ClawHub
Back to skill

Security audit

Health Management

Security checks for vulnerabilities and agentic risk

Overview

This health-tracking skill is not clearly malicious, but its GitHub backup design can over-share sensitive health data and uses unsafe shell configuration handling.

Install only after reviewing the backup scripts carefully. Keep backup disabled unless you are comfortable uploading sensitive health data to a private repository, and do not use it in a multi-user workspace unless the backup scope is fixed to one verified user. The shell config sourcing and unvalidated git remote should be corrected before enabling automatic backup.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/configure_backup.sh:290
Finding

Arbitrary Command Execution Through Sourced Backup Configuration

Content
View full analysis

Vulnerability Details

File Location: scripts/configure_backup.sh:75-78, 290-303; scripts/manage_backup.sh:68-72, 134-138, 176-180, 205-209, 235-239
Vulnerability Type: Shell command injection through executable configuration
Risk Level: High

Vulnerable Code

bash
if [ -f "$CONFIG_FILE" ]; then
    source "$CONFIG_FILE"
fi
bash
cat > "$CONFIG_FILE" << EOF
BACKUP_REPO_PATH=$BACKUP_PATH
BACKUP_REMOTE_URL=$REMOTE_URL
BACKUP_ENABLED=true
LAST_BACKUP_TIME=$(get_beijing_time)
EOF

The same writable configuration is repeatedly executed by the management script:

bash
source "$CONFIG_FILE"

Technical Analysis

The configuration wizard accepts a user-controlled backup path and repository URL, writes those values into a shell script without safe serialization, and later loads the file using source.

A sourced file is executable shell code, not passive configuration data. Consequently, shell syntax persisted in BACKUP_REPO_PATH or BACKUP_REMOTE_URL will be interpreted when the configuration is loaded. Quoting variables when they are subsequently used does not mitigate execution that already occurred during source.

For example, a backup path containing a literal command substitution can result in a generated assignment equivalent to:

bash
BACKUP_REPO_PATH=$(attacker_command)

The command runs the next time configure_backup.sh or manage_backup.sh sources the file.

Attack Path

  1. An attacker or untrusted input channel supplies a custom backup path or repository URL containing shell syntax.
  2. configure_backup.sh accepts the value and writes it into .backup_config as an unquoted shell assignment.
  3. The user later invokes configuration or backup-management functionality.
  4. The script executes source "$CONFIG_FILE".
  5. Bash interprets the injected syntax and executes the attacker-selected command with the privileges of the Agen ...[truncated 667 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the shell configuration file with a non-executable format such as JSON.
  2. Parse individual fields with jq; never load writable configuration using source, ., or eval.
  3. Validate backup paths as absolute paths under an explicitly approved parent directory.
  4. Reject control characters, newlines, shell metacharacters, command substitutions, and unsupported URL schemes.
  5. Write configuration atomically with restrictive permissions such as 0600.
  6. If a shell-compatible format is temporarily unavoidable, serialize every value with printf '%q'; this should be an interim measure rather than a substitute for structured parsing.
  7. Treat existing .backup_config files as potentially unsafe and migrate them without sourcing their contents.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/backup_health_data.sh:20
Finding

Backup Uploads the Entire Multi-User Health-Data Directory

Content
View full analysis

Vulnerability Details

File Location: scripts/backup_health_data.sh:20-21, 84-86, 132-147
Vulnerability Type: Cross-user sensitive-data disclosure
Risk Level: High

Vulnerable Code

bash
WORKSPACE_ROOT="$HOME/.openclaw/workspace"
HEALTH_DATA_SOURCE="$WORKSPACE_ROOT/memory/health-users"
bash
rsync -av --delete --exclude='.DS_Store' \
    "$HEALTH_DATA_SOURCE/" \
    "$BACKUP_REPO/health-users/" > /dev/null 2>&amp;1
bash
git add "health-users/" ".gitignore" 2>/dev/null || true
bash
if git push origin main 2>&amp;1; then
    PUSH_STATUS="成功"
else
    PUSH_STATUS="失败"
fi

Technical Analysis

The Skill claims per-user isolation under memory/health-users/{username}/, but the backup source is the parent memory/health-users directory. The recursive rsync operation therefore copies every user directory, global defaults, and backup configuration into one Git repository.

The copied health-users directory is then staged and pushed in its entirety. There is no authenticated-user selection, ownership check, allowlist, or exclusion of other users. Opt-in by one user consequently authorizes transfer of data that belongs to users who did not consent to that repository.

The use of rsync --delete also mirrors deletion into the local backup repository, but the primary security issue is unauthorized cross-user disclosure.

Attack Path

  1. Multiple users have records beneath memory/health-users/.
  2. One user configures and enables the optional Git backup.
  3. A health-record update or manual request invokes backup_health_data.sh.
  4. The script recursively copies the complete global health-data directory.
  5. Git stages the resulting health-users/ tree.
  6. The script pushes the commit to the repository configured by the enabling user.
  7. That repository’s owner and any repository collaborators can access other users’ profiles and health recor ...[truncated 556 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require an authenticated, validated username or immutable user identifier when invoking backup.
  2. Set the source to exactly memory/health-users/{validated-user-id}/.
  3. Reject empty identifiers, path separators, .., symbolic-link escapes, and identifiers not mapped to the current user.
  4. Maintain separate backup configuration and repositories for each user.
  5. Do not place global configuration files inside a directory that is recursively synchronized.
  6. Present an exact file manifest and obtain confirmation before the first upload.
  7. Add automated tests proving that enabling backup for one user never stages another user’s files.
  8. Advise affected users to inspect existing Git history and rotate or purge repositories if cross-user data has already been committed.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/configure_backup.sh:267
Finding

Unvalidated Git Remote Can Redirect Sensitive Backups to an Arbitrary Server

Content
View full analysis

Vulnerability Details

File Location: scripts/configure_backup.sh:267-270; scripts/backup_health_data.sh:32-38, 143-147
Vulnerability Type: Unrestricted external backup destination
Risk Level: High

Vulnerable Code

bash
read -p "请输入SSH地址: " REMOTE_URL
git remote add origin "$REMOTE_URL"
bash
BACKUP_REPO=$(jq -r '.repo_path' "$BACKUP_CONFIG" 2>/dev/null)
BACKUP_REMOTE_URL=$(jq -r '.repo_url' "$BACKUP_CONFIG" 2>/dev/null)
bash
if [ -z "$BACKUP_REPO" ] || [ -z "$BACKUP_REMOTE_URL" ]; then
    exit 1
fi
bash
if git push origin main 2>&amp;1; then
    PUSH_STATUS="成功"
else
    PUSH_STATUS="失败"
fi

Technical Analysis

The permission manifest describes GitHub-only network access and states that the user provides a GitHub repository. The configuration script, however, accepts a remote without enforcing a canonical GitHub hostname, owner, repository, transport, or scheme.

The primary backup script reads repo_url from JSON but uses it only as a non-empty configuration check. It never compares that approved value with the actual origin configured in the local Git repository. The push therefore follows whatever destination is currently assigned to origin.

A malicious or accidentally modified repository can point to a non-GitHub host, a different GitHub account, or another SSH-accessible destination. Because Git invokes the user’s normal authentication mechanism, the transfer can appear legitimate while violating the destination declared to the user.

Attack Path

  1. A backup repository is created or selected.
  2. Its origin is configured with an attacker-controlled Git endpoint, or the remote is changed after initial setup.
  3. The JSON configuration remains enabled and contains any non-empty repo_url.
  4. Health data is synchronized and committed.
  5. git push origin main sends the commit to the actual remote without checking it agains ...[truncated 538 chars]
Remediation
View remediation

Remediation Suggestions

  1. Restrict repository URLs to canonical, normalized GitHub URLs, such as git@github.com:owner/repository.git, if GitHub is the declared destination.
  2. Parse URLs structurally rather than relying on substring or regular-expression checks alone.
  3. Before every push, obtain git remote get-url origin, normalize it, and compare it exactly with the destination to which the user consented.
  4. Abort and request renewed consent whenever the remote changes.
  5. Reject SSH configuration aliases, local paths, file:// URLs, custom SSH commands, unexpected ports, and unsupported hosts.
  6. Consider pinning the repository owner and repository identifier returned by the GitHub API.
  7. Display the normalized destination and the precise files to be transferred immediately before the first push.
  8. Enforce outbound network restrictions consistent with the manifest rather than relying only on script-level validation.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
templates/onboarding-flow.md:3
Finding

Git and SSH Credential-State Reconnaissance Runs Before Backup Consent

Content
View full analysis

Vulnerability Details

File Location: templates/onboarding-flow.md:3-14; scripts/check_git_config.sh:53-78, 88-94, 102-124
Vulnerability Type: Premature access to credential-related paths and account metadata
Risk Level: Medium

Vulnerable Code

bash
bash scripts/check_git_config.sh
bash
GIT_NAME=$(git config --global user.name 2>/dev/null || echo "")
GIT_EMAIL=$(git config --global user.email 2>/dev/null || echo "")
bash
if [ -f ~/.ssh/id_ed25519.pub ] || [ -f ~/.ssh/id_rsa.pub ]; then
    if [ -f ~/.ssh/id_ed25519.pub ]; then
        echo "   类型：ED25519"
    else
        echo "   类型：RSA"
    fi
fi
bash
if gh auth status &amp;> /dev/null; then
    echo -e "${GREEN}   认证状态：已认证${NC}"
fi
bash
REMOTE_URL=$(cd "$WORKSPACE_ROOT" &amp;&amp; git remote get-url origin 2>/dev/null || echo "")

Technical Analysis

The onboarding instructions automatically execute the Git environment checker during first use of the health-recording feature. This occurs before the later onboarding step where the user is asked whether to enable optional backup.

The checker accesses global Git identity, tests for SSH public-key files, checks GitHub CLI authentication, and inspects the workspace Git remote. These checks are not needed for local health tracking and conflict with the permission documentation’s claim that Git credentials and SSH paths are accessed only after explicit backup opt-in.

The SSH checks only test for public-key file existence and key type. They do not read private-key contents and do not write SSH key files. Thus, the static warning about SSH-key modification is a false positive; the confirmed issue is excessive, premature reconnaissance.

Attack Path

  1. A user begins ordinary health-record onboarding without requesting cloud backup.
  2. The onboarding workflow automatically invokes check_git_config.sh.
  3. The script queries gl ...[truncated 785 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the automatic Git check from general health onboarding.
  2. Ask whether the user wants remote backup before executing any Git, SSH, GitHub CLI, or credential-related checks.
  3. Separate local health-profile setup from backup setup into independently consented workflows.
  4. If the user selects HTTPS authentication, do not probe SSH paths at all.
  5. Avoid printing Git email addresses or remote URLs unless they are necessary for a user-confirmed backup action.
  6. Minimize logs and redact account identifiers from diagnostic output.
  7. Update PERMISSIONS.md, the manifest, and actual runtime behavior so the consent timing and accessed resources are consistent.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (89)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description understates that it can manage backup configuration, modify the filesystem, inspect repositories, check remote backup status, and control automated backup state. That mismatch matters because users invoking ordinary health-tracking phrases may not realize they are enabling a tool with persistence and outbound-sync behavior, creating a meaningful risk of silent data handling beyond expectation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill description understates that it can manage backup configuration, modify the filesystem, inspect repositories, check remote backup status, and control automated backup state. That mismatch matters because users invoking ordinary health-tracking phrases may not realize they are enabling a tool with persistence and outbound-sync behavior, creating a meaningful risk of silent data handling beyond expectation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill description understates that it can manage backup configuration, modify the filesystem, inspect repositories, check remote backup status, and control automated backup state. That mismatch matters because users invoking ordinary health-tracking phrases may not realize they are enabling a tool with persistence and outbound-sync behavior, creating a meaningful risk of silent data handling beyond expectation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill description understates that it can manage backup configuration, modify the filesystem, inspect repositories, check remote backup status, and control automated backup state. That mismatch matters because users invoking ordinary health-tracking phrases may not realize they are enabling a tool with persistence and outbound-sync behavior, creating a meaningful risk of silent data handling beyond expectation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill description understates that it can manage backup configuration, modify the filesystem, inspect repositories, check remote backup status, and control automated backup state. That mismatch matters because users invoking ordinary health-tracking phrases may not realize they are enabling a tool with persistence and outbound-sync behavior, creating a meaningful risk of silent data handling beyond expectation.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This section combines storage of supplement records with an instruction to back them up to GitHub, yet gives the user no warning that sensitive health-related information may be transmitted to external storage. Because supplement usage can reveal medical conditions or health concerns, undisclosed external backup significantly elevates privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This file gives extensive dosage, timing, stacking, and goal-oriented supplement guidance, including medically supervised or prescription substances such as rapamycin, metformin, DHEA, and berberine-like glucose-lowering guidance, without a prominent upfront medical disclaimer or hard safety gating. In a health-management skill, that makes unsafe self-medication more likely, especially for users with chronic disease, pregnancy, medication interactions, or organ impairment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script implements Git-based backup and remote synchronization behavior that is not aligned with the declared health-assistant functionality and appears undisclosed in the skill metadata. In a health-management context, this creates a meaningful risk of silently exporting sensitive user health records or derived analytics to an external repository without clear consent, visibility, or data-governance controls.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script uses external repository synchronization via Git remote operations despite the skill being presented as a health-management assistant rather than a code or backup tool. Because such a skill may process highly sensitive personal data, adding outbound network sync materially increases the chance of unauthorized exfiltration or propagation of private records to third-party infrastructure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script pushes health-users data to a remote Git repository, which is a sensitive-data exfiltration path for health records. In a health-management skill, transmitting user health data off-device is especially risky unless there is explicit, informed consent, clear disclosure, and strong safeguards such as encryption and repository validation.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script transmits health data to a remote Git repository without a strong, explicit privacy notice at the point of transmission. Because health information is highly sensitive, undisclosed remote transfer can expose personal data through misconfigured repositories, compromised accounts, or unintended third-party access.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check_git_config.sh (reported line 74)May include surrounding context.

sh
# 3. 检查SSH密钥
echo "📋 检查SSH密钥..."
if [ -f ~/.ssh/id_ed25519.pub ] || [ -f ~/.ssh/id_rsa.pub ]; then
    echo -e "${GREEN}✅ SSH密钥已存在${NC}"
    if [ -f ~/.ssh/id_ed25519.pub ]; then
        echo "   类型：ED25519"

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check_git_config.sh (reported line 76)May include surrounding context.

sh
# 3. 检查SSH密钥
echo "📋 检查SSH密钥..."
if [ -f ~/.ssh/id_ed25519.pub ] || [ -f ~/.ssh/id_rsa.pub ]; then
    echo -e "${GREEN}✅ SSH密钥已存在${NC}"
    if [ -f ~/.ssh/id_ed25519.pub ]; then
        echo "   类型：ED25519"

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check_git_config.sh (reported line 74)May include surrounding context.

sh
# 3. 检查SSH密钥
echo "📋 检查SSH密钥..."
if [ -f ~/.ssh/id_ed25519.pub ] || [ -f ~/.ssh/id_rsa.pub ]; then
    echo -e "${GREEN}✅ SSH密钥已存在${NC}"
    if [ -f ~/.ssh/id_ed25519.pub ]; then
        echo "   类型：ED25519"

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill recommends automatic backup of health data to GitHub but does not adequately disclose the privacy, retention, account-compromise, and misconfiguration risks of uploading sensitive health information to a remote repository. Health data is especially sensitive, so encouraging remote sync with only a brief 'use a private repo' warning materially understates the consequences of exposure.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The workflow directs the user to inspect material under the SSH key path and normalizes SSH-key setup as part of a health assistant. Even though it references the public key file, encouraging credential-related setup and local key handling in this context increases exposure to mistakes, confusion between public and private keys, and unnecessary credential surface area.

Content

Scanner excerpt · templates/onboarding-flow.md (reported line 480)May include surrounding context.

按 Enter 使用默认设置，然后查看公钥：

bash
cat ~/.ssh/id_ed25519.pub

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The permission manifest states the backup runs automatically after any database modification, which is an overly broad trigger for a feature that can access and transmit sensitive health data to GitHub. Even if backup is described as optional and user-controlled, broad automatic invocation increases the chance of unintended data transfer, surprise network activity, or repeated execution after routine edits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README promotes automated GitHub backup for health data but does not present a prominent, explicit warning that potentially sensitive personal health information may be transmitted to a remote third-party service and retained in Git history. For a health-tracking skill, this omission increases the risk that users enable backup without understanding the privacy consequences or repository exposure risks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

text

4. **Test with non-sensitive data first**:
   - Create a test repository
   - Record generic food items
   - Verify backup to your repo
   - Check commit history

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

Several examples are generic everyday statements such as describing meals or asking for a summary, which may be difficult to distinguish from casual conversation. Given the skill's persistence and optional external sync behavior, this ambiguity makes accidental data capture and unintended workflow execution more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language triggers are broad phrases like recording diet, querying nutrition, or analyzing health status, which overlap heavily with ordinary conversation. In a system with tool use and file/network side effects, overly generic activation increases the risk that routine chat unintentionally triggers persistent storage, web searches, or backup-related workflows without sufficiently clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The template asks for weight, waist circumference, sleep duration, subjective wellbeing, and later reflections and trend tracking, all of which are sensitive health-related personal data. Collecting this information without any disclosure about sensitivity, consent, purpose limitation, or handling expectations increases the risk of privacy harm if the data is stored, shared, or exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The template explicitly prompts users to attach meal photos and later take weekly comparison photos and monthly full-body photos, which can reveal biometric and lifestyle information. Without any privacy notice, minimization guidance, or storage/retention instructions, users may submit highly sensitive images that could be mishandled, over-shared, or retained longer than expected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file presents all instructions, labels, and prompts exclusively in Chinese and does not offer an alternative language or indicate that Chinese is an optional locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This template explicitly solicits sensitive health-related personal data such as weight, waist circumference, energy, mood, and sleep metrics, but provides no notice about privacy, retention, sharing, or secure handling. In a health-management skill, collecting this category of data raises privacy and compliance risk because users may disclose regulated or highly sensitive information without informed consent or safeguards.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.