Low-Spec Optimizer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:07 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed low-resource cleanup helper, but its cleanup script can delete more local data than its purpose safely requires.

Install only if you are comfortable with a cleanup helper that can delete local session and cache data. Run the dry-run first, review every target path, avoid aggressive mode unless you intentionally want system journal and package-cache cleanup, and do not run it with elevated privileges until the deletion scope is narrowed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/cleanup_sessions.sh:38
• Finding: Cleanup Logic Can Recursively Delete Active and Non-Stale Sessions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/cleanup_sessions.sh`, lines 38–47 **Vulnerability Type**: Unsafe recursive deletion caused by an overly broad `find` expression **Risk Level**: High ### Vulnerable Code ```bash # 1. Stale subagent sessions (older than 1h) if [ -d /home/nvi/.openclaw/sessions ]; then stale_count=$(find /home/nvi/.openclaw/sessions -maxdepth 1 -type d -mmin +60 2>/dev/null | wc -l) if [ "$stale_count" -gt 1 ]; then echo "Found $((stale_count - 1)) stale session(s)" if [ "$DRY_RUN" = true ]; then find /home/nvi/.openclaw/sessions -maxdepth 1 -type d -mmin +60 -exec echo "[DRY-RUN] Would remove: {}" \; else find /home/nvi/.openclaw/sessions -maxdepth 1 -type d -mmin +60 -exec rm -rf {} + 2>/dev/null || true echo "[CLEANED] Stale sessions removed" fi fi fi ``` ### Technical Analysis The `find` commands use `-maxdepth 1` but omit `-mindepth 1`. Consequently, the search may include `/home/nvi/.openclaw/sessions` itself when that root directory satisfies `-type d -mmin +60`. If both the session root and at least one child directory match, `stale_count` is greater than one and the deletion branch executes. Passing the root to `rm -rf` recursively removes everything under it, including child sessions that are newer than one hour or currently active. The count adjustment does not prevent deletion of the root; it only changes the displayed count. The code also suppresses errors with `2>/dev/null || true` and unconditionally reports that stale sessions were removed. This can conceal partial failures or unintended deletion behavior. ### Attack Path 1. `/home/nvi/.openclaw/sessions` has a modification time older than one hour. 2. At least one immediate child session directory also has a modification time older than one hour. 3. A user follows the documented instructions and runs `cleanup_sessions.sh` without `--dry-run`. 4. The count check succeeds because both the root and child dire ...[truncated 796 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Exclude the search root explicitly by adding `-mindepth 1`: ```bash find /home/nvi/.openclaw/sessions \ -mindepth 1 -maxdepth 1 -type d -mmin +60 ``` 2. Collect candidates first, validate that every resolved path is an immediate child of the expected session directory, and then delete only those validated entries. 3. Exclude sessions with active-process markers, lock files, or other OpenClaw-specific indications that they are in use. 4. Prefer an OpenClaw-supported session cleanup API or command, if one exists, rather than deleting internal state directly. 5. Resolve the current user's OpenClaw data directory dynamically instead of hard-coding `/home/nvi`. 6. Display the exact deletion list and request confirmation before destructive cleanup unless an explicit non-interactive option is supplied. 7. Do not suppress all deletion errors. Report failures accurately and only print a success message when deletion succeeds. 8. Add automated tests covering an old root containing both stale and recent child sessions, verifying that the root and recent sessions remain intact. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cleanup_sessions.sh:60
• Finding: Cleanup Removes the Entire Playwright Data Directory Instead of a Scoped Cache<![CDATA[ ## Vulnerability Details **File Location**: `scripts/cleanup_sessions.sh`, line 60 **Vulnerability Type**: Overly broad destructive cleanup target **Risk Level**: Medium ### Vulnerable Code ```bash # 3. Browser profiles cache clean "Browser cache" /home/nvi/.cache/ms-playwright ``` The invoked helper performs the following deletion when the path exists: ```bash rm -rf "$path" ``` ### Technical Analysis The script describes `/home/nvi/.cache/ms-playwright` as a browser cache and passes the entire directory to a helper that recursively deletes its target. The Playwright directory may contain installed browser binaries and related runtime data, not merely disposable cache files. The operation is executed during ordinary cleanup, not only with `--aggressive`. It therefore exceeds the minimum scope necessary to clear temporary browser data and can remove components needed for subsequent browser automation. The path is hard-coded to a specific user's home directory. If the script is run by another account with sufficient permissions, it may alter another user's Playwright installation. The fixed path also makes the behavior inconsistent across environments. ### Attack Path 1. Playwright browser binaries or required runtime data are stored under `/home/nvi/.cache/ms-playwright`. 2. A user runs the documented `cleanup_sessions.sh` command without `--dry-run`. 3. The `clean` helper detects that the directory exists. 4. The helper executes `rm -rf` against the entire `ms-playwright` directory. 5. Subsequent browser automation fails or requires the removed browser components to be downloaded and installed again. ### Impact Assessment The issue can cause denial of browser-automation functionality, loss of local browser runtime data, and unnecessary reinstallation or network downloads. It affects data available to the executing user's permissions and could affect the hard-coded `nvi` account if invoked by a more privileged user. The code does not obtai ...[truncated 113 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Identify and remove only documented, disposable Playwright cache subdirectories rather than deleting the complete `ms-playwright` directory. 2. Keep installed browser binaries and active profile data outside the cleanup target. 3. Move broad browser cleanup behind `--aggressive` and require explicit confirmation before deletion. 4. Use the executing user's cache directory, such as `${XDG_CACHE_HOME:-"$HOME/.cache"}`, instead of `/home/nvi/.cache`. 5. Resolve and validate each target with `realpath` before deletion, ensuring it remains within the intended cache root. 6. Report exactly which files or directories will be removed during `--dry-run`. 7. Prefer Playwright-supported uninstall or garbage-collection commands where available. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The code is consistent with one subset of the description: resource monitoring / health checking on low-spec machines. However, the declared purpose claims a broader optimization skill that includes automatic cleanup, session management, and configuration recommendations. None of those capabilities appear in this code chunk. The script is read-only and reports metrics; it does not optimize performance or take corrective actions. That makes the description materially broader than the actual behavior shown.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly authorizes proactive invocation during heartbeats and before heavy operations using broad conditions such as low-resource machines or general system lag. In an agent setting, ambiguous proactive triggers can cause the skill to run unexpectedly, leading to unnecessary system inspection, cleanup actions, or interference with user workflows on constrained hosts.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: In aggressive mode, the script invokes `journalctl --vacuum-time=3d`, which deletes system journal logs outside the OpenClaw application scope. For a low-resource optimization skill, removing host-level forensic and operational logs is overbroad and can hinder incident response, troubleshooting, and auditability while providing only indirect memory or disk benefits.

Static analysis

No suspicious patterns detected.