ClawHub
Back to skill

Security audit

Travel Tracker

Security checks for vulnerabilities and agentic risk

Overview

This travel-tracking skill has a coherent purpose, but it delegates sensitive calendar, travel-record, report, reminder, and Obsidian actions to unreviewed local scripts outside the package.

Review this skill before installing. Only use it if you trust and can inspect the scripts under ~/.openclaw/workspace/scripts/, understand that it may process Apple Calendar and travel history, and are comfortable with persistent copies in reports, memory files, Obsidian, and reminders.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T07 · Tool Hijacking and Spoofing

Warning
Location
SKILL.md:17
Finding
Execution of Unverified External Scripts## Vulnerability Details **File Location**: `SKILL.md`, lines 17-50 **Vulnerability Type**: Execution of mutable external tools without integrity validation **Risk Level**: Medium The Skill directs the agent to execute multiple shell and Python scripts from `~/.openclaw/workspace/scripts/`. These scripts are outside the reviewed project and are not included in the supplied artifact. ```bash # Query travel records ~/.openclaw/workspace/scripts/travel-query.sh [日期范围] # Weekly travel statistics ~/.openclaw/workspace/scripts/generate-weekly-travel-report.sh # Monthly Excel report python3 ~/.openclaw/workspace/scripts/generate-travel-excel-2026-03.py # Quarterly summary python3 ~/.openclaw/workspace/scripts/generate-travel-excel-2026-Q1.py # Extract travel arrangements from Apple Calendar ~/.openclaw/workspace/scripts/auto-travel-from-calendar.sh # Synchronize with Obsidian ~/.openclaw/workspace/scripts/sync-travel-to-obsidian.sh # Verify and configure travel reminders ~/.openclaw/workspace/scripts/travel-reminder-auto-verify.sh ``` ### Technical Analysis The project consists only of `SKILL.md`; none of the referenced executable files are present for review. The instructions do not require validation of script ownership, permissions, symlink status, provenance, or cryptographic integrity before execution. The fixed paths therefore act as an external trust boundary. If another process, package, or user can create or replace a referenced script, a legitimate-looking Skill operation will execute that substituted implementation. Invoking a script through `python3` does not mitigate this issue because the Python source file itself remains mutable and unverified. This finding does not establish that the referenced scripts are currently malicious. It establishes that the Skill delegates execution to unaudited, externally mutable tools without controls that ensure the executed files are the versions intended by the ...[truncated 1289 chars]
Remediation
## Remediation Suggestions 1. Include all required scripts in the reviewed Skill package rather than relying on mutable files in a shared workspace. 2. Resolve executable paths relative to a trusted, immutable Skill installation directory. 3. Review and version-control every invoked script together with `SKILL.md`. 4. Verify script integrity against pinned cryptographic hashes or signed release manifests before execution. 5. Require trusted ownership and restrictive permissions; reject scripts or parent directories writable by untrusted users. 6. Resolve paths canonically and reject symbolic links or paths that escape the trusted installation directory. 7. Execute the scripts with least privilege and restrict filesystem, calendar, and network access to what each operation requires. 8. Validate the date-range argument before passing it to `travel-query.sh`, and use structured argument passing rather than shell interpolation. 9. Fail closed when a referenced script is missing, has unexpected metadata, or fails integrity verification.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list includes broad phrases such as "travel report," "travel tracker," and especially "outbound," which can match ordinary user requests and invoke the skill unexpectedly. Because this skill accesses and syncs personal travel records, accidental activation could expose or process sensitive location/lifestyle data without clear user intent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill documents syncing travel data into an Obsidian directory but provides no warning that personal itinerary, location, and routine information will be copied into a separate knowledge store. This increases privacy risk because users may not realize sensitive movement history is being duplicated into files that could be indexed, synced to cloud services, or exposed through other plugins.

Natural-Language Policy Violations

Low
Confidence
72% confidence
Finding
The skill description and trigger guidance are primarily in Chinese, and there is no statement that users may interact in another language or choose their preferred locale. This can be a natural-language policy issue when a skill implicitly enforces a specific language without opt-in or justification.

Static analysis

No suspicious patterns detected.