Security audit

writing-coach-pro

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real writing coach, but it stores writing-derived history and can automatically sync it to a dashboard while also claiming it does not transmit or track data.

Review this carefully before installing if you will process confidential writing. Disable dashboard synchronization unless you intentionally want writing statistics, issue descriptions, and profile changes written to the dashboard backend, and understand that local logs and session history may contain excerpts or sensitive writing-derived metadata.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: config/settings.json:30
Finding: Default-On Dashboard Synchronization May Disclose Writing-Derived Data
Content: View full analysis
Vulnerability Details

File Location: config/settings.json:30-34; related behavior in SKILL.md:432-452, dashboard-kit/DASHBOARD-SPEC.md:8-9,17-20, and conflicting claims in SECURITY.md:23-25
Vulnerability Type: Default-enabled external data synchronization without explicit informed consent
Risk Level: Medium

Vulnerable Code and Configuration

config/settings.json:30-34:

json
"dashboard": { "enabled": true, "sync_after_each_session": true, "progress_report_interval_sessions": 10 }

SKILL.md:432-452:

text
Writing Coach Pro feeds data to the NormieClaw dashboard (if installed). The dashboard kit is in `dashboard-kit/`. ### Data Tables Three tables (full schemas in `dashboard-kit/manifest.json`): - **`wc_sessions`**: One row per review session — date, mode, word count, issues found/accepted, readability metrics, context type - **`wc_issues`**: Individual issues across all sessions — linked to session, categorized by pass (grammar/style/tone/consistency), tracks acceptance - **`wc_profile_history`**: Style profile change log — what changed, old/new values, whether learned or manual ### Dashboard Route & Sync Route: `/writing-coach` — displays stat cards (sessions, words, grade level, acceptance rate), readability trend line, issue category breakdown, acceptance rate over time, and a recent sessions table. After each review session, write a summary row to `wc_sessions` and individual findings to `wc_issues`. Update `wc_profile_history` whenever the style profile changes.

dashboard-kit/DASHBOARD-SPEC.md:8-9,17-20:

text
- NormieClaw Dashboard v1.0+ - Dashboard must support the standard manifest format (see `manifest.json`) - Tables auto-created on first data sync if using Supabase backend

text
1. After each Writing Coach Pro review session, the agent writes a summary row to `wc_sessions` 2. Individual findings are written to `w ...[truncated 2652 chars]
Remediation: View remediation
Remediation Suggestions

Set both dashboard.enabled and dashboard.sync_after_each_session to false by default.

Require explicit, informed opt-in before the first synchronization.

Display the destination backend, whether it is local or remote, and the exact fields that will be transmitted.

Allow users to select which record types may be synchronized.

Redact document excerpts, names, identifiers, and sensitive issue descriptions before synchronization.

Provide a local-only dashboard mode and a visible synchronization status indicator.

Add documented authentication, authorization, encryption, and retention requirements for remote dashboard deployments.

Provide controls to delete both local records and all remotely synchronized records.

Update SECURITY.md to disclose optional remote dashboard transmission and avoid unconditional no-transmission or no-tracking claims.

Consider per-session confirmation when the analyzed document may contain confidential or regulated information.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (25)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SECURITY.md (reported line 37)May include surrounding context.
md
- Review your LLM provider's data handling policies if you process sensitive documents - Use a local model (Ollama, llama.cpp) if you need text to stay on your machine - The `data/` directory contains analysis metadata — protect it like any personal file - Run `rm -rf ~/.openclaw/skills/writing-coach-pro/data` to delete all stored analysis data ## Reporting Issues

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SETUP-PROMPT.md (reported line 90)May include surrounding context.
md
- Review your LLM provider's data handling policies if you process sensitive documents - Use a local model (Ollama, llama.cpp) if you need text to stay on your machine - The `data/` directory contains analysis metadata — protect it like any personal file - Run `rm -rf ~/.openclaw/skills/writing-coach-pro/data` to delete all stored analysis data ## Reporting Issues

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SECURITY.md (reported line 37)May include surrounding context.
md
- Review your LLM provider's data handling policies if you process sensitive documents - Use a local model (Ollama, llama.cpp) if you need text to stay on your machine - The `data/` directory contains analysis metadata — protect it like any personal file - Run `rm -rf ~/.openclaw/skills/writing-coach-pro/data` to delete all stored analysis data ## Reporting Issues

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SECURITY.md (reported line 37)May include surrounding context.
md
- Review your LLM provider's data handling policies if you process sensitive documents - Use a local model (Ollama, llama.cpp) if you need text to stay on your machine - The `data/` directory contains analysis metadata — protect it like any personal file - Run `rm -rf ~/.openclaw/skills/writing-coach-pro/data` to delete all stored analysis data ## Reporting Issues

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SETUP-PROMPT.md (reported line 90)May include surrounding context.
md
- Review your LLM provider's data handling policies if you process sensitive documents - Use a local model (Ollama, llama.cpp) if you need text to stay on your machine - The `data/` directory contains analysis metadata — protect it like any personal file - Run `rm -rf ~/.openclaw/skills/writing-coach-pro/data` to delete all stored analysis data ## Reporting Issues

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README explicitly markets "Persistent Style Memory" that learns user preferences over time, but it does not warn users that their writing characteristics may be stored, retained, or reused. This creates a privacy and consent problem because users may submit sensitive drafts, professional communications, or personal writing without understanding that durable profiling or storage is occurring.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The installation/use instructions advertise a very generic invocation phrase ("review this") that can easily occur in normal conversation or while handling unrelated user text. In an agent-integrated environment, this can cause unintended skill activation on sensitive content, leading to accidental processing, rewriting, or retention of user data by the skill.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Lines L05-L07 state that submitted text is processed by the configured LLM backend and may be sent to a cloud model API, but L23 says the skill 'does not ... transmit data anywhere.' Those statements cannot both be true as written, creating an intent/documentation contradiction about external data flow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup guide advertises trigger phrases like "review this," "full review," and "rewrite this" that are extremely generic and likely to overlap with normal user conversation. In an agent skill system, overly broad invocation patterns can cause unintended activation, making the skill act on content or context the user did not intend to route to this skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The phrase "set up my writing profile" is still broad enough to be said in ordinary conversation and may invoke profile-changing behavior without sufficient user intent verification. Because profile setup can alter persistent settings, ambiguous activation is more dangerous than a read-only help command.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide states that the product tracks which suggestions users accept or reject and adapts over time, but it does not present a clear privacy notice, consent flow, retention policy, or opt-out. Behavioral tracking of writing interactions can expose sensitive preferences and writing habits, especially since user text may contain confidential material.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Automatically feeding writing statistics to an external dashboard increases data-sharing risk, yet the guide does not warn users that their usage metrics may be exposed to another component or environment. Even if limited to statistics, writing telemetry can reveal activity patterns, performance characteristics, and potentially sensitive project metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is designed to persist user writing preferences and learn from writing across sessions, but it does not clearly warn users that their behavioral and stylistic data will be stored. This creates a privacy risk because users may submit sensitive drafts or personal writing without understanding that data is being retained for future profiling.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.
md
Use when the user asks to: - Review, edit, proofread, or polish writing - Check grammar, style, or tone - Rewrite or rephrase text - Score readability or grade level - Check document consistency - Set writing preferences or style guide

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.
md
Always end with "Top 3 Priorities" — the user's attention is finite. Surface what matters most. ### Rewrite Mode **Trigger**: "rewrite this", "polish this", "make this better", "clean this up".

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The learning loop logs detailed interaction history, including suggestion acceptance, context, word counts, and session metrics, without an explicit retention and consent warning. Behavioral tracking of this kind can reveal preferences, work patterns, and potentially sensitive writing habits, creating privacy and secondary-use risks if the files are exposed or reused unexpectedly.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Persistent logs, session histories, profile histories, and dashboard summaries create a broad natural-language data retention surface around user writing activity. Even if full text is not always stored, accumulated metadata and derived summaries can leak sensitive topics, habits, organizational context, and writing content over time.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The dashboard integration propagates writing analytics and profile history into additional tables beyond the primary local profile files, but the skill does not clearly disclose this broader data flow. Replicating metadata across multiple stores increases exposure, makes deletion harder, and raises the risk of unintended access to writing-derived behavioral data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises execution of external shell scripts (export-report.sh and style-check.sh) even though the core capability is writing analysis. This expands the attack surface from passive text processing to arbitrary local command execution, and the documentation provides no trust boundary, validation, or sandboxing requirements for those scripts.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.sh (reported line 31)May include surrounding context.
sh
mkdir -p "${REPORTS_DIR}" # Set permissions — owner only chmod 700 "${DATA_DIR}" chmod 700 "${SESSION_DIR}" chmod 700 "${REPORTS_DIR}"

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.sh (reported line 32)May include surrounding context.
sh
mkdir -p "${REPORTS_DIR}" # Set permissions — owner only chmod 700 "${DATA_DIR}" chmod 700 "${SESSION_DIR}" chmod 700 "${REPORTS_DIR}"

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.sh (reported line 33)May include surrounding context.
sh
mkdir -p "${REPORTS_DIR}" # Set permissions — owner only chmod 700 "${DATA_DIR}" chmod 700 "${SESSION_DIR}" chmod 700 "${REPORTS_DIR}"

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.sh (reported line 56)May include surrounding context.
sh
sed -i "s/TIMESTAMP/${TIMESTAMP}/" "${LEARNING_LOG}" fi fi chmod 600 "${LEARNING_LOG}" echo " → Created ${LEARNING_LOG}" else echo " → Learning log already exists, skipping"

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file instructs users to delete local logs and run SQL DELETE commands to clear stored data, but it does not explicitly warn that these actions are destructive and may permanently remove historical session information. Because the file describes user-data-affecting behavior, a brief warning would improve safety and clarity.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This manifest is in scope for vague-trigger review, and the description only says "Writing analysis trends, style profile, and improvement tracking" without clarifying when the skill should be invoked versus not invoked. The lack of explicit trigger phrases, constraints, or exclusion examples could allow the skill to be matched for general writing-related requests more broadly than intended.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code and Configuration

Remediation Suggestions

SkillSpector

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Missing User Warnings

Vague Triggers

Intent-Code Divergence

Vague Triggers

Vague Triggers

Missing User Warnings

Missing User Warnings

Missing User Warnings

Session Persistence

Session Persistence

Missing User Warnings

Ssd 3

Missing User Warnings

Context-Inappropriate Capability

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

Vague Triggers