T09 · Insecure Skill Coding Practices
Error
- Location
scripts/greeting.sh:279- Finding
Environment-Controlled Skill Path Enables Arbitrary Recursive Deletion
- Content
View full analysis
- Remediation
View remediation
Security audit
Daily Greeting
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it can automatically message every bound channel using inferred context and installs persistent triggers with unsafe cleanup behavior.
Install only after reviewing the automation and privacy implications. Prefer disabling BOOT.md and cron until explicitly needed, limit the skill to approved agents/channels, remove context/status details from the trigger message for sensitive channels, and avoid running uninstall with any overridden SKILL_DIR environment variable.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/greeting.sh:136- Finding
Unvalidated Configuration Value Reaches Bash Arithmetic Evaluation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/greeting.sh:69- Finding
Timestamp Format Mismatch Disables Duplicate-Greeting Protection
- Content
View full analysis
/dev/null) if [ -z "$last_run" ] || [ "$last_run" != "$today" ]; then return 0 fi ``` The stored value uses a different format: ```bash local timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ) echo "{\"lastRun\": \"$timestamp\", \"agents\": {}}" > "$STATE_FILE" ``` ### Technical Analysis `today` contains a date-only value such as `2026-09-16`, while `lastRun` is stored as a complete UTC timestamp such as `2026-09-16T09:00:00Z`. These strings cannot be equal. Consequently, `should_run_today` returns success before checking whether any agent already completed a greeting. The documented protection against duplicate execution therefore fails whenever the state contains the timestamp format written by the script. The use of local time for `today` and UTC for the stored timestamp introduces an additional timezone inconsistency around midnight. ### Attack Path 1. The first BOOT or cron invocation runs the greeting process. 2. The script records a full UTC timestamp in `data/state.json`. 3. Another trigger occurs on the same day, such as a Gateway restart, a second cron trigger, or manual execution. 4. The script compares the full timestamp with a date-only local value. 5. Because the values differ, the script concludes that it has not run today. 6. All eligible bound agents are triggered again and may send duplicate messages. No privileged attacker access is required; enabling both documented automatic trigger modes is sufficient to expose the flaw. ### Impact Assessment The flaw can repeatedly trigger all non-excluded bound agents and cause duplicate outbound messages across Discord, Fe ...[truncated 371 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Rogue AgentSelf-Modification, Session Persistence
Findings (30)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md > [!TIP] > Give your OpenClaw agents a personality! They automatically send personalized daily greetings to users every morning. <!-- Language Navigation --> [English](README.md) | [中文](docs/README_zh.md) ---
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill presents itself primarily as a greeting tool, but the documented behavior also includes persistent state management, BOOT.md modification, cron job management, and self-removal. Those actions are not inherently malicious, but they expand the trust boundary and can surprise operators because the description does not clearly foreground these system-modifying capabilities.
- Content
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md |---------|-------------| | `bash scripts/greeting.sh run` | Execute greeting manually | | `bash scripts/greeting.sh status` | View execution status | | `bash scripts/greeting.sh reset` | Reset state (allows re-trigger) | | `bash scripts/greeting.sh install` | Record BOOT.md path (for uninstall) | | `bash scripts/greeting.sh uninstall` | Remove skill and clean BOOT.md |
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md |---------|-------------| | `bash scripts/greeting.sh run` | Execute greeting manually | | `bash scripts/greeting.sh status` | View execution status | | `bash scripts/greeting.sh reset` | Reset state (allows re-trigger) | | `bash scripts/greeting.sh install` | Record BOOT.md path (for uninstall) | | `bash scripts/greeting.sh uninstall` | Remove skill and clean BOOT.md |
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
sh |---------|-------------| | `bash scripts/greeting.sh run` | Execute greeting manually | | `bash scripts/greeting.sh status` | View execution status | | `bash scripts/greeting.sh reset` | Reset state (allows re-trigger) | | `bash scripts/greeting.sh install` | Record BOOT.md path (for uninstall) | | `bash scripts/greeting.sh uninstall` | Remove skill and clean BOOT.md |
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
sh |---------|-------------| | `bash scripts/greeting.sh run` | Execute greeting manually | | `bash scripts/greeting.sh status` | View execution status | | `bash scripts/greeting.sh reset` | Reset state (allows re-trigger) | | `bash scripts/greeting.sh install` | Record BOOT.md path (for uninstall) | | `bash scripts/greeting.sh uninstall` | Remove skill and clean BOOT.md |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 92% confidence
- Finding
The README advertises autonomous behavior: agents automatically send personalized greetings every morning. In this skill's context, autonomous outbound actions are security-relevant because they can trigger user-facing communication and potentially disclose inferred language, status, and task-related context without contemporaneous approval.
- Content
md # Daily Greeting Skill > [!TIP] > Give your OpenClaw agents a personality! They automatically send personalized daily greetings to users every morning. <!-- Language Navigation --> [English](README.md) | [中文](docs/README_zh.md)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly promotes automatic personalized greetings sent to bound user channels, but it does not clearly foreground that this is unsolicited outbound messaging initiated by the skill rather than by an immediate user request. In an agent platform, autonomous contact with users can create privacy, consent, and trust risks, especially when message content is based on channel history, user context, or ongoing tasks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installation guidance states that BOOT.md and cron automation are enabled by default, creating persistent autonomous behavior on startup and on a schedule. Without a strong warning and explicit consent step, users may enable a skill that keeps sending messages over time and may be difficult to notice until after deployment.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ## Star History [](https://star-history.com/#shz2050/daily-greeting&type=Timeline)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md --- name: daily-greeting description: Give your OpenClaw agents personality! Automatically sends personalized daily greetings to all bound channels. Each agent greets users in their preferred language with relevant status updates. Supports BOOT.md and OpenClaw cron triggers. --- # Daily Greeting Skill
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description advertises automatic personalized greetings but does not clearly warn that the skill may infer language preference and summarize user/task context from history. Missing disclosure weakens informed consent and can lead users to install a skill that performs more contextual analysis and messaging than expected.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The BOOT.md block uses a broad natural-language instruction to execute a shell command and then suppress output with 'reply ONLY: NO_REPLY'. Broad trigger phrasing combined with hidden execution semantics can make autonomous startup behavior harder to audit and easier to invoke in unintended contexts.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger message instructs agents to infer preferred language from channel history and include status derived from ongoing tasks and user context. That goes beyond a simple greeting and can cause unnecessary access, processing, and disclosure of contextual or sensitive information into outbound messages without an explicit minimization boundary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README describes automatic daily greetings to bound channels, personalized using inferred user language and relevant status, but does not clearly warn users that messages will be sent automatically and may incorporate context derived from channel history or user state. In a multi-channel agent environment, this can lead to unintended disclosure of private context or messages being sent without explicit per-send confirmation.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger message explicitly instructs agents to infer user preferences from channel history and user context, include ongoing task or status details, and send that information to bound channels. This creates a real risk of cross-context leakage, where sensitive user data, project status, or private workflow details are surfaced into channels that may include unintended recipients or weaker access controls.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guide instructs users to configure persistent BOOT.md execution, scheduled cron execution, and uninstall behavior that modifies workspace state, which exceeds a simple greeting skill’s stated purpose. Even if intended for convenience, this broadens the skill’s authority and creates a persistence mechanism that could later be abused if the script is modified or the repository is compromised.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide enables both startup and scheduled auto-execution by default without a strong, explicit warning that the skill will continue running automatically. Users may install what appears to be a simple greeting feature without understanding that it establishes persistent background behavior.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
Creating and editing BOOT.md to execute the skill at startup establishes session persistence. In context, this is more dangerous because the skill is presented as a benign greeting utility, yet it arranges automatic execution every time the workspace starts, expanding opportunities for covert or unintended behavior.
- Content
ls ~/.openclaw/workspace/
text If not found, create it: ```bash mkdir -p ~/.openclaw/workspace
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The BOOT.md instructions embed a shell command that executes the skill automatically at startup and direct the agent to reply only with
NO_REPLY, reducing visibility into what ran. For a greeting skill, granting shell execution plus self-modifying workspace behavior is disproportionate and can conceal unintended or malicious actions behind an apparently harmless feature.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The guide describes maintaining a cron-based recurring task, which is a classic persistence mechanism. Although scheduled greetings may be the stated goal, using cron gives the skill durable execution beyond a one-time install and increases risk if the underlying script changes or is later abused.
- Content
Already set up - to modify, edit crontab:
bash crontab -eDefault:
0 9 * * 1-5(9am on weekdays)
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The uninstall instructions state that the skill deletes its entire skill directory, which is a destructive filesystem action unrelated to sending greetings. Destructive cleanup logic increases the blast radius of mistakes or abuse, especially if paths are resolved incorrectly or manipulated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The default trigger message tells agents to infer a user's preferred language from channel history and context without explicit consent. That encourages profiling of user behavior and may cause the agent to process or reveal inferred personal attributes in outbound messages.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger message directs agents to mine channel history and user context, then include ongoing-task status in a greeting. This can leak sensitive contextual information into channels, especially where multiple participants can see the message or where the agent's memory includes private task details.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script enumerates all global channel bindings from ~/.openclaw/openclaw.json and triggers every bound agent, rather than operating on an explicit allowlist or scoped set of agents. This broad access can cause unintended cross-channel actions, surprise message delivery, and privacy issues if agents act in channels the operator did not intend this skill to touch.
- Content