deceptive or destructive, but it is designed to keep shared household financial records and identity mappings on disk. Use it only in a trusted household/workspace, remove real personal identifiers from the skill package, restrict file permissions, and add explicit confirmation and authorization rules before allowing writes or cross-user queries.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:107

Finding

Shared Financial Records Lack a Documented Authorization Boundary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 107-118
Vulnerability Type: Missing authorization controls for shared financial data
Risk Level: Medium

Relevant Code Snippet:

text

~/.openclaw/workspace/shared/ledger/user-mapping.json

json

{
  "ou_7d82888fe950c222c78c4ba7e7ec9ab7": "\u8bbe\u8ba1\u8671",
  "ou_2d8827e13291607774e7d518d1b5bfe0": "\u5927\u8138\u9c7c"
}

text

The skill automatically reads sender_id from message metadata
and converts it to the recorder name.

The same document defines common ledger storage under:

text

~/.openclaw/workspace/shared/ledger/
├── daily.json
├── social.json
└── borrow.json

Technical Analysis

All participating users are directed to common JSON files containing household expenses, social payments, loans, and reimbursements. The sender_id mapping establishes attribution, but the documented workflow does not require an authorization decision before reading, updating, or overwriting shared records.

Attribution is not equivalent to access control. A secure design must validate whether the mapped sender is authorized for the requested ledger, record, and operation. The skill does not document rejection of unknown sender IDs, role separation, record ownership checks, or restrictions on cross-user queries and status changes.

The read-modify-write design increases the risk because the agent is instructed to overwrite an entire JSON file after reading it. An unauthorized or mistaken operation could therefore affect records beyond the requesting user's legitimate scope.

Attack Path

1. A user who can invoke the skill submits a query for household-wide daily, social, loan, or reimbursement records.
2. The skill obtains the user's sender_id and maps it to a recorder name.
3. No documented policy verifies that the sender is permitted to read the requested ledger or other family members' records.
4. T ...[truncated 889 chars]

Remediation

View remediation

Remediation Suggestions

1. Define an explicit allowlist of permitted sender IDs and reject unknown, missing, or malformed identities before any ledger operation.
2. Enforce authorization separately for reads, inserts, edits, deletions, and status updates.
3. Associate every record with an immutable owner or household identifier and verify access to that scope for each request.
4. Separate ledgers by household or user where full sharing is unnecessary.
5. Require elevated authorization and explicit confirmation for cross-user changes, bulk operations, and destructive updates.
6. Avoid unrestricted whole-file overwrite operations. Use validated transactional updates, backups, file locking, and atomic replacement.
7. Apply restrictive filesystem permissions so unrelated local users and agents cannot access the ledger directory.
8. Maintain an audit trail containing the authenticated sender, operation, affected record, timestamp, and previous value.
9. Minimize query responses and redact fields that the requester does not need.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:57

Finding

Platform Identifiers and Family Relationship Data Are Embedded in the Skill Definition

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57-59 and 111-115
Vulnerability Type: Plaintext sensitive personal data in skill configuration
Risk Level: Medium

Relevant Code Snippet:

The following is a Unicode-escaped rendering of the source content so that the report remains English-only while preserving the represented values:

text

**\u5f53\u524d\u7528\u6237\u5b69\u5b50\u4fe1\u606f**:
- \u679c\u679c (\u552f\u4e00\u5b69\u5b50)
- \u5bb6\u5ead\u5173\u7cfb: \u5927\u8138\u9c7c\u662f\u679c\u679c\u7684\u5988\u5988

json

{
  "ou_7d82888fe950c222c78c4ba7e7ec9ab7": "\u8bbe\u8ba1\u8671",
  "ou_2d8827e13291607774e7d518d1b5bfe0": "\u5927\u8138\u9c7c"
}

Technical Analysis

The reusable skill definition contains persistent platform user identifiers, personal aliases, a child's nickname, and a parent-child relationship. These values are not generic examples because the document separately labels them as current user information.

Skill packages can be copied, published, archived, indexed, or reviewed by people who do not require access to the household's personal data. Embedding such data in the distributable definition unnecessarily expands its exposure and retention scope.

Platform IDs are not authentication secrets by themselves, but they are stable identifiers that can facilitate account correlation. When combined with aliases and family relationships, they can support profiling, impersonation, targeted social engineering, and privacy invasion.

Attack Path

1. An unauthorized party obtains access to the skill package through repository access, package distribution, backups, logs, or accidental publication.
2. The party reads the embedded platform IDs, aliases, child's nickname, and parent-child relationship.
3. The identifiers are correlated with activity on the associated messaging platform or with other leaked data.
4. The family context is used to create convincing ...[truncated 723 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all real platform IDs, aliases, child information, and family relationships from SKILL.md.
2. Replace examples with unmistakably synthetic values that cannot be associated with real accounts or people.
3. Collect household configuration at runtime and store it outside the distributable skill package.
4. Protect the runtime configuration with restrictive filesystem permissions and encryption where supported.
5. Store only the minimum information necessary for ledger operation; avoid recording family relationships unless required.
6. Use opaque internal identifiers instead of personal names when possible.
7. Establish retention and deletion procedures for children's data and other sensitive household information.
8. Review repository history, published packages, backups, and logs for prior exposure, because deleting the current text does not remove historical copies.
9. If the platform IDs were publicly distributed, assess whether they should be rotated or otherwise invalidated through the platform.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill stores detailed household financial data in shared local JSON files, including dates, amounts, family relationships, children, and property references, but provides no warning about persistence or shared access risks. Users may unknowingly expose sensitive personal and financial information to other local users, tools, backups, or any process with workspace access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Persistently mapping platform sender IDs to real identities creates a durable linkage between message metadata and named household members without warning the user. This increases privacy risk because identity correlation can expose communication patterns and attribute financial actions to specific individuals if the workspace is accessed or leaked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger rules use very broad keyword matching for common terms like '借', '还', and category words that can easily appear in normal conversation. This can cause unintended activation and accidental creation or modification of sensitive financial records, especially in a family/shared-channel context where casual messages may be misinterpreted as bookkeeping commands.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

Saying that the whole family can use the skill through different channels without defining activation boundaries or authorization expectations increases the chance that unintended users or contexts will invoke it. In a skill that writes shared financial and identity-linked data, ambiguous scope can lead to accidental disclosure, unauthorized entries, or confusion about who is permitted to access or alter records.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

All documented commands and examples are specified only in Chinese, and the skill does not indicate that language selection is optional or that the Chinese-only scope is an intentional locale-specific limitation. This can be a language/locale policy issue when a skill effectively requires one language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.