Security audit

Daily Commit Logbook

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its logbook automation purpose, but its setup scripts make broad persistent changes and have an unsafe executable .env configuration path.

Review before installing. Use this only in a workspace where you are comfortable with recurring OpenClaw cron jobs, Telegram delivery, GitHub/GitLab activity reads, and possible MIS submission. Avoid running setup until .env handling is fixed, and back up HEARTBEAT.md plus crontab or OpenClaw cron configuration first.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup-cron.sh:112
Finding: Persistent Shell Command Injection Through Executable .env Configuration
Content: View full analysis
"$CONFIG_FILE" <
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: scripts/setup-cron.sh:129
Finding: Destructive Overwrite of Shared Persistent Agent Heartbeat Instructions
Content: View full analysis
"$WORKSPACE/HEARTBEAT.md" <<'EOF' # Heartbeat Tasks Daily logbook draft delivery is handled directly by OpenClaw cron in the Telegram session. If nothing else needs attention, reply HEARTBEAT_OK. EOF echo "[OK] Updated HEARTBEAT.md to remove the old pending-file delivery path" ``` ### Technical Analysis The scheduler setup replaces the entire workspace-level `HEARTBEAT.md` file. This file is treated by the surrounding Agent environment as persistent behavioral state. The operation does not preserve unrelated heartbeat tasks, does not delimit a Skill-owned section, and does not request confirmation before destroying existing content. Installing a dedicated OpenClaw cron job does not require replacement of global heartbeat instructions. The modification therefore exceeds the minimum state changes necessary for the declared scheduling functionality. Although the replacement text is fixed rather than derived from a remote source, it persistently changes future Agent behavior and can suppress unrelated tasks by deleting their instructions. ### Attack Path 1. A workspace contains existing `HEARTBEAT.md` instructions for unrelated monitoring, reporting, or maintenance tasks. 2. A user runs the documented daily scheduler setup command. 3. `setup-cron.sh` truncates and replaces the complete file without a backup or content merge. 4. The Agent no longer receives the previous heartbeat instructions. 5. In future sessions, heartbeat processing follows only the replacement content and may return `HEARTBEAT_OK` instead of executing previously configured tasks. ### Impact Assessment The issue can disable unrelated persistent Agent workflows across the entire selected workspace. Its scope is not limited to this Skill because `HEARTBEAT.md` is workspace-level state. ...[truncated 260 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup-cron.sh:123
Finding: Overbroad Crontab Cleanup Can Alter Unrelated Scheduled Jobs
Content: View full analysis
/dev/null || true) FILTERED_CRONTAB=$(printf "%s\n" "$EXISTING_CRONTAB" | grep -vF "$SKILL_DIR/scripts/cron-generate.sh" | grep -vF "# Daily logbook report -" | grep -vE '^CRON_TZ=(Asia/Jakarta|UTC)$' || true) printf "%s\n" "$FILTERED_CRONTAB" | crontab - ``` ### Technical Analysis The setup script reads and rewrites the user's complete crontab while filtering lines by broad textual patterns. In particular, it removes every line exactly matching `CRON_TZ=Asia/Jakarta` or `CRON_TZ=UTC`, regardless of whether that directive belongs to this Skill. A `CRON_TZ` declaration can govern unrelated jobs that follow it. Removing the declaration while retaining those jobs silently changes their execution timezone. The generic comment filter can likewise remove unrelated comments that happen to contain the same phrase. This cleanup is unnecessary for installing the new OpenClaw job. The script should remove only legacy entries that can be unambiguously attributed to this Skill. ### Attack Path 1. The user has an existing crontab containing unrelated jobs and a `CRON_TZ=UTC` or `CRON_TZ=Asia/Jakarta` directive. 2. The user runs `scripts/setup-cron.sh` as documented. 3. The script removes all matching timezone directives while preserving the associated unrelated jobs. 4. It installs the filtered content as the user's new crontab. 5. The unrelated jobs subsequently execute according to the cron daemon's default timezone instead of their intended timezone. ### Impact Assessment The script can change the behavior of unrelated scheduled tasks belonging to the same operating-system account. Possible consequences include jobs running at unintended times, missed maintenance windows, duplicated operations, or time-sensitive au ...[truncated 267 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the skill can directly submit MIS logbooks or bypass the stated approval step, that weakens an explicit human-review control and can cause unauthorized or incorrect submissions. In this context, the skill handles external reporting workflows, so approval bypass materially increases the risk of accidental disclosure, false records, or unintended actions on behalf of the user.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: If the skill can directly submit MIS logbooks or bypass the stated approval step, that weakens an explicit human-review control and can cause unauthorized or incorrect submissions. In this context, the skill handles external reporting workflows, so approval bypass materially increases the risk of accidental disclosure, false records, or unintended actions on behalf of the user.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: If the skill can directly submit MIS logbooks or bypass the stated approval step, that weakens an explicit human-review control and can cause unauthorized or incorrect submissions. In this context, the skill handles external reporting workflows, so approval bypass materially increases the risk of accidental disclosure, false records, or unintended actions on behalf of the user.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: If the skill can directly submit MIS logbooks or bypass the stated approval step, that weakens an explicit human-review control and can cause unauthorized or incorrect submissions. In this context, the skill handles external reporting workflows, so approval bypass materially increases the risk of accidental disclosure, false records, or unintended actions on behalf of the user.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate-report.sh (reported line 18)May include surrounding context.
sh
WORKSPACE="$(resolve_workspace "$DAILY_DIR")" export OPENCLAW_WORKSPACE="$WORKSPACE" CONFIG_FILE="$DAILY_DIR/.env" if [ -f "$CONFIG_FILE" ]; then set -a # shellcheck disable=SC1090

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate-weekly-report.sh (reported line 17)May include surrounding context.
sh
WORKSPACE="$(resolve_workspace "$DAILY_DIR")" export OPENCLAW_WORKSPACE="$WORKSPACE" CONFIG_FILE="$DAILY_DIR/.env" if [ -f "$CONFIG_FILE" ]; then set -a # shellcheck disable=SC1090

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/setup-cron.sh (reported line 67)May include surrounding context.
sh
WORKSPACE="$(resolve_workspace "$DAILY_DIR")" export OPENCLAW_WORKSPACE="$WORKSPACE" CONFIG_FILE="$DAILY_DIR/.env" if [ -f "$CONFIG_FILE" ]; then set -a # shellcheck disable=SC1090

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description and overview repeatedly state that the skill generates Indonesian summaries and logbook text, but do not offer a language choice or explicit opt-in. That creates a natural-language locale policy concern because the skill appears to force a specific language by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document states that it provides standards for generating internship logbook entries in Indonesian, which sets a fixed language requirement. Because the file does not present this as an optional preference or explain a region-specific compliance need, it constitutes a natural-language locale policy concern under the stated rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: These lines explicitly label mixed English as incorrect and prescribe full Indonesian as the correct form. That is a direct language-policy constraint, and the file does not indicate that users may choose their preferred language or that the restriction is limited to a documented locale-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON file contains natural-language summaries in Indonesian (for example, 'Backend utama...' and 'Contoh project pribadi...') but does not indicate that the skill is intentionally locale-specific or that users can opt into that language. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The extraction logic only recognizes Indonesian headings such as "Versi 2", "Aktivitas", and "Hasil". This creates a language-specific behavior in the skill without offering user choice or documenting a justified locale restriction, which matches the natural-language policy concern for forced language/locale assumptions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code fixes the locale and generated report content to Indonesian/WIB context, including Indonesian date formatting and Indonesian report text, without any user opt-in or configurable language selection. That is a natural-language policy concern because it forces a specific language/locale choice on all users of the script.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code emits user-facing status text in Indonesian, and the pattern continues throughout the script in titles, notes, and generated report prose. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script emits user-facing status and approval messages entirely in Indonesian, and the same language continues through the final confirmation text. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The approval request presented to the user is fully in Indonesian and directly instructs the user how to respond, but there is no indication that the user can choose another language. This matches the policy's example of a language/locale constraint imposed without user opt-in.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script's stated purpose is to generate a report and print a WhatsApp-ready confirmation, but it also performs a live MIS submission as a side effect via submit-logbook.js. This creates a dangerous trust boundary issue: a user or calling agent may invoke it expecting read-only formatting behavior, yet it modifies an external system and can create unintended submissions or duplicate operational actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script unconditionally overwrites the skill-local .env file with a here-doc containing only GITHUB_USER. This can silently destroy existing configuration, including unrelated settings or secrets stored in that file, causing misconfiguration or credential loss; in a skill that manages automated reporting, unexpected local config mutation is operationally risky.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: The script inspects and rewrites the user's crontab as part of installing a recurring delivery workflow, which establishes persistence beyond the current execution. In the context of an automation skill that also writes OpenClaw cron jobs and sends messages to Telegram, this increases the risk of unintended long-lived behavior and makes removal or auditing harder if the user did not explicitly approve it.
Content: Scanner excerpt · scripts/setup-cron.sh (reported line 123)May include surrounding context.
sh
echo " Telegram target: $TELEGRAM_CHAT" echo "" EXISTING_CRONTAB=$(crontab -l 2>/dev/null || true) FILTERED_CRONTAB=$(printf "%s\n" "$EXISTING_CRONTAB" | grep -vF "$SKILL_DIR/scripts/cron-generate.sh" | grep -vF "# Daily logbook report -" | grep -vE '^CRON_TZ=(Asia/Jakarta|UTC)$' || true) printf "%s\n" "$FILTERED_CRONTAB" | crontab -

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script removes entries from the user's crontab and later restarts the OpenClaw gateway without any confirmation or dry-run safeguard. Modifying persistence and restarting a service are privileged, state-changing actions that can disrupt other scheduled jobs, create availability issues, and establish long-lived automated behavior the user may not fully intend.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This shell script creates the cron directory, initializes jobs.json if absent, and then rewrites the cron configuration before moving it into place. Although it prints success messages afterward, there is no confirmation prompt or explicit warning before changing persistent scheduler state, which is a safety-relevant file modification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script invokes openclaw gateway restart, which is a service-affecting subprocess operation that can interrupt running work or alter system behavior. While there is an informational echo immediately before execution, it does not ask for confirmation and the file lacks an upfront warning that setup will restart the gateway.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This shell script emits all user-facing status and error messages in Indonesian, including confirmations, failures, and success summaries. Forcing a specific language without user opt-in matches the natural-language policy violation criteria, and the file does not document that the skill is intentionally restricted to Indonesian-speaking users or a locale-specific workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The setup instructions encourage installation of recurring cron jobs and writing local configuration without clearly warning that these are persistent system changes. That can lead users to unknowingly create long-lived automated tasks that continue accessing repos, generating messages, or using credentials after initial setup, increasing the chance of unintended data exposure or operational abuse.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/generate-report.js:75

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/generate-weekly-report.js:345