Security audit

Log Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This log analyzer has a coherent purpose, but it can automatically send raw operational logs to a fixed Discord channel and contains a command-injection flaw.

Review this carefully before installing. Only use it after removing the hard-coded Discord destination, making external notifications opt-in, limiting log sources to paths you choose, adding secret redaction, and replacing shell-string execSync with an argument-based command or API call.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/analyzer.cjs:280
Finding: Arbitrary OS Command Execution Through Unescaped Log Content
Content: View full analysis
Remediation: View remediation

other

Error

Location: scripts/analyzer.cjs:280
Finding: Automatic Disclosure of Raw Operational Data to a Hard-Coded Discord Recipient
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/analyzer.cjs:18
Finding: Overbroad User-Specific Filesystem Collection Combined with Recurring Execution
Content: View full analysis
file.endsWith('.log')) .sort((a, b) => b.localeCompare(a)); logFiles.forEach(file => { this.analyzeLogFile(path.join(CONFIG.logDirectory, file)); }); ``` It separately reads global cron job state: ```js const jobs = JSON.parse(fs.readFileSync(CONFIG.cronJobsFile, 'utf8')).jobs || []; const failedJobs = jobs.filter(job => { return job.state && job.state.lastStatus === 'error'; }); ``` The documentation recommends recurring execution and delivery: ```bash openclaw cron add \ --name "log-analyzer" \ --cron "*/30 * * * *" \ --tz "Asia/Shanghai" \ --session isolated \ --wake now \ --deliver ``` ### Technical Analysis The analyzer does not derive its workspace from the current user's configuration and does not require the operator to select individual log sources. Instead, it is hard-coded to another named user's OpenClaw workspace and processes every `.log` file there, in addition to the global cron jobs state file. The task requires log analysis, but scanning every log and all failed job records is broader than necessary when only selected jobs or files may be relevant. The documented recurring deployment magnifies the exposure because the broad collection is repeated every 30 minutes. The scheduling command is documented rather than ...[truncated 1228 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly states that reports are pushed to Discord, but it does not warn users that log-derived data may leave the local system and be sent to a third-party service. Because logs can contain stack traces, hostnames, file paths, tokens, or other sensitive operational data, this omission creates a real data-exposure risk rather than a purely documentation issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documents monitoring of system logs and application logs, including user behavior, without any privacy notice, scoping limits, or minimization guidance. This is dangerous because such logs may contain sensitive personal data, authentication artifacts, operational secrets, and behavioral telemetry, and the skill encourages broad collection without informing the user of those implications.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The cron invocation message explicitly says "报告格式用中文," which forces report output to Chinese. Under the language/locale policy, a skill should not impose a specific language unless the user opts in or the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The generated report can include raw log contents and cron job error details, and the script automatically transmits that data to Discord. Logs frequently contain secrets, internal paths, tokens, stack traces, or personal data, so sending them to an external service without explicit consent, redaction, or classification controls creates a real data-exfiltration/privacy risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script invokes execSync with a shell command that embeds report content directly into the command line. Because the report includes untrusted log lines and task error text, a crafted quote or shell metacharacter in those inputs can break out of the intended argument and trigger command injection, while also granting broader external-command capability than needed for simple notification delivery.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON manifest contains multiple natural-language description values in Chinese, such as at L07, L13, L19, L27, L33, and L41, but the file does not indicate that the skill is Chinese-only or region-specific. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest says the tool supports automatic error detection, log aggregation, and Discord notifications. In the implementation, log handling is limited to enumerating .log files from one hard-coded local directory and analyzing them individually; there is no evident cross-source collection or aggregation mechanism beyond simple per-run scanning.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The report timestamp is generated with a fixed 'zh-CN' locale and 'Asia/Shanghai' timezone, which imposes a specific language/locale behavior regardless of user preference. The file does not provide opt-in, configurability, or a documented regional justification for this constraint.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/analyzer.cjs:294