ClawHub
Back to skill

Security audit

Study Buddy

Security checks for vulnerabilities and agentic risk

Overview

This is a local study-assistant skill with disclosed local storage and no evidence of network access, exfiltration, deception, or unsafe system changes.

Before installing, understand that this skill will keep local study records such as notes, cards, quiz scores, plans, and history under ~/.openclaw/study-buddy/. Consider narrowing activation phrases and adding clear delete/export controls, especially if your study material is sensitive.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill is explicitly designed for session persistence: it stores settings, notes, flashcards, quiz results, plans, and study history across interactions. While this appears product-intended rather than malicious, persistent local storage creates privacy and data-retention risk because sensitive educational content and behavioral data may accumulate without clear consent, retention controls, or minimization.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: study-buddy
description: When user asks to study, create flashcards, take a quiz, make notes, revise, set study timer, track study hours, create study plan, explain a topic, test knowledge, do spaced repetition, summarize a chapter, practice questions, view study stats, or any learning/studying task. 22-feature AI study assistant with flashcards, quizzes, spaced repetition, Pomodoro timer, study planner, notes, and gamification. All data stays local — NO external API calls, NO network requests, NO data sent to any server.
metadata: {"clawdbot":{"emoji":"📚","requires":{"tools":["read","write"]}}}
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The top-level description says the skill should activate for essentially 'any learning/studying task,' which is overly broad and likely to capture normal conversation. Overbroad activation can cause the skill to read or write local study data unexpectedly in contexts where the user did not intend to invoke it, increasing privacy and integrity risk through unintended persistence.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill documentation states that exec permission is needed to run mkdir -p ~/.openclaw/study-buddy/, but the manifest only declares read and write. This mismatch is dangerous because it obscures the true privilege requirements, making review and deployment decisions inaccurate and increasing the chance that exec is later added or used without proper scrutiny.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The activation list includes ambiguous single words and common phrases such as 'study,' 'explain,' 'review,' 'notes,' and 'pomodoro' without qualifiers. These generic triggers make accidental activation likely, which is especially risky for a stateful skill that auto-saves notes, quiz history, and usage data to local files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.