Security audit

OpenClaw Diary Insights

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent diary-insights purpose, but its generated private diary report can run unsafe browser scripts and loads remote resources that can access sensitive journal-derived data.

Review before installing. This skill processes private journal content and saves extracted insights into persistent local HTML/JS/JSON files. Do not open generated reports containing sensitive diary text until the template escapes user content safely and either bundles dependencies locally or clearly gates remote CDN/font loading.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: demo/insights.html:268
Finding: Persistent DOM-Based Cross-Site Scripting Through Diary-Derived Data
Content: View full analysis
c.cat))]; const filtered = filter ? thoughtCards.filter(c => c.cat === filter) : thoughtCards; document.getElementById('cards').innerHTML = `
从日记中提炼的思考碎片

全部 ${cats.map(c => `${c}`).join('')}

${filtered.map((c,i) => `

${String(c.id).padStart(2,'0')}

${c.insight}

${c.cat} ${c.date}

`).join('')}
`; } ``` ```javascript mg.days.forEach(day => { const mt = moodType(day.mood); const preview = day.entries[0].content.slice(0, 50) + (day.entries[0].content.length > 50 ? '...' : ''); html += `

${day.date.slice(5).replace('-','/')}

${day.label}

${preview}

${day.entries.length} 条

${d ...[truncated 3582 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: demo/insights.html:7
Finding: Remote Third-Party JavaScript Executes Without Integrity Protection
Content: View full analysis
``` The external dependency is documented as follows: ```markdown - 依赖 Chart.js（CDN），需联网加载雷达图；其余功能纯 Canvas/CSS，离线可用 ``` The Skill also makes the following broad privacy assertion: ```markdown - 所有数据都在本地处理和存储 ``` ### Technical Analysis The generated local report retrieves and executes Chart.js from jsDelivr whenever the page is opened with network access. The script element has no Subresource Integrity hash and the page has no restrictive Content Security Policy. Although the URL specifies Chart.js version `4.4.1`, the browser still trusts the content returned by an external CDN at runtime. A compromised CDN, compromised upstream asset, DNS or network-layer redirection, or unexpected asset replacement could cause different JavaScript to execute after the Skill package has already been reviewed. The third-party script executes in the same page context as the private diary report. It can access global variables loaded from `data.js`, including diary entries, thought cards, dimension scores, and knowledge-graph data. The Google Fonts stylesheet also creates an external request when the report opens. This leaks network metadata to an external service and means the visualization is not completely isolated or offline. While the repository contains no intentional exfiltration logic, the broad local-only privacy statement does not disclose these runtime external connections clearly enough. ### Attack Path 1. The Skill generates an HTML report containing ...[truncated 1275 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The standalone trigger “insights” is extremely vague and likely to appear in normal conversation, making accidental invocation much more likely. In this skill’s context, unintended activation is more dangerous because it initiates analysis of highly sensitive journal content and produces derived artifacts on disk.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
md
files: ["demo/insights.html", "demo/data.js"]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 465)May include surrounding context.
md
files: ["demo/insights.html", "demo/data.js"]

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README presents the skill behavior and invocation guidance entirely in Chinese, implying a fixed language experience without indicating user choice or a region-specific requirement. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrase “生成洞察” is broad enough that it could match ordinary conversation rather than a deliberate tool invocation. Because this skill reads private journal files and generates output files, accidental triggering could cause unintended access to sensitive personal data and unexpected file creation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README states that the skill reads from private journal directories and writes generated HTML/JSON files, but it does not clearly warn users about the privacy implications or persistent local side effects. This can lead users to expose intimate personal content into derived files that may be easier to open, share, sync, or index than the original journals.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file defines immediate activation phrases, and one of them is generic enough to match ordinary conversation about generating insights in many domains. The description does not provide exclusion conditions or tighter scope for when this trigger should invoke the diary skill versus a different analysis task.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: "提取笔记" can refer to many unrelated note-processing tasks and overlaps with everyday language, making unintended invocation more likely. The file does not narrow the phrase to journal files or specify when it should not activate.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description presents the skill as operating on a specific journal directory under ~/write_me/00inbox/journal/. However, the documented implementation first reads ~/.openclaw/workspace/diary/config/diary-config.json and then reads whatever path is configured in storage.path, which may differ from the manifest-stated location. This is a semantic mismatch about the actual data source the skill uses.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs the agent to execute a shell command to open a generated HTML file in the user's browser. Even though the path is locally generated, unnecessary command execution expands the attack surface and can be risky if any part of the path or filename becomes influenced by untrusted input or if platform command execution policies are weak.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The comments state the file was automatically generated in Chinese, and the entire embedded natural-language dataset is presented only in Chinese. For a general-purpose skill artifact, this effectively imposes a specific language/locale without any visible opt-in, alternative, or documented regional justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document declares lang="zh-CN", and the visible interface text is also entirely in Chinese, which imposes a specific language/locale on users. Under the policy, locale constraints should either be optional for the user or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This local diary visualization page loads third-party JavaScript and fonts from external CDNs, which causes sensitive journal-derived content and access metadata to be exposed to external services whenever the page is opened. Because the skill’s purpose is explicitly local analysis of private diary files, introducing remote dependencies creates a supply-chain and privacy exfiltration risk that is not necessary for core functionality.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The stated purpose is extracting insights from diaries and generating a local visualization page. The implementation additionally reads identity.md from a separate user_identity path to collect name and role, which is not mentioned in the manifest description of inputs. While still local, this extends the data sources beyond just journal files.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The collaboration note claims the skill only reads journal files, which implies a narrower data-access scope. Earlier sections explicitly instruct reading ~/.openclaw/workspace/diary/config/diary-config.json and optionally identity.md, so the documentation contradicts itself about what files are accessed. This is an intent-level inconsistency in the file's own guidance.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The comment implies data is loaded from a local data.js file, but the page also depends on external third-party resources. In a privacy-sensitive journaling context, this mismatch can mislead reviewers or users into believing the page is fully local, reducing scrutiny while remote requests still occur and potentially leak usage patterns or enable third-party compromise.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.