Educlaw Ielts Planner

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:12 AM UTC
• Version: 1.0.1

Overview

The skill’s IELTS planning purpose is mostly coherent, but its setup and runtime instructions expose users to high-impact install, credential, calendar, and background automation risks that need review before use.

Install only after choosing safer setup paths: avoid the curl-to-bash installer unless you have independently verified it, prefer isolated or pinned dependency installation, restrict Google Calendar and bot permissions, protect config files containing tokens, and disable Discord/Telegram or cron jobs unless you actually need automated reminders and reports.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SETUP.md:44
• Finding: Unverified Remote Installer Is Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SETUP.md:44-46`, `SETUP.md:650-653`, `SETUP_VI.md:44-46`, and `SETUP_VI.md:597-600` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://get.openclaw.dev | bash ``` The same command appears both in the primary installation instructions and in the abbreviated installation instructions in the English and Vietnamese setup documents. ### Technical Analysis The installation command downloads content from a mutable external URL and immediately passes the response to `bash`. The downloaded payload is not: - Pinned to a specific release or immutable artifact. - Checked against a cryptographic hash. - Verified using a trusted digital signature. - Saved for inspection before execution. - Constrained by a sandbox or reduced-privilege execution environment. Consequently, the effective code executed by users can change after this Skill has been reviewed. Although the domain appears related to the declared OpenClaw platform, the repository provides no mechanism to establish the integrity or provenance of the response at execution time. This behavior is not necessary for the IELTS planning functionality itself. It is only a platform installation convenience, and safer package-based or verified-artifact installation methods are available. ### Attack Path 1. An attacker compromises the installer host, deployment pipeline, DNS resolution, CDN, or another component in the remote delivery chain. 2. The attacker changes the response served by `https://get.openclaw.dev`. 3. A user follows the documented installation command. 4. `curl` retrieves the attacker-controlled response. 5. The shell executes the response immediately without allowing the user to inspect or authenticate it. 6. The payload executes with the privileges of the user running the command and can access that user's files, OpenClaw configuration, API credentials, OAuth data, ...[truncated 642 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash` installation instructions. 2. Publish versioned, immutable release artifacts. 3. Provide a detached signature and a SHA-256 or stronger checksum through an independently protected channel. 4. Require users to download and verify the artifact before executing it. For example: ```bash curl -fSLO https://example.invalid/releases/openclaw-2026.x.y.tar.gz curl -fSLO https://example.invalid/releases/openclaw-2026.x.y.tar.gz.sha256 sha256sum -c openclaw-2026.x.y.tar.gz.sha256 ``` 5. Prefer a package manager that supports signed metadata and pinned versions. 6. Document the expected files, permissions, and actions performed by the installer. 7. Advise users not to execute installation commands as root unless a narrowly scoped operation explicitly requires elevation. 8. Apply the same correction to both English and Vietnamese setup documents and to every abbreviated installation section. ]]>

T08 · Insecure Dependencies

Warning

• Location: SETUP.md:194
• Finding: Third-Party Python Dependency Is Installed Without Version or Integrity Pinning<![CDATA[ ## Vulnerability Details **File Location**: `SETUP.md:194-208` and `README.md:72-75` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash pip3 install gcalcli ``` The setup guide also recommends the following alternatives: ```bash pip3 install --break-system-packages gcalcli # OR use pipx: pipx install gcalcli ``` ### Technical Analysis These commands resolve the latest available `gcalcli` release and its transitive dependencies at installation time. No exact version, lock file, package hash, or reviewed dependency set is supplied. This makes installation behavior dependent on mutable third-party package indexes. A newly compromised, malicious, or incompatible release could be installed even if the Skill itself has not changed. Python package installation may execute build backend or setup logic during installation, making dependency compromise a potential code-execution path. The `--break-system-packages` recommendation additionally bypasses protections intended to prevent modifications to the operating system's managed Python environment. It may create dependency conflicts or replace packages used by other applications. The calendar client itself is necessary for the declared Google Calendar functionality, but installing an unpinned latest version and bypassing system package protections are not necessary. ### Attack Path 1. An attacker compromises the `gcalcli` package, one of its transitive dependencies, a maintainer account, or the package distribution infrastructure. 2. A malicious release becomes the version selected by an unpinned installation command. 3. A user follows the setup instructions. 4. `pip` downloads the malicious release and may execute attacker-controlled build or installation logic. 5. The installed package later runs with access to local Google Calendar OAuth credentials and calendar data. ### Impact Assessment Exploitation could provide code executi ...[truncated 497 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `gcalcli` to a reviewed exact version. 2. Pin transitive dependencies using a lock file generated by a tool such as `pip-tools`. 3. Require package hashes, for example through `pip install --require-hashes -r requirements.txt`. 4. Prefer `pipx` or a dedicated virtual environment to isolate the dependency. 5. Remove the recommendation to use `--break-system-packages`. 6. Document a tested upgrade process and review dependency changes before updating the pinned version. 7. Where available, verify package signatures or trusted publisher metadata. 8. Keep the pinned version consistent across `README.md`, `README_VI.md`, `SETUP.md`, and `SETUP_VI.md`. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SETUP.md:149
• Finding: API Keys and Bot Tokens Are Stored in Plaintext Configuration Files<![CDATA[ ## Vulnerability Details **File Location**: `SETUP.md:149-161`, `SETUP.md:260-272`, `SETUP.md:321-335`, and `SETUP.md:404-418` **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: High ### Vulnerable Code The model API key is placed directly in a JSON configuration file: ```json { "version": 1, "profiles": { "google:default": { "type": "api_key", "provider": "google", "key": "YOUR_GEMINI_API_KEY_HERE" } } } ``` The web-search key is also stored directly in configuration: ```json { "tools": { "web": { "search": { "enabled": true, "provider": "gemini", "gemini": { "apiKey": "YOUR_WEB_SEARCH_API_KEY_HERE" } } } } } ``` The Discord token is stored in plaintext: ```json { "channels": { "discord": { "name": "Jaclyn", "enabled": true, "token": "YOUR_DISCORD_BOT_TOKEN_HERE", "groupPolicy": "open", "streaming": "partial" } } } ``` A similar configuration pattern is documented for the Telegram bot token: ```json { "channels": { "telegram": { "name": "EduClaw", "enabled": true, "token": "YOUR_TELEGRAM_BOT_TOKEN_HERE" } } } ``` ### Technical Analysis The setup instructions direct users to place long-lived API keys and bot tokens directly in files under their OpenClaw configuration directory. The documentation does not require restrictive file permissions, an operating-system secret store, encrypted storage, credential scoping, or redaction from backups and diagnostic archives. The command-line alternatives also pass bot tokens as command arguments: ```bash openclaw channels add \ --channel discord \ --token "YOUR_DISCORD_BOT_TOKEN_HERE" \ --name "Jaclyn" ``` Command-line arguments can be retained in shell history and may be visible to local process inspection tools while the command is executing. The credentials are relevant to optional model, search, ...[truncated 1416 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use an operating-system credential manager, OpenClaw secret facility, or protected environment injection rather than literal secrets in general configuration files. 2. If file storage is unavoidable, store secrets in a separate file with mode `0600` and verify ownership before use: ```bash chmod 600 ~/.openclaw/agents/main/agent/auth-profiles.json chmod 600 ~/.openclaw/openclaw.json ``` 3. Avoid supplying secrets as command-line arguments. Read them from a protected prompt, standard input, file descriptor, or secret manager. 4. Add configuration files and local secret files to `.gitignore`. 5. Document backup exclusion and support-bundle redaction requirements. 6. Restrict API keys by service, project, quota, and other provider-supported controls. 7. Grant Discord and Telegram bots only the minimum permissions needed to send notifications. 8. Remove unnecessary optional Discord privileges such as `Manage Messages`, `Server Members Intent`, and `Presence Intent` unless a concrete feature requires them. 9. Document credential rotation and immediate revocation procedures. 10. Mark the OAuth client JSON path as sensitive metadata even if the path itself is not a secret. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:235
• Finding: Generated Values Are Interpolated into Shell-Executed SQL Without Parameter Binding<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:235-254` and `SKILL.md:882-900` **Vulnerability Type**: Unsafe shell and SQL command construction **Risk Level**: High ### Vulnerable Code The Skill instructs the agent to construct SQL commands by substituting generated values directly into a shell string: ```bash sqlite3 workspace/tracker/educlaw.db "INSERT INTO sessions \ (date, phase, session, skill, topic, event_id, status, duration_min, vocab_count) \ VALUES ('<date>', <phase>, <session_num>, '<skill>', '<topic>', \ '<exact_event_title>', 'Planned', <duration>, 10);" ``` Vocabulary values are handled in the same way: ```bash sqlite3 workspace/tracker/educlaw.db "INSERT INTO vocabulary \ (word, ipa, pos, meaning, collocations, example, topic, session_id) \ VALUES ('<word>', '<ipa>', '<pos>', '<meaning>', '<collocations>', '<example>', '<topic>', \ (SELECT id FROM sessions WHERE event_id='<exact_event_title>'));" ``` Materials are also interpolated: ```bash sqlite3 workspace/tracker/educlaw.db "INSERT OR IGNORE INTO materials \ (title, type, reference, skill, phase, status) \ VALUES ('<title>', '<type>', '<url_or_page>', '<skill>', <phase>, 'Not Started');" ``` Update examples use the same construction pattern: ```bash sqlite3 workspace/tracker/educlaw.db "UPDATE sessions SET status='Completed', score=7.5, notes='Good progress on gap-fill' WHERE event_id='IELTS Phase 1 | Session 1 - Listening: Section 1-2 Gap Fill';" ``` ### Technical Analysis Topics, titles, vocabulary definitions, examples, URLs, and notes can originate from user input, model-generated content, calendar data, or external web resources. The command templates surround these values with SQL quotes but do not define escaping or parameter binding. An apostrophe in an ordinary value such as `student's progress` is sufficient to terminate the intended SQL string and cause an error. Crafted input may append additional SQL expressions or statements. Because ...[truncated 2021 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not generate SQL inside shell command strings. 2. Use Python's `sqlite3` module with parameterized queries: ```python import sqlite3 with sqlite3.connect("workspace/tracker/educlaw.db") as connection: connection.execute( """ INSERT INTO sessions (date, phase, session, skill, topic, event_id, status, duration_min, vocab_count) VALUES (?, ?, ?, ?, ?, ?, 'Planned', ?, ?) """, (date, phase, session_num, skill, topic, event_title, duration, 10), ) ``` 3. Use a single database transaction for each calendar event, session row, vocabulary set, and material set. 4. Validate enumerated fields such as skill, phase, status, duration, and session number against strict allowlists or numeric ranges. 5. Apply length limits and reject control characters in titles, topics, URLs, and notes. 6. Treat web content, calendar content, model output, and user input as untrusted data. 7. Do not attempt to solve this only with manual quote replacement; parameter binding must enforce the data/code boundary. 8. If external commands remain necessary, invoke them through an argument-array API without a shell. 9. Add tests containing apostrophes, double quotes, semicolons, newlines, backticks, and command-substitution sequences. 10. Ensure database synchronization failures cannot leave orphaned calendar events; implement explicit rollback or reconciliation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (59)

External Script Fetching

High

• Category: Supply Chain

Content

### Option A: One-line install (recommended)

```bash
curl -fsSL https://get.openclaw.dev | bash
```

### Option B: npm global install

• Confidence: 97% confidence
• Finding: Piping a remote script directly into bash executes unverified code from the network with no integrity pinning, review step, or signature verification. If the hosting domain, transport, or delivered script is compromised, users can be induced to run arbitrary commands on their system during installation.

Chaining Abuse

High

• Category: Tool Misuse

Content

### Option A: One-line install (recommended)

```bash
curl -fsSL https://get.openclaw.dev | bash
```

### Option B: npm global install

• Confidence: 96% confidence
• Finding: The shell pipeline from curl to bash is a classic chaining pattern that removes the opportunity to inspect downloaded content and directly hands network data to a command interpreter. In a setup guide, this is especially dangerous because it normalizes executing arbitrary remote content during installation.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# 1. Install OpenClaw
curl -fsSL https://get.openclaw.dev | bash

# 2. Run setup wizard (configures API key + model)
openclaw config

• Confidence: 97% confidence
• Finding: The quick-start section repeats the same unsafe remote-script execution pattern, increasing the likelihood that users will follow the most dangerous path. Because quick-start blocks are often copied blindly, this materially raises exploitation risk.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 1. Install OpenClaw
curl -fsSL https://get.openclaw.dev | bash

# 2. Run setup wizard (configures API key + model)
openclaw config

• Confidence: 96% confidence
• Finding: The repeated curl-to-bash chain in the quick-start section compounds risk because users are most likely to copy that concise command without review. Any compromise of the source or path would immediately yield code execution on the host.

External Script Fetching

High

• Category: Supply Chain

Content

### Cách A: Cài một dòng (khuyên dùng)

```bash
curl -fsSL https://get.openclaw.dev | bash
```

### Cách B: Cài qua npm

• Confidence: 98% confidence
• Finding: Fetching and executing a remote installer script from the network is a classic supply-chain risk because any compromise of the hosting domain, transport, or script content results in arbitrary code execution. This is especially dangerous here because later steps configure tokens, OAuth credentials, and a persistent gateway that could all be subverted.

Chaining Abuse

High

• Category: Tool Misuse

Content

### Cách A: Cài một dòng (khuyên dùng)

```bash
curl -fsSL https://get.openclaw.dev | bash
```

### Cách B: Cài qua npm

• Confidence: 97% confidence
• Finding: Chaining curl output directly into bash combines network retrieval and execution in a single step, eliminating inspection barriers and making arbitrary command execution immediate. In setup docs, this pattern is dangerous because users are primed to trust and run it verbatim.

Credential Access

High

• Category: Privilege Escalation

Content

#### Cách A: Dùng file client secret JSON từ Bước 3.2

```bash
gcalcli --client-id /đường/dẫn/client_secret.json list
```

Trình duyệt sẽ mở ra để xác thực. Đăng nhập Google và cho phép.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Cách A: Dùng file client secret JSON từ Bước 3.2

```bash
gcalcli --client-id /đường/dẫn/client_secret.json list
```

Trình duyệt sẽ mở ra để xác thực. Đăng nhập Google và cho phép.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Cách sửa:**
```bash
rm -f ~/.gcalcli_oauth
gcalcli list   # Xác thực lại
```

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Cách sửa:**
```bash
rm -f ~/.gcalcli_oauth
gcalcli list   # Xác thực lại
```

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# 1. Cài OpenClaw
curl -fsSL https://get.openclaw.dev | bash

# 2. Chạy setup wizard (cấu hình API key + model)
openclaw config

• Confidence: 98% confidence
• Finding: The quick-start repeats the same unsafe remote script execution pattern, increasing the likelihood users will follow the shortest path without scrutiny. Repetition in a summary section amplifies the practical exploitation risk of a compromised installer endpoint.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 1. Cài OpenClaw
curl -fsSL https://get.openclaw.dev | bash

# 2. Chạy setup wizard (cấu hình API key + model)
openclaw config

• Confidence: 97% confidence
• Finding: The same chaining pattern is repeated in the quick-start, where users are most likely to copy-paste commands without reading caveats. This meaningfully raises exploitability if the remote installer is altered or intercepted.

Self-Modification

High

• Category: Rogue Agent

Content

1. **Delete Calendar events NOT tracked in the SQLite database** → NEVER delete events that EduClaw did not create. Only events with a matching event_id in `workspace/tracker/educlaw.db` sessions table may be deleted, and ONLY after user confirmation.
2. **Auto-select time slots** → MUST ask user first (Step 0).
3. **Place events outside chosen window** → ASK if blocked, don't auto-move.
4. **Delete files/emails** → Only CREATE and EDIT your own files.
5. **Retry on API errors** → STOP, report, suggest checks.
6. **Skip approval step** → Must have user consent before Calendar events.
7. **Create >14 events at once** → Batch by 2 weeks, ask to continue.

• Confidence: 90% confidence
• Finding: The skill is permitted to create and edit files in the workspace, including the study plan and database, which introduces persistent state changes. If invoked unexpectedly or supplied bad inputs, it can overwrite planning artifacts or corrupt tracking data, and the persistence makes mistakes durable across sessions.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

---

## Channel-Specific Output Rules

### Discord Output
- **Message limit:** 2000 characters max per message. Split if longer.

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

---

## Channel-Specific Output Rules

### Discord Output
- **Message limit:** 2000 characters max per message. Split if longer.

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: The line describes 'Bilingual support (English & Vietnamese) with automatic language detection'. Under the policy rule, forcing or automatically selecting a language/locale without explicit user opt-in can be a natural-language policy concern, because it does not state that users can choose their preferred language.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README advertises web search and Discord-based automation for study planning and progress reporting, but it does not warn users that study schedules, calendar metadata, or progress details may be transmitted to third-party services. This creates a real privacy and data-handling risk because users may enable these integrations without understanding what personal data leaves the local environment.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The setup guide expands the skill’s effective capabilities beyond IELTS planning by enabling Discord and Telegram bot channels, which create externally reachable interfaces for the agent. Even if not inherently malicious, adding network-facing messaging channels increases attack surface, privacy risk, and the chance the skill is used in contexts not clearly disclosed by the manifest.

Session Persistence

Medium

• Category: Rogue Agent

Content

```

This runs the setup wizard. It will:
- Create `~/.openclaw/` directory
- Prompt for model provider and API key
- Set up basic config

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The instructions tell users to place API credentials and bot tokens directly into configuration files without prominent secret-handling guidance. This creates a realistic risk of accidental disclosure through shell history, backups, screenshots, misconfigured file permissions, or committing secrets to source control.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# Make sure the directory exists
mkdir -p ~/.openclaw/workspace/tracker
# Re-create the database
sqlite3 ~/.openclaw/workspace/tracker/educlaw.db \
  < ~/.openclaw/skills/educlaw-ielts-planner-1.0.0/schema.sql

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The setup guide materially expands the skill’s operational scope beyond IELTS planning by adding always-on Discord and Telegram channel integrations. This broadens the attack and privacy surface by enabling inbound messaging, remote control paths, and exposure of user content without that capability being clearly justified by the core workflow.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Piping a remote script directly into bash executes unreviewed code with the user’s privileges and removes the opportunity to inspect integrity or provenance first. In setup documentation, especially for a skill that later handles API keys and calendar access, this creates a strong supply-chain compromise path.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The guide requests Google Calendar read/write OAuth scope without explicitly warning users that the skill will gain access to calendar contents and be able to create or modify events. For a planning assistant this may be functionally relevant, but the missing consent and data-handling notice increases privacy and misuse risk.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 3.1. Lấy Gemini API Key (cho AI model)

1. Truy cập [Google AI Studio](https://aistudio.google.com/apikey)
2. Nhấn **"Create API Key"**
3. Chọn hoặc tạo Google Cloud project
4. Copy API key (bắt đầu bằng `AIzaSy...`)
5. **Quan trọng:** Kiểm tra [billing/quota](https://console.cloud.google.com/apis/api/generativelanguage.googleapis.com/quotas) — free tier có giới hạn. Tăng spending cap nếu cần.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.