Client Data Management

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:52 PM UTC
• Version: 0.1.0

Overview

This skill is coherent, but it should be reviewed because it manages sensitive accounting client data with broad export/delete powers and weakly specified local storage safeguards.

Install only in an environment where OpenClaw runs under a dedicated account with strict filesystem permissions, enforced role checks, logged approvals for GDPR export/delete and all-client export, protected backups and exports, and administrator-managed dependency installation. Review whether the plaintext index is acceptable for your privacy obligations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:19

Finding

Sensitive client-data directory is created without explicit permission hardening

Content

View full analysis

Remediation

View remediation

&2; exit 1 ;; esac umask 077 install -d -m 0700 -- "$OPENCLAW_DATA_DIR/clients" ``` - Verify that the destination is not a symbolic link and is owned by the intended OpenClaw service account. - Create client JSON files with mode `0600` and subdirectories with mode `0700`. - Run OpenClaw under a dedicated, unprivileged service account rather than a shared interactive account. - Keep dependency installation separate from runtime initialization. Administrators should install `jq` through an approved package-management process. - Add startup checks that reject group-readable or world-readable data directories and report incorrect ownership. - Apply similarly restrictive controls to export, backup, GDPR-export, and audit-log directories. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:200

Finding

Global client index intentionally stores identifying client metadata in plaintext

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow explicitly expects decryption of encrypted fields and generation of a complete data export containing highly sensitive client data, yet the evaluation criteria do not require identity verification, authorization checks beyond a vague role check, data minimization, secure delivery, or explicit handling safeguards. In a client-data management context holding tax, contact, compliance, and audit information, this could enable unauthorized bulk disclosure of regulated personal and financial data if triggered by an attacker or misused by an overprivileged user.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

bash

export OPENCLAW_DATA_DIR="/data"
which jq || sudo apt install jq
mkdir -p $OPENCLAW_DATA_DIR/clients

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file repeatedly specifies Greek-only business data conventions, tax offices, legal forms, phone formats, and retention context in natural-language prompts and expected behavior. Because the file does not indicate that this skill is explicitly region-scoped or that users can opt into this locale, it appears to impose a specific locale by default.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 92% confidence

Finding

The skill contains multiple mojibake and mixed-script strings in sensitive identity fields such as names, legal forms, and tax-office labels. In a client-data management skill, malformed Unicode can cause identifier mismatches, failed searches, incorrect audit trails, and deceptive display of client records, especially where AFM-linked records and GDPR actions depend on exact text handling.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The setup instructions tell operators to run sudo apt install jq, introducing privileged execution from within a skill document. Even though jq is a common package, embedding sudo-based installation guidance in an agent skill normalizes privilege escalation and could lead users or automated environments to perform unnecessary root actions.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

bash

export OPENCLAW_DATA_DIR="/data"
which jq || sudo apt install jq
mkdir -p $OPENCLAW_DATA_DIR/clients

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This section documents highly destructive and privacy-sensitive operations such as GDPR export, GDPR delete with retention override, bulk export, backup/restore, and audit-log access without prominent warnings, approval requirements, or operator-safety guidance. In an instruction-following agent context, this increases the chance that an assistant executes irreversible deletion or mass data disclosure commands from ambiguous user prompts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The phrase "English interface" specifies a language constraint in the skill's natural-language behavior. The file does not indicate that users may choose another language or that English is optional, which can violate organizational language/locale choice policies.

Content

No source excerpt is available for this finding.