Tyche — Habit & Goal Tracker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:09 AM UTC
• Version: 1.0.4

Overview

This invoicing skill appears purpose-aligned and local-only, but it under-discloses saved client billing reports and uses broad installation instructions that deserve review before use.

Install only in a virtual environment, avoid --break-system-packages, and run the skill from a private directory because it saves a Markdown report with client and invoice details by default. Review the separate tyche-pro package before installing it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:86

Finding

Unpinned Python Dependency Installed Outside an Isolated Environment

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:86
Vulnerability Type: Unpinned third-party dependency installation with system package safeguards disabled
Risk Level: Medium

Vulnerable Code:

bash

pip3 install rich --break-system-packages --quiet

Technical Analysis

The installation command does not pin rich to a reviewed version or verify the downloaded distribution using a cryptographic hash. Consequently, the code installed when users follow these instructions can change independently of the audited Skill.

The --break-system-packages option explicitly bypasses protections intended to prevent pip from modifying an externally managed Python environment. This can overwrite or conflict with operating-system-managed packages and increases the blast radius of dependency installation.

This is a supply-chain exposure rather than evidence that the current rich package is malicious. Exploitation requires compromise of the selected package, its distribution channel, dependency resolution, or the configured Python package index.

Attack Path

1. An attacker compromises a package release, transitive dependency, package-index account, distribution channel, or user-configured package source involved in resolving rich.
2. A user follows the documented installation command.
3. Because no exact version or artifact hash is enforced, pip retrieves the attacker-controlled or unexpectedly changed distribution.
4. Package installation logic executes with the privileges of the invoking user.
5. Because --break-system-packages permits modification of the externally managed environment, affected Python components may extend beyond this Skill.
6. If the command is run with elevated privileges, the impact may extend to system-wide Python packages and other applications that rely on them.

Impact Assessment

A compromised dependency could execute arbitrary code with the invoking user's privile ...[truncated 437 chars]

Remediation

View remediation

Remediation Suggestions

• Install dependencies in a dedicated virtual environment rather than the system-managed Python environment.
• Remove --break-system-packages.
• Pin rich and any transitive dependencies to reviewed versions.
• Use a lock file or requirements file with cryptographic hashes, enforced through pip install --require-hashes.
• Configure an approved package index and prevent fallback to untrusted indexes.
• Document installation without administrative privileges.
• Add automated dependency scanning and periodically review pinned versions for known vulnerabilities.

Example hardened workflow:

bash

python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --require-hashes -r requirements.txt

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:99

Finding

Unpinned External Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:99
Vulnerability Type: Unpinned external Skill dependency
Risk Level: Medium

Vulnerable Code:

bash

openclaw skills install tyche-pro
# Set LICENSE_KEY env var to your key from Ko-fi, then run

Technical Analysis

The optional upgrade instructions install the external tyche-pro Skill by name without specifying an immutable version, commit, checksum, or signed artifact. The effective content retrieved by the package manager can therefore change after this project has been audited.

This finding does not establish that tyche-pro is currently malicious. The risk arises because users are instructed to trust mutable third-party content that is outside the reviewed project and whose integrity is not constrained by the command.

Attack Path

1. An attacker compromises the external Skill's publisher account, registry entry, distribution service, or another part of its delivery chain.
2. The attacker publishes a malicious release under the expected tyche-pro identifier.
3. A user follows the documented installation command.
4. Since no version or integrity value is specified, the package manager resolves and installs the attacker-controlled release.
5. The installed Skill gains whatever local tools, files, environment variables, and execution capabilities the OpenClaw runtime grants to Skills.
6. Malicious behavior occurs when installation hooks run, if supported, or when the user invokes the installed Skill.

Impact Assessment

A compromised external Skill could potentially execute instructions or code within the permissions granted by the OpenClaw runtime and invoking user. Depending on that runtime configuration, impact could include reading accessible local data, accessing exposed environment variables, modifying user files, or invoking permitted tools.

This project's reviewed embedded Python code does not itself transmit data or exec ...[truncated 153 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the external Skill to an immutable, reviewed version or content digest.
• Publish and verify a cryptographic checksum or signed release before installation.
• Document the authoritative registry and publisher identity.
• Review the complete external Skill package and its requested permissions before recommending it.
• Apply least-privilege runtime policies and avoid exposing unrelated files, tools, credentials, or environment variables.
• Isolate third-party Skills in a sandbox where available.
• Warn users that the Pro package is separately distributed and was not included in this project's security review.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill persists a Markdown report containing client names, email addresses, invoice amounts, due dates, and statuses to disk, despite security messaging that emphasizes local-only handling. While this is not exfiltration, it creates an additional sensitive-data artifact that may be retained, indexed, backed up, or exposed to other local users and processes without the user's explicit awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code writes a local invoice report containing sensitive business and personal data without prominent advance notice in the skill description. In the context of invoicing, the generated report includes potentially confidential client and financial information, so silent persistence increases the chance of unintended disclosure through shared systems, backups, or later file handling.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The documentation states that client data stays on the machine and no data is transmitted, but omits that the tool also writes a new persistent local file with client billing data. This is a transparency and secure-data-handling issue because users may reasonably expect in-memory/local console processing only, not creation of additional sensitive files.

Content

No source excerpt is available for this finding.