T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/analyze.py:67- Finding
Undisclosed Default Access to Agent Identity and Instruction Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Weekly Retro
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a legitimate weekly retrospective tool, but it needs review because it can process private memory logs and also reads agent instruction files by default without clear disclosure.
Before installing, confirm you are comfortable with the skill reading your OpenClaw memory logs and potentially SOUL.md and AGENTS.md, and with generated retrospectives being saved as long-lived files. Use explicit --memory-dir, --soul, --agents, --history, and --output paths where possible, review any WEEKLY_RETRO_CONFIG file, and avoid enabling the cron example until the output location and privacy implications are clear.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill describes reading memory files, potentially accessing environment-derived paths, and writing output files, but it declares no explicit tool scope or permissions boundaries. That makes the operational authority implicit and increases the chance an agent will over-read sensitive local data or write to unintended locations when the skill is invoked.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description contains broad triggers like 'weekly review', 'how was this week', and 'what should change', which can match normal conversation and cause the skill to activate unexpectedly. Because the skill reads memory logs and writes retrospective files, accidental invocation could expose private data processing or create files without the user realizing this specific skill was engaged.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs analysis of memory logs and generation of retrospective files but does not prominently warn that it will process potentially sensitive personal/work history and persist derived summaries to disk. In this context, the absence of privacy and file-output disclosure is risky because retrospective reports can consolidate and amplify sensitive information into a durable artifact.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The script automatically reads SOUL.md and AGENTS.md from default workspace paths under the user's home directory when explicit paths are not provided. In a retrospective skill that analyzes memory logs, this expands data access beyond the direct input and can unintentionally ingest sensitive workspace documents without clear disclosure or consent, creating a privacy boundary issue.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest describes a weekly retrospective that analyzes memory logs, but this script also consults the WEEKLY_RETRO_CONFIG environment variable to locate and load additional configuration. Reading environment state is not an obvious requirement for the stated analytical purpose and expands the skill's capability beyond simple log analysis inputs.
- Content
Static analysis
No suspicious patterns detected.