Security audit

Turnip Prophet

Security checks for vulnerabilities and agentic risk

Overview

This turnip predictor is mostly coherent, but its optional reminders create persistent scheduled message-sending jobs with misleading behavior and broad setup commands, so it belongs in Review.

Install only if you are comfortable with an optional reminder flow that can add cron jobs sending messages through your OpenClaw identity. Review the generated crontab carefully, prefer not enabling reminders unless needed, and verify removal from crontab because deleting the local config alone may not stop direct-send reminder jobs.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Warning

Location: SKILL.md:168
Finding: Optional Reminder Setup Installs Persistent Cron Jobs with Messaging Authority
Content: View full analysis
&1 | logger -t turnip-prophet 0 12 * * 1-6 /usr/local/bin/openclaw gateway call message.send --params '{"channel":"telegram","target":"8577655544","message":"🔔 Time to check Nook'\''s Cranny turnip prices!"}' 2>&1 | logger -t turnip-prophet 0 20 * * 1-6 /usr/local/bin/openclaw gateway call message.send --params '{"channel":"telegram","target":"8577655544","message":"🔔 Evening price check: Check Nook'\''s Cranny!"}' 2>&1 | logger -t turnip-prophet 45 21 * * 6 /usr/local/bin/openclaw gateway call message.send --params '{"channel":"telegram","target":"8577655544","message":"⏰ FINAL CALL: Turnips expire at 10 PM! Sell now or they'\''ll rot 🗑️"}' 2>&1 | logger -t turnip-prophet ``` ```bash # If it looks good, install: (crontab -l 2>/dev/null; cat /tmp/turnip-cron-$$.txt) | crontab - ``` ### Technical Analysis The setup adds commands to the user's persistent crontab. These commands survive the current skill invocation and repeatedly invoke `openclaw gateway call message.send` using the user's existing OpenClaw configuration and messaging credentials. Scheduled reminders are relevant to the optional reminder feature, and the documentation requires an explicit confirmation before installation. Therefore, the mechanism is not covert. Nevertheless, cron persistence is not required for the skill's core turnip-price prediction functionality and grants materially broader authority than local prediction and chart generation require. The installation operation also appends ...[truncated 1508 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:165
Finding: Generated Cron Entries Bypass the Data-Aware Handler and Send Messages Unconditionally
Content: View full analysis
&1 | logger -t turnip-prophet 0 12 * * 1-6 /usr/local/bin/openclaw gateway call message.send --params '{"channel":"telegram","target":"8577655544","message":"🔔 Time to check Nook'\''s Cranny turnip prices!"}' 2>&1 | logger -t turnip-prophet 0 20 * * 1-6 /usr/local/bin/openclaw gateway call message.send --params '{"channel":"telegram","target":"8577655544","message":"🔔 Evening price check: Check Nook'\''s Cranny!"}' 2>&1 | logger -t turnip-prophet 45 21 * * 6 /usr/local/bin/openclaw gateway call message.send --params '{"channel":"telegram","target":"8577655544","message":"⏰ FINAL CALL: Turnips expire at 10 PM! Sell now or they'\''ll rot 🗑️"}' 2>&1 | logger -t turnip-prophet ``` The setup instructions subsequently claim: ```text ✅ Reminders configured. You'll only get pings for missing data. ``` The documented conditional handler instead sends through: ```bash "$OPENCLAW_BIN" gateway call message.send --params "{\"channel\":\"$CHANNEL\",\"target\":\"$TARGET\",\"message\":\"...\"}" ``` ### Technical Analysis The generated cron examples directly invoke `message.send`; they do not call `scripts/cron_handler.sh`. As a result, the jobs do not inspect `memory/turnip-week.json` and cannot suppress reminders for prices that are already present. This conflicts with the stated behavior that users will “only get pings for missing data.” The direct commands also duplicate channel and target identifiers in the crontab instead of relying on the local configuration consumed ...[truncated 1187 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:192
Finding: Predictable Temporary Cron File Permits Symlink and Race Attacks
Content: View full analysis
/tmp/turnip-cron-$$.txt <<'TURNIP_EOF' [generated entries] TURNIP_EOF # Review the file cat /tmp/turnip-cron-$$.txt # If it looks good, install: (crontab -l 2>/dev/null; cat /tmp/turnip-cron-$$.txt) | crontab - ``` ### Technical Analysis The temporary file name is derived only from the shell process ID and is created through ordinary redirection. The operation does not use `mktemp`, exclusive creation, ownership validation, restrictive permissions, or cleanup. In a shared local environment, another user can predict or monitor process IDs and pre-create `/tmp/turnip-cron-.txt` as a symbolic link. When the victim executes the generated command, shell redirection follows the link and truncates or overwrites a file writable by the victim. There is also a time-of-check/time-of-use interval between reviewing the file and installing it. A local attacker able to replace or alter the temporary file after review can cause different cron content to be installed. ### Attack Path 1. An attacker with access to the shared `/tmp` namespace predicts or detects the victim shell's PID. 2. The attacker creates `/tmp/turnip-cron-.txt` as a symbolic link to a file writable by the victim, or arranges to replace the temporary file after it is reviewed. 3. The victim runs the documented `cat > /tmp/turnip-cron-$$.txt` command. 4. The shell follows the symbolic link and overwrites the linked file with cron content. 5. Alternatively, the attacker changes the temporary file between `cat` review and the final `crontab` command. 6. The victim installs attacker-controlled scheduled commands into their own crontab. ### Impact Assessment A successful symlink attack can overwrite or corrupt any file writable by the victim account. A successf ...[truncated 247 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:12
Finding: Unpinned Dependency Installation Uses Mutable Package Sources
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The advertised purpose is turnip price prediction, but the skill also implements reminder setup, stores messaging identifiers, and prepares scheduled outbound messages via cron and a gateway API. This hidden or under-disclosed behavior materially expands the trust boundary from local computation into persistent automation and message sending on the user's behalf.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The advertised purpose is turnip price prediction, but the skill also implements reminder setup, stores messaging identifiers, and prepares scheduled outbound messages via cron and a gateway API. This hidden or under-disclosed behavior materially expands the trust boundary from local computation into persistent automation and message sending on the user's behalf.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 87% confidence
Finding: The chained command sudo apt-get update && sudo apt-get install -y jq combines privileged package-management operations in one step, reducing review granularity and increasing the risk of unintended system changes. In a skill context, command chaining makes it easier to hide or normalize broader system modification than is necessary for a prediction feature.
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
"id": "jq-debian", "kind": "shell", "label": "Install jq (Debian/Ubuntu)", "command": "sudo apt-get update && sudo apt-get install -y jq", "when": "debian" }, {

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
- OpenClaw binary path - Setup timestamp **Why:** These values are needed so the cron reminders can send messages to the correct place without hard-coded values. **Where:** Stored locally in the skill's memory directory on your OpenClaw instance. Not shared, not uploaded, not visible to anyone else.

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
md
- OpenClaw binary path - Setup timestamp **Why:** These values are needed so the cron reminders can send messages to the correct place without hard-coded values. **Where:** Stored locally in the skill's memory directory on your OpenClaw instance. Not shared, not uploaded, not visible to anyone else.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
How to disable/reset:

bash
rm ~/.openclaw/workspace/skills/turnip-prophet/memory/turnip-config.json

Removing cron entries:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.
• Location: memory/turnip-config.json (local only)

This data is stored locally on your machine and is needed so cron reminders can send messages to you. You can delete the config file anytime with: rm memory/turnip-config.json

Continue? Reply 'confirm' to proceed, or 'cancel' to skip.

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.
(crontab -l 2>/dev/null; cat /tmp/turnip-cron-$$.txt) | crontab -

text
3. Ask user to run the commands and confirm when done 4. Reply: "✅ Reminders configured. You'll only get pings for missing data. Check `crontab -l` to verify installation. To remove: `rm memory/turnip-config.json` and remove the cron entries." **On rejection/cancel:** - Reply: "No problem. No data was stored. You can set this up anytime by asking about turnip prices again."

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes shell commands for installation, file checks, Python execution, and cron setup but does not declare an explicit tool scope or permissions boundary. That makes the operational capability broader than what a reviewer or platform policy can easily enforce, increasing the chance of unintended command execution and reducing transparency.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The installation flow includes sudo apt-get update && sudo apt-get install -y jq, which encourages privileged system modification from within the skill. Even if intended for convenience, prompting or embedding root-level package installation increases the blast radius of compromise and can violate least-privilege expectations.
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
"id": "jq-debian", "kind": "shell", "label": "Install jq (Debian/Ubuntu)", "command": "sudo apt-get update && sudo apt-get install -y jq", "when": "debian" }, {

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
text
memory/turnip-week.json

This contains the buy price, previous pattern, and all known prices for the current week. Do not ask the user for data you already have. Only ask for new/missing prices.

When the user gives a new price, update memory/turnip-week.json immediately with the new value before running the prediction.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
}

text
On Sundays, create a fresh file with the new buy price and reset prices to all nulls. ## Triggers

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The skill instructs users to manage cron entries, indicating persistent scheduled execution beyond the immediate session. Persistence significantly increases risk because the skill's behavior continues automatically and can keep invoking local tools and messaging actions without fresh per-run review.
Content: Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.
Removing cron entries:

bash
# Edit crontab and remove the turnip-prophet lines crontab -e

Important: You must explicitly confirm the setup flow before any config is saved. Declining the setup offer means nothing is stored.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 93% confidence
Finding: The provided install command appends generated entries directly into the user's crontab, establishing durable scheduled execution. Persistent tasks can outlive user awareness, repeatedly trigger outbound messaging, and are difficult to audit if mixed into an existing crontab.
Content: Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.
cat /tmp/turnip-cron-$$.txt

If it looks good, install:

(crontab -l 2>/dev/null; cat /tmp/turnip-cron-$$.txt) | crontab -

text
3. Ask user to run the commands and confirm when done 4. Reply: "✅ Reminders configured. You'll only get pings for missing data. Check `crontab -l` to verify installation. To remove: `rm memory/turnip-config.json` and remove the cron entries."

Session Persistence

Medium

Category: Rogue Agent
Confidence: 89% confidence
Finding: The instruction to verify via crontab -l is part of the same persistence mechanism and reinforces continued scheduled execution. In context, the danger is not the listing command itself but the normalized setup of long-lived automation for a skill whose primary purpose is presented as prediction.
Content: Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.
(crontab -l 2>/dev/null; cat /tmp/turnip-cron-$$.txt) | crontab -

text
3. Ask user to run the commands and confirm when done 4. Reply: "✅ Reminders configured. You'll only get pings for missing data. Check `crontab -l` to verify installation. To remove: `rm memory/turnip-config.json` and remove the cron entries." **On rejection/cancel:** - Reply: "No problem. No data was stored. You can set this up anytime by asking about turnip prices again."

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · test_turnip_predictor.py (reported line 24)May include surrounding context.
python
scripts_dir = os.path.join(skill_dir, 'scripts') # Run the predictor process = subprocess.Popen( ['python3', 'turnip_predict.py'], cwd=scripts_dir, stdin=subprocess.PIPE,

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The send_message function invokes an external gateway command to transmit messages to a configured channel and target, which is a network/data-transmission operation. In this file there is no confirmation prompt or user-facing warning at the point of transmission; only internal comments and syslog logging are present.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script writes to a caller-controlled output_path with no validation or restriction, so an upstream caller can cause files to be created or overwritten at arbitrary locations accessible to the process. In isolation this is a common utility pattern, but in an agent skill context it can become path traversal or unintended file overwrite if user input is forwarded into this argument.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T06 · System Persistence

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tp4

Tp4

Chaining Abuse

Exfiltration Commands

Exfiltration Commands

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Undeclared Tool Scope

Sudo/Root Execution

Autonomous Decision Making

Session Persistence

Session Persistence

Session Persistence

If it looks good, install:

Session Persistence

subprocess module call

Missing User Warnings

Missing User Warnings

Static analysis