Security audit

Tyche — Habit & Goal Tracker

Security checks for vulnerabilities and agentic risk

Overview

This invoicing skill appears purpose-aligned and local-only, but it under-discloses saved client billing reports and uses broad installation instructions that deserve review before use.

Install only in a virtual environment, avoid --break-system-packages, and run the skill from a private directory because it saves a Markdown report with client and invoice details by default. Review the separate tyche-pro package before installing it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:86
Finding: Unpinned Python Dependency Installed Outside an Isolated Environment## Vulnerability Details **File Location**: `SKILL.md:86` **Vulnerability Type**: Unpinned third-party dependency installation with system package safeguards disabled **Risk Level**: Medium **Vulnerable Code**: ```bash pip3 install rich --break-system-packages --quiet ``` ### Technical Analysis The installation command does not pin `rich` to a reviewed version or verify the downloaded distribution using a cryptographic hash. Consequently, the code installed when users follow these instructions can change independently of the audited Skill. The `--break-system-packages` option explicitly bypasses protections intended to prevent `pip` from modifying an externally managed Python environment. This can overwrite or conflict with operating-system-managed packages and increases the blast radius of dependency installation. This is a supply-chain exposure rather than evidence that the current `rich` package is malicious. Exploitation requires compromise of the selected package, its distribution channel, dependency resolution, or the configured Python package index. ### Attack Path 1. An attacker compromises a package release, transitive dependency, package-index account, distribution channel, or user-configured package source involved in resolving `rich`. 2. A user follows the documented installation command. 3. Because no exact version or artifact hash is enforced, `pip` retrieves the attacker-controlled or unexpectedly changed distribution. 4. Package installation logic executes with the privileges of the invoking user. 5. Because `--break-system-packages` permits modification of the externally managed environment, affected Python components may extend beyond this Skill. 6. If the command is run with elevated privileges, the impact may extend to system-wide Python packages and other applications that rely on them. ### Impact Assessment A compromised dependency could execute arbitrary code with the invoking user's privile ...[truncated 437 chars]
Remediation: ## Remediation Suggestions - Install dependencies in a dedicated virtual environment rather than the system-managed Python environment. - Remove `--break-system-packages`. - Pin `rich` and any transitive dependencies to reviewed versions. - Use a lock file or requirements file with cryptographic hashes, enforced through `pip install --require-hashes`. - Configure an approved package index and prevent fallback to untrusted indexes. - Document installation without administrative privileges. - Add automated dependency scanning and periodically review pinned versions for known vulnerabilities. Example hardened workflow: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ```

T08 · Insecure Dependencies

Warning

Location: SKILL.md:99
Finding: Unpinned External Skill Installation## Vulnerability Details **File Location**: `SKILL.md:99` **Vulnerability Type**: Unpinned external Skill dependency **Risk Level**: Medium **Vulnerable Code**: ```bash openclaw skills install tyche-pro # Set LICENSE_KEY env var to your key from Ko-fi, then run ``` ### Technical Analysis The optional upgrade instructions install the external `tyche-pro` Skill by name without specifying an immutable version, commit, checksum, or signed artifact. The effective content retrieved by the package manager can therefore change after this project has been audited. This finding does not establish that `tyche-pro` is currently malicious. The risk arises because users are instructed to trust mutable third-party content that is outside the reviewed project and whose integrity is not constrained by the command. ### Attack Path 1. An attacker compromises the external Skill's publisher account, registry entry, distribution service, or another part of its delivery chain. 2. The attacker publishes a malicious release under the expected `tyche-pro` identifier. 3. A user follows the documented installation command. 4. Since no version or integrity value is specified, the package manager resolves and installs the attacker-controlled release. 5. The installed Skill gains whatever local tools, files, environment variables, and execution capabilities the OpenClaw runtime grants to Skills. 6. Malicious behavior occurs when installation hooks run, if supported, or when the user invokes the installed Skill. ### Impact Assessment A compromised external Skill could potentially execute instructions or code within the permissions granted by the OpenClaw runtime and invoking user. Depending on that runtime configuration, impact could include reading accessible local data, accessing exposed environment variables, modifying user files, or invoking permitted tools. This project's reviewed embedded Python code does not itself transmit data or exec ...[truncated 153 chars]
Remediation: ## Remediation Suggestions - Pin the external Skill to an immutable, reviewed version or content digest. - Publish and verify a cryptographic checksum or signed release before installation. - Document the authoritative registry and publisher identity. - Review the complete external Skill package and its requested permissions before recommending it. - Apply least-privilege runtime policies and avoid exposing unrelated files, tools, credentials, or environment variables. - Isolate third-party Skills in a sandbox where available. - Warn users that the Pro package is separately distributed and was not included in this project's security review.

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill persists a Markdown report containing client names, email addresses, invoice amounts, due dates, and statuses to disk, despite security messaging that emphasizes local-only handling. While this is not exfiltration, it creates an additional sensitive-data artifact that may be retained, indexed, backed up, or exposed to other local users and processes without the user's explicit awareness.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code writes a local invoice report containing sensitive business and personal data without prominent advance notice in the skill description. In the context of invoicing, the generated report includes potentially confidential client and financial information, so silent persistence increases the chance of unintended disclosure through shared systems, backups, or later file handling.

Intent-Code Divergence

Low

Confidence: 86% confidence
Finding: The documentation states that client data stays on the machine and no data is transmitted, but omits that the tool also writes a new persistent local file with client billing data. This is a transparency and secure-data-handling issue because users may reasonably expect in-memory/local console processing only, not creation of additional sensitive files.

Static analysis

No suspicious patterns detected.