ClawHub
Back to skill

Security audit

Longevity OS

Security checks for vulnerabilities and agentic risk

Overview

This health bundle needs Review because it asks users or agents to run an unpinned external installer while handling sensitive health data and optional automated Telegram messages.

Install only if you are comfortable cloning and running code from the current GitHub repository state. Prefer a pinned commit or signed release, inspect scripts/install_bundle.py and the sub-skills before running it, verify changes to ~/.openclaw/openclaw.json, and enable cron or Telegram delivery only after confirming the destination chat id and understanding what health data may be stored or sent.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
skill.md:44
Finding

Execution of Unpinned Code Retrieved from a Mutable Remote Repository

Content
View full analysis

Vulnerability Details

File Location: skill.md:44-47; duplicated installation workflow in README.md:127-130 and README.md:146-164
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable code snippet from skill.md:44-47:

text
1. Clone `https://github.com/compound-life-ai/longClaw`.
2. Change into the repository.
3. Run `python3 scripts/install_bundle.py`.
4. Run `python3 scripts/install_bundle.py --verify`.

Corresponding code snippet from README.md:127-130:

text
1. Clone `https://github.com/compound-life-ai/longClaw` to a stable local path.
2. Change into the cloned repository.
3. Run `python3 scripts/install_bundle.py`.
4. Run `python3 scripts/install_bundle.py --verify`.

Additional executable installation commands from README.md:146-164:

bash
python3 scripts/install_bundle.py --dry-run
bash
python3 scripts/install_bundle.py
bash
python3 scripts/install_bundle.py --openclaw-home /path/to/.openclaw
bash
python3 scripts/install_bundle.py --verify

Technical Analysis

The skill directs an agent or user to clone an external GitHub repository and immediately execute its Python installer. The repository reference is not pinned to an immutable commit hash or signed release, and the instructions do not require verification of a cryptographic checksum or signature.

Consequently, the effective executable payload can change after this skill has been reviewed. The audited artifact contains only skill.md and README.md; it does not contain scripts/install_bundle.py, the advertised skills/ directory, or the other executable components. Their implementation and safety therefore cannot be verified from the submitted project.

The README states that the external installer copies scripts and skills, initializes runtime storage, and modifies ~/.openclaw/openclaw.json by registering ...[truncated 1920 chars]

Remediation
View remediation

Remediation Suggestions

  1. Include scripts/install_bundle.py, all sub-skills, and every executable dependency directly in the reviewed artifact so installation behavior can be audited.
  2. Pin remote installation to an immutable Git commit or versioned release instead of cloning the mutable default branch.
  3. Publish a SHA-256 checksum for the complete release artifact and require checksum verification before execution.
  4. Prefer cryptographically signed releases and verify the signature against a documented maintainer key.
  5. Display all proposed filesystem and configuration changes before applying them, and require explicit user approval.
  6. Execute installation with least privilege. Do not request administrator or root access when changes are limited to the user's OpenClaw directory.
  7. Validate copied paths and reject symbolic links, path traversal, or destinations outside the intended bundle directory.
  8. Back up ~/.openclaw/openclaw.json before modification and update it atomically.
  9. Audit the pinned installer and every registered skill before instructing the user to start a fresh OpenClaw session.
  10. Update the documentation to use a workflow such as downloading a signed release, verifying its signature and checksum, inspecting the installation plan, and only then running the installer.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 289)May include surrounding context.

text
1. List active cron jobs with `openclaw cron list` and remove any that reference `health-brief`, `news-digest`, or `daily-health-coach`.
2. Open `~/.openclaw/openclaw.json` and remove the `~/.openclaw/bundles/compound-clawskill/skills` entry from `skills.load.extraDirs`.
3. Delete the installed bundle directory: `rm -rf ~/.openclaw/bundles/compound-clawskill`.
4. Tell the user to start a new OpenClaw session so the removed skills are no longer loaded.
5. Confirm that `/snap`, `/health`, `/news`, `/insights`, and `daily-coach` are no longer available.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 289)May include surrounding context.

text
1. List active cron jobs with `openclaw cron list` and remove any that reference `health-brief`, `news-digest`, or `daily-health-coach`.
2. Open `~/.openclaw/openclaw.json` and remove the `~/.openclaw/bundles/compound-clawskill/skills` entry from `skills.load.extraDirs`.
3. Delete the installed bundle directory: `rm -rf ~/.openclaw/bundles/compound-clawskill`.
4. Tell the user to start a new OpenClaw session so the removed skills are no longer loaded.
5. Confirm that `/snap`, `/health`, `/news`, `/insights`, and `daily-coach` are no longer available.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 289)May include surrounding context.

text
1. List active cron jobs with `openclaw cron list` and remove any that reference `health-brief`, `news-digest`, or `daily-health-coach`.
2. Open `~/.openclaw/openclaw.json` and remove the `~/.openclaw/bundles/compound-clawskill/skills` entry from `skills.load.extraDirs`.
3. Delete the installed bundle directory: `rm -rf ~/.openclaw/bundles/compound-clawskill`.
4. Tell the user to start a new OpenClaw session so the removed skills are no longer loaded.
5. Confirm that `/snap`, `/health`, `/news`, `/insights`, and `daily-coach` are no longer available.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The README promotes Apple Health import, persistent storage under longevityOS-data, and proactive cron-driven messaging, but does not give an explicit privacy, retention, or sensitive-data handling warning. For a health-data skill, that omission increases the chance users enable ingestion and automated messaging without understanding what is stored locally, what may be sent through Telegram, and how long data persists.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly says the bundle responds to broad natural-language phrases like ordinary health chat, not just slash commands. That can cause unintended routing of free-form conversations into data-writing or analysis skills, especially in a chat environment where users may not realize a capability was invoked. In a health-focused bundle, accidental invocation is more sensitive because it may import, log, or persist personal health information.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
79% confidence
Finding

The README instructs users to create cron jobs that proactively send health briefings and coaching messages, introducing persistent automated behavior outside the current session. Session-persistent automation increases risk because it can continue processing or disclosing sensitive health context after the user forgets it is enabled, especially if Telegram destinations are misconfigured or shared.

Content

Scanner excerpt · README.md (reported line 259)May include surrounding context.

  • cron/news-digest.example.json
  • cron/daily-health-coach.example.json

Then create the jobs:

bash
openclaw cron add --from-file cron/health-brief.example.json

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is designed to trigger on very broad health-related natural language, which can cause over-selection and unintended routing of ordinary conversation into health workflows. In a health context, this increases the chance of collecting or processing sensitive personal data without sufficiently clear user intent or boundaries, and may also cause the wrong sub-skill to act on ambiguous input.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.md (reported line 63)May include surrounding context.

md
- `README.md` for installation, verification, cron setup, and bundle-level architecture
- `docs/install.md` for the direct install workflow
- `skills/snap/SKILL.md` for meal logging behavior and payload shape
- `skills/health/SKILL.md` for Apple Health import and questionnaire flows
- `skills/news/SKILL.md` for curated digest behavior
- `skills/insights/SKILL.md` for experiment creation, check-ins, and analysis

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.md (reported line 64)May include surrounding context.

md
- `README.md` for installation, verification, cron setup, and bundle-level architecture
- `docs/install.md` for the direct install workflow
- `skills/snap/SKILL.md` for meal logging behavior and payload shape
- `skills/health/SKILL.md` for Apple Health import and questionnaire flows
- `skills/news/SKILL.md` for curated digest behavior
- `skills/insights/SKILL.md` for experiment creation, check-ins, and analysis
- `skills/daily-coach/SKILL.md` for the scheduled coaching workflow

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.md (reported line 65)May include surrounding context.

md
- `docs/install.md` for the direct install workflow
- `skills/snap/SKILL.md` for meal logging behavior and payload shape
- `skills/health/SKILL.md` for Apple Health import and questionnaire flows
- `skills/news/SKILL.md` for curated digest behavior
- `skills/insights/SKILL.md` for experiment creation, check-ins, and analysis
- `skills/daily-coach/SKILL.md` for the scheduled coaching workflow

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.md (reported line 66)May include surrounding context.

md
- `skills/snap/SKILL.md` for meal logging behavior and payload shape
- `skills/health/SKILL.md` for Apple Health import and questionnaire flows
- `skills/news/SKILL.md` for curated digest behavior
- `skills/insights/SKILL.md` for experiment creation, check-ins, and analysis
- `skills/daily-coach/SKILL.md` for the scheduled coaching workflow

If the user asks what this repository does overall, explain that it is a local-first personal health companion bundle for OpenClaw with nutrition logging, health profile building, curated health news, structured self-experimentation, and a cron-driven daily coaching workflow.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.md (reported line 67)May include surrounding context.

md
- `skills/health/SKILL.md` for Apple Health import and questionnaire flows
- `skills/news/SKILL.md` for curated digest behavior
- `skills/insights/SKILL.md` for experiment creation, check-ins, and analysis
- `skills/daily-coach/SKILL.md` for the scheduled coaching workflow

If the user asks what this repository does overall, explain that it is a local-first personal health companion bundle for OpenClaw with nutrition logging, health profile building, curated health news, structured self-experimentation, and a cron-driven daily coaching workflow.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
README.md:289