Security audit

Conversation Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill openly does conversation memory and task analysis, but it asks to profile users, retain chat-derived information, run on a schedule, and send task reminders externally without enough consent, scoping, or recipient controls.

Review this before installing if your OpenClaw conversations include private, work, customer, or personal information. Enable it only if you are comfortable with recurring chat analysis, long-term profile and memory files, and Feishu task notifications; configure recipients carefully and consider disabling cron or external notifications until there are clear review and deletion controls.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:103
Finding: Overbroad Conversation History and Persistent Workspace Access
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:103-116
Vulnerability Type: Excessive access to conversation history, session state, and persistent user records
Risk Level: Medium

Vulnerable Code

markdown
### Input Files - `HEARTBEAT.md` - Conversation counter, task tracking - `USER.md` - User profile records - `MEMORY.md` - Long-term memory, conversation analysis history - `SESSION-STATE.md` - Current session state - Chat history (via sessions_history tool) ### Output Files - `USER.md` - Updated user profile - `MEMORY.md` - Appended conversation analysis - `HEARTBEAT.md` - Reset conversation counter - Feishu messages - Task notifications

The resulting profile includes potentially sensitive behavioral and personal attributes:

markdown
- **Personal Traits**: Personality, communication style, decision-making patterns - **Preferences**: Technical preferences, tool choices, content types - **Skills**: Tech stack, professional capabilities, familiar domains - **Experience**: Career path, project experience, growth trajectory - **Background**: Work environment, team role, industry background - **Emotional State**: Stress level, satisfaction, focus areas - **Current Activities**: Current projects, key tasks, daily activities - **Future Goals**: Goals, plans, expectations

Technical Analysis

The Skill requests access to complete chat history through sessions_history and multiple persistent workspace files, including SESSION-STATE.md, USER.md, and MEMORY.md. It then directs the host agent to derive and retain personality, emotional-state, professional-background, and future-goal information.

Access to recent conversations and task records is relevant to conversation summarization. However, systematic behavioral profiling and unrestricted access to session state exceed the minimum permissions necessary for basic summarization and incomplete-task detection. No ...[truncated 1462 chars]
Remediation: View remediation
Remediation Suggestions

Request explicit user consent before accessing conversation history, session state, or persistent memory.

Default to the current conversation rather than complete session history.

Remove access to SESSION-STATE.md unless a concrete feature requires it.

Separate task tracking from personality profiling and make profiling an independent, disabled-by-default option.

Avoid collecting emotional state, personal background, and future goals unless the user explicitly requests those fields.

Implement configurable retention limits and automatic deletion of stale analysis.

Present proposed updates to USER.md and MEMORY.md for user review before writing them.

Mark uncertain conclusions as inferences and allow users to correct or delete them.

Restrict file access to an explicit allowlist under the configured workspace and reject paths resolved outside that directory.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:50
Finding: Conversation-Derived Task Information May Be Disclosed Through Feishu Without Recipient Validation
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:50-57
Vulnerability Type: Uncontrolled external disclosure of task and conversation metadata
Risk Level: Medium

Vulnerable Code

markdown
**Execution:** - List incomplete tasks - Send inquiry messages via Feishu - If no incomplete tasks, send "No incomplete tasks found"

The declared outputs confirm that Feishu is treated as an external notification destination:

markdown
### Output Files - `USER.md` - Updated user profile - `MEMORY.md` - Appended conversation analysis - `HEARTBEAT.md` - Reset conversation counter - Feishu messages - Task notifications

Technical Analysis

The Skill directs the host agent to send conversation-derived incomplete-task information through Feishu. It does not define an approved recipient, workspace, tenant, channel, content-redaction policy, or confirmation step.

Task descriptions can contain confidential project names, deadlines, internal identifiers, customer information, or other material copied from HEARTBEAT.md, WORKING.md, MEMORY.md, and conversation history. Sending those details to an incorrectly configured Feishu destination creates an external disclosure risk.

The bundled scripts do not contain a Feishu API client or perform direct network requests. scripts/check-tasks.js only prints proposed notification contents, while scripts/analyze.js and scripts/daily-analysis.js emit instructions for the host agent. Consequently, the disclosure occurs only if the host agent follows those instructions and has access to a Feishu messaging tool.

Attack Path

The Skill reads task data from workspace files or directs the host agent to inspect conversation history.

An incomplete task containing sensitive information is identified.

The Skill generates or requests a Feishu notification containing task metadata.

The host agent uses its configured Feishu integration without ...[truncated 764 chars]
Remediation: View remediation
Remediation Suggestions

Make Feishu notifications disabled by default and require explicit user opt-in.

Require an allowlisted Feishu tenant and recipient identifier configured specifically for this Skill.

Display the destination and proposed message to the user before the first transmission and whenever the destination changes.

Send only aggregate counts by default rather than task names or descriptions.

Redact credentials, customer names, internal URLs, personal information, and other sensitive content before transmission.

Require per-message confirmation for notifications containing conversation-derived text.

Clearly document which data leaves the local workspace and through which external service.

Record auditable notification metadata without storing full sensitive message bodies.

Update the documentation to clarify that the included JavaScript only prepares notification content and that actual transmission requires a separately authorized host tool.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: There is a material description-behavior mismatch. The description says the skill performs intelligent conversation analysis, summarization, conclusion recording, personality analysis, task tracking, incomplete-task checking, and memory writes. However, this code is primarily an orchestration/trigger script: it updates a heartbeat counter, checks a threshold every 10 conversations, emits console instructions, and returns metadata describing tasks for another system ('OpenClaw') to execute. The only concrete file modification performed here is to HEARTBEAT.md. USER.md and MEMORY.md are not actually updated by this script, and no real analysis of conversation content occurs. The incomplete-task check and Feishu notification are also only described in logs/returned objects, not executed. Because the implemented primary behavior is a counter/trigger mechanism plus task scaffolding rather than actual analysis and recording, the declared purpose overstates what the supplied code chunk does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description only partially matches the code. The code's actual primary function is incomplete-task checking based on markdown files in a workspace, which aligns with the 'checks incomplete tasks' portion. However, most of the declared functionality—intelligent conversation analysis, summarization, personality analysis, and conclusion recording—is not implemented in this chunk. Additionally, the description says it 'writes to memory files,' but this script only reads MEMORY.md, HEARTBEAT.md, and WORKING.md and never writes any file. The code also generates Feishu notification content (at least for notification output/logging), which is an undeclared behavior. Overall, this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: There is a material description-to-behavior mismatch. The declared description says the skill performs conversation analysis, summarization, personality analysis, task tracking, incomplete-task checking, and memory-file updates. However, this code chunk only calculates the current day's time range, prints a plan of what OpenClaw should do, and returns a simple task list. No actual file reads/writes occur beyond defining a MEMORY.md path, no session history is fetched, no LLM analysis is invoked, and no Feishu notification is sent. The primary purpose of the code is orchestration/logging rather than execution of the described capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill describes persistent profiling, memory-file updates, and Feishu notifications without warning the user that personal conversation content may be stored or disclosed externally. This creates a real privacy and consent risk, especially because the documented analysis includes sensitive attributes and long-term retention.
Content: No source excerpt is available for this finding.

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: The skill includes stateful modification of HEARTBEAT.md by resetting the conversation counter, which is a form of memory/state manipulation. Although not inherently malicious, modifying operational state without clear safeguards can interfere with auditing, trigger logic, or user expectations about when analysis runs.
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
md
### Output Files - `USER.md` - Updated user profile - `MEMORY.md` - Appended conversation analysis - `HEARTBEAT.md` - Reset conversation counter - Feishu messages - Task notifications ---

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill description itself establishes ongoing collection, summarization, and storage of extensive personal and conversational data across sessions. In context, this is dangerous because it normalizes broad surveillance-style memory accumulation without visible constraints, consent, or data minimization, increasing exposure if memory files are accessed, leaked, or reused improperly.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly profiles and persistently stores highly sensitive user attributes such as personality, emotions, background, experiences, and future plans in USER.md without any notice, opt-in, minimization, or retention controls. In this context, the danger is elevated because the profiling is systematic, cross-session, and tied to long-term memory updates, creating privacy, surveillance, and misuse risks even if no overtly malicious behavior is stated.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill directs creation and continuous updating of a detailed persistent profile covering traits, preferences, skills, experiences, background, emotional state, and future plans. This creates a rich inferred dossier that can be far more sensitive than raw conversation text and is especially risky because many of these fields are subjective inferences that may be inaccurate yet retained long-term.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The scheduled workflow analyzes all conversation history from the day and writes results into long-term memory automatically. This is dangerous because automatic bulk analysis increases the scope of sensitive data processing without requiring contemporaneous user awareness, and recurring summarization compounds privacy risk over time.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README advertises personality analysis, emotional-state inference, task tracking, and writes to persistent memory files, yet it does not clearly warn users about the privacy implications or obtain explicit informed consent. This is dangerous because users may unknowingly allow sensitive profiling and persistence of inferred personal data beyond the current session.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs broad collection and persistence of sensitive conversation-derived information, including personality, preferences, background, and emotional state, into memory files. This creates substantial privacy and security risk because highly sensitive inferred data is stored persistently and could later be exposed, misused, or acted upon without the user's intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill documents automatic triggering every 10 conversations or daily, along with writes to USER.md and MEMORY.md, but does not clearly warn that this runs periodically and modifies persistent state. Automatic background processing of conversations increases the chance of silent data accumulation and profiling without active user awareness.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 46)May include surrounding context.
bash
# Edit crontab crontab -e # Add these lines # Daily analysis at 12:00 and 24:00

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 149)May include surrounding context.
bash
# Edit crontab crontab -e # Add these lines # Daily analysis at 12:00 and 24:00

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The HEARTBEAT instructions operationalize recurring extraction of user attributes and appending conversation-derived data into persistent memory, making the profiling behavior continuous rather than one-off. This is more dangerous in context because it normalizes repeated surveillance-like summarization of the user across sessions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The Chinese section repeats the same sensitive-data collection and persistence instructions, confirming that this is a core intended behavior of the skill rather than an isolated wording issue. The repeated emphasis on profiling and storage increases confidence that users may be systematically analyzed and recorded without adequate privacy safeguards.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The Chinese HEARTBEAT guidance again directs recurring extraction and persistence of user profile and task information from conversations, reinforcing cross-session tracking. In this skill context, recurring autonomous memory updates substantially heighten privacy risk because they can create long-lived dossiers from ordinary conversations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill documents capabilities involving file access, environment-dependent execution, and external notification behavior, but it declares no explicit tool scope or permissions. That makes the operational boundary unclear and increases the risk of the skill being run with broader access than users or reviewers expect.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs creation and persistence of detailed user profiles, including emotional state, background, preferences, and goals, from conversation content. Collecting and storing this level of sensitive inferred data can expose users to privacy harms, profiling abuse, and unauthorized secondary use if accessed or shared.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill directs broad harvesting of chat history and long-term recording of analysis results into memory files. Even without overtly malicious logic, centralizing conversational data in persistent memory increases exposure in the event of misuse, over-retention, or unauthorized access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Using a generic manual trigger phrase like "summary" creates a high chance of accidental activation during ordinary conversation. That can cause unintended analysis, memory operations, or data processing without the user's clear intent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Scheduled analysis of all conversations in a time window, followed by storage and notification actions, expands processing beyond immediate user intent and can disclose user-derived task information through external messaging. This automation makes the privacy risk more severe because it can occur without a contemporaneous user prompt or review.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The skill file is entirely written in Chinese and specifies user-facing trigger phrases and notification text only in Chinese, with no indication that users may choose another language. Under the locale policy, a skill should not force a specific language unless it offers opt-in or clearly documents a justified region-specific limitation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tp4

Tp4

Tp4

Missing User Warnings

Memory Manipulation

Ssd 3

Missing User Warnings

Ssd 3

Ssd 3

Missing User Warnings

Ssd 3

Missing User Warnings

Rp1

Rp1

Session Persistence

Session Persistence

Ssd 3

Ssd 3

Ssd 3

Undeclared Tool Scope

Ssd 3

Ssd 3

Vague Triggers

Ssd 3

Natural-Language Policy Violations

Static analysis