ClawHub
Back to skill

Security audit

Weekly Retro

Security checks for vulnerabilities and agentic risk

Overview

This weekly retrospective skill is mostly coherent, but it reads sensitive local memory and workspace instruction files by default and writes persistent summaries, so users should review its scope before installing.

Install only if you are comfortable with the skill reading your weekly memory logs and creating persistent retrospective outputs. Before use, review or set the memory directory, output vault path, history path, and any WEEKLY_RETRO_CONFIG file; consider disabling or modifying the default SOUL.md and AGENTS.md reads, and avoid the cron example unless you want unattended weekly processing.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/analyze.py:68
Finding

Unnecessary Default Access to Agent Identity and Instruction Files

Content
View full analysis

Vulnerability Details

File Location: scripts/analyze.py:68-89, 680-683
Vulnerability Type: Excessive file-read privileges and violation of least privilege
Risk Level: Medium

Vulnerable Code

python
def scan_for_formalized(soul_path, agents_path):
    """Read SOUL.md and AGENTS.md to find already-formalized patterns."""
    formalized = set()
    for path in [soul_path, agents_path]:
        if path and os.path.exists(path):
            text = Path(path).read_text(encoding='utf-8').lower()
            # Extract key concepts mentioned in operational docs
            # Look for specific workflows, cron jobs, rules that are codified
            if 'cron' in text:
                formalized.add('cron-jobs')
            if 'daily recap' in text or 'daily-recap' in text:
                formalized.add('daily-recap')
            if 'media vault' in text or 'youtube' in text:
                formalized.add('media-vault')
            if 'trending' in text and 'scanner' in text:
                formalized.add('trending-scanner')
            if 'obsidian' in text and 'vault' in text:
                formalized.add('obsidian-vault')
            if 'smart routing' in text or 'model routing' in text:
                formalized.add('model-routing')
            if 'memory' in text and ('daily' in text or 'log' in text):
                formalized.add('memory-logging')
    return formalized
python
# Load SOUL.md / AGENTS.md for formalization detection
soul_path = args.soul or config.get(
    'soul_path',
    os.path.expanduser('~/.openclaw/workspace/SOUL.md')
)
agents_path = args.agents or config.get(
    'agents_path',
    os.path.expanduser('~/.openclaw/workspace/AGENTS.md')
)
formalized = scan_for_formalized(soul_path, agents_path)

Technical Analysis

Every execution of analyze.py attempts to read the complete contents of the default workspace files SOUL.md and AGENTS.md, unless different paths are supplied. This occurs even whe ...[truncated 2013 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove default access to SOUL.md and AGENTS.md. Only read these files when users explicitly provide --soul or --agents.
  2. Alternatively, introduce an explicit opt-in option such as --scan-operational-docs, disabled by default.
  3. Clearly document which files are read, why they are required, and how their contents affect generated analysis.
  4. Validate explicitly supplied paths against an approved workspace root and reject unexpected files or directory traversal outside that boundary.
  5. Replace full-document reads with narrowly scoped structured metadata containing only the formalization identifiers required by the analysis.
  6. Avoid retaining or propagating raw document contents. Ensure errors and generated reports cannot include sensitive source text.
  7. Add tests confirming that ordinary pipeline execution does not open agent identity or instruction files unless explicit consent is provided.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill describes and encourages operations that read from a memory directory and write retrospective files, but the manifest declares no explicit tool scope or permissions boundary. This creates unnecessary ambient authority: if invoked, the agent may access sensitive local files and write outputs without clear least-privilege constraints, increasing the chance of data exposure or unintended file modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description includes broad trigger phrases like 'weekly review,' 'how was this week,' and 'what should change,' which overlap with normal conversation and can cause the skill to activate in contexts the user did not intend. Because this skill reads memory logs and writes reports, accidental invocation can lead to privacy-sensitive analysis and file creation without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation instructs the agent to read memory log files and generate written retrospectives, but it does not warn about sensitive content, retention, consent, or safe storage. In this context, the skill processes longitudinal personal or work history, so missing privacy guidance materially increases the risk of exposing confidential information in generated summaries or persisted vault files.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script reads SOUL.md and AGENTS.md from configurable paths outside the primary gathered-week input, which expands the analyzer's data access to potentially sensitive workspace documents. In a skill that processes memory logs, silently ingesting additional policy/identity files can expose unrelated secrets or personal context and increases the blast radius if the skill is invoked in a broader workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code processes local memory markdown files and extracts potentially sensitive accomplishments, failures, decisions, action items, topics, and tools mentioned, then prepares them for output. Although the module docstring says it reads memory files, there is no explicit user-facing warning in code about the sensitivity of the data being collected and printed to stdout.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest describes a weekly retrospective that analyzes memory logs and answers what should change next week, which suggests analysis/reporting behavior. This file creates and updates a persistent JSON history store on disk, including recommendation status tracking, which is additional stateful record management not disclosed by the manifest description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The stated skill purpose is to analyze past logs and produce a strategic retrospective. The mark-addressed command changes stored recommendation state over time, turning the skill into a lightweight task/status tracker, which is a behavior not reflected in the manifest description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

Using the WEEKLY_RETRO_CONFIG environment variable to locate a config file gives ambient environment state control over what additional files the analyzer reads. While this is common in CLI tools, in an agent/skill context it can cause unexpected file access or policy bypass if the runtime environment is attacker-influenced or simply misconfigured.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The analyzer accesses workspace policy/identity documents without any user-facing notice, even though those files may contain sensitive operational guidance, identity details, or other non-retrospective information. The lack of disclosure undermines least surprise and can lead to overcollection of sensitive data during a seemingly narrow weekly-review task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The manifest describes a retrospective skill that analyzes memory logs, but this script also consults the WEEKLY_RETRO_CONFIG environment variable to locate and load additional configuration. Reading environment-derived configuration is not an obvious requirement of retrospective analysis itself and expands the skill's inputs beyond the stated memory-log scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

A weekly retrospective skill would be expected to read analysis inputs and perhaps a local history file, but this code also consults an environment variable that points to an arbitrary config file and loads JSON from it. That indirection is not clearly part of the manifest's stated purpose and broadens the skill's file-reading surface.

Content

No source excerpt is available for this finding.