T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/mastery_score.py:90- Finding
Overbroad Access to Agent Memory Logs
- Content
View full analysis
- Remediation
View remediation
Security audit
Learning System Skill
Security checks for vulnerabilities and agentic risk
Overview
This learning-note skill is mostly coherent, but it can read broad local memory logs and may send weekly summaries through Feishu without clear confirmation.
Install only if you are comfortable with the skill reading OpenClaw memory logs and learning notes to build summaries and scores. Before using weekly review, disable or confirm any Feishu sending, verify the recipient, and avoid --quick unless you have reviewed exactly what files and changes will be used.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Warning
- Location
SKILL.md:112- Finding
Weekly Review Requires Unconfirmed External Delivery Through Feishu
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description, commands context, and operating instructions are entirely presented in Chinese, with no indication that users may choose another language or locale. Under the policy criteria, a skill that effectively mandates a specific language without opt-in or documented regional justification is a natural-language policy violation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
2. 初始化笔记目录
bash mkdir -p ~/.openclaw/workspace/notes/areas/{deep-dives,weekly-reviews}3. 运行
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to read local files such as memory logs, PR records, templates, and knowledge-map documents, but the manifest does not declare any tool scope or allowed-tools. This creates an authorization transparency gap: the agent may access repository or workspace content without an explicit permission boundary, making unintended data exposure more likely if the skill is invoked broadly.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include very common expressions like '总结一下', 'recap', and 'what did I learn', which can match ordinary conversation and cause unintended activation. In this skill, accidental invocation is more dangerous because activation can lead to reading memory logs, PR history, and notes, and in review mode may also send a summary via Feishu.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill says it will 'automatically determine' the most appropriate mode from context when no parameter is provided, but it does not define strict activation constraints. This ambiguity can cause the agent to choose a more invasive mode than the user intended, including reading historical files or producing and sending a weekly summary.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Weekly review mode states that it will send a summary to the user via Feishu, but this outbound messaging capability is not disclosed in the manifest description. Undisclosed exfiltration or external transmission channels are security-relevant because users may trigger the skill expecting local note management, while the skill can transmit synthesized content externally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill description presents the capability as a learning and note-management system but omits that weekly review mode sends a summary through Feishu. This missing warning materially affects user consent because sensitive work summaries derived from logs, PRs, and notes may be transmitted off-platform without the user realizing it.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire guide is written as prescriptive operational content in Chinese, including headings, instructions, and report templates, with no indication that the user may choose another language. Under the policy rule for natural-language violations, this is a locale/language constraint that lacks user opt-in or a documented region-specific justification.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guide instructs the agent to send a weekly summary via Feishu to a named recipient, which expands the skill from internal knowledge management into external communication. That creates a data-exfiltration and unauthorized-messaging path because collected logs, notes, and knowledge-map changes may contain sensitive work context, and the messaging action is not necessary to the core learning-system function as described.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This Python file contains natural-language docstrings and generated report text entirely in Chinese, indicating the skill is designed to operate in a single language with no visible opt-in or locale selection. The stated policy flags language or locale constraints when a skill forces a specific language without user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This Python skill hard-codes Chinese locale strings in comments and user-facing output, including proficiency labels and later report text, without any opt-in or language selection mechanism. That can violate language/locale policy because the skill imposes a specific language on users regardless of preference.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill metadata and triggers are predominantly Chinese-centric, while also mixing in a few English terms without clearly documenting locale behavior or offering user choice. This can lead to inconsistent activation, exclusion of users in other locales, and misrouting of requests when language expectations are unclear, though it is more of a robustness and access-control issue than a direct security exploit.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list includes very broad terms such as "learning" and "study", which are common in ordinary conversation and can cause the skill to activate unexpectedly. This increases the risk of incorrect routing, unintentional access to learning-system behavior, and reduced reliability of the agent, especially in multilingual environments where these generic triggers overlap with many benign requests.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The manifest-level argument hint at L004 lists only deep-dive, recap, review, and health modes, but the file later documents an additional 'mastery' mode that runs
scripts/mastery_score.py. This creates a description-to-behavior mismatch because the exposed behavior documented in the skill body exceeds the manifest's declared invocation surface.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file contains user-facing natural-language instructions entirely in Chinese, and there is no indication that the skill is region-specific or that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire template is written as a required Chinese-language structure, with no indication that users may choose another language or that the template is specifically intended for a Chinese-only context. This can violate a language/locale policy when skills should not force a specific language without user opt-in.
- Content
Static analysis
No suspicious patterns detected.