T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:17- Finding
Automatic Persistent Collection of Personal Information Without Explicit Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
生命之书 (Life Book)
Security checks for vulnerabilities and agentic risk
Overview
This biography skill is purpose-aligned but needs Review because it automatically stores sensitive life-story content and has weak controls around privacy, paths, and network imports.
Install only if you are comfortable with the agent saving personal life details to local files automatically. Treat imported URLs as untrusted, avoid sensitive or third-party details unless you manually control what is saved, and do not rely on the [私密] marker to be filtered from generated books in this version.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
life-book.sh:30- Finding
Path Traversal Through Unvalidated User and Chapter Names
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
life-book.sh:213- Finding
Server-Side Request Forgery Through Unrestricted Remote Material Import
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
life-book.sh:266- Finding
Documented Privacy Filtering Is Not Enforced During Book Generation
- Content
View full analysis
> "${book_file}" echo >> "${book_file}" # 跳过原文件的标题行 tail -n +2 "${chapter_file}" >> "${book_file}" echo >> "${book_file}" echo "---" >> "${book_file}" echo >> "${book_file}" ((chapter_num++)) done ``` ### Technical Analysis The documentation tells users that sensitive entries can be marked `[私密]` and filtered when generating the final book. However, `generate_book` unconditionally appends all chapter lines after the first line to `book.md`. No command-line option, configuration setting, parser, or filtering condition implements the promised behavior. This creates a security-control mismatch: users may disclose or retain sensitive information based on the belief that the marker prevents inclusion in generated output, while the actual implementation includes it unchanged. ### Attack Path 1. A user records sensitive personal information in a chapter. 2. The user applies the documented `[私密]` marker. 3. The user invokes `life-book.sh generate`, expecting private content to be excluded. 4. The generation loop uses `tail -n +2` to copy the complete chapter body. 5. The private entry is written into `book.md`. 6. The generated book may subsequently be viewed, copied, backed up, or shared with the sensitive content included. ### Impact Ass ...[truncated 418 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This variant of the mismatch is more serious because the skill also advertises local and network material collection while the metadata does not clearly surface that user topics may trigger remote retrieval (
curl/web search) and persistent storage. Users may disclose sensitive biographical data believing it remains local or limited in scope, when the skill can interact with external resources and save data durably.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This variant of the mismatch is more serious because the skill also advertises local and network material collection while the metadata does not clearly surface that user topics may trigger remote retrieval (
curl/web search) and persistent storage. Users may disclose sensitive biographical data believing it remains local or limited in scope, when the skill can interact with external resources and save data durably.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The operating instructions direct silent persistence of highly personal life details to local files without an upfront warning or consent notice. Because the skill is specifically designed to elicit autobiographical content, the context increases the danger: the data is likely to include names, relationships, health, finances, trauma, and other sensitive material.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill defaults to continuous recording of all life details and places the burden on users to mark items as private afterward. That design is dangerous because it encourages overcollection of sensitive personal data first and relies on users to recognize and annotate privacy risks in real time.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directs automatic logging of user-provided autobiographical content into persistent chapter files under a fixed workspace path. Persistent structured storage of personal narratives increases the risk of later unauthorized access, unintended reuse, or aggregation of sensitive information.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The privacy section says no content is uploaded externally, yet the instructions direct use of
web_searchto fetch background material based on user-provided topics. Even if raw content is not uploaded verbatim, user topics, names, places, or events may be sent to external services, making the privacy claim misleading and potentially causing unintended disclosure.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guidance says user statements should be recorded immediately and broadly treated as source material, without clear minimization limits. In this skill context, that encourages bulk retention of sensitive biographical information, including data about third parties, which increases privacy harm, accidental over-collection, and downstream misuse if the stored book is exposed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The examples direct the agent to automatically persist intimate personal details as the conversation proceeds, but do not require an upfront notice or consent step. In a biography-building skill, this can silently collect and retain highly sensitive life history, relationship, education, and work information the user may not expect to be stored permanently.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation asserts that all data is stored locally, but the example workflow explicitly instructs using web_search to gather external material. That creates a misleading privacy guarantee and can cause personal context about the user's life story to be sent to external services, increasing disclosure risk for sensitive biographical data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This file presents all operational instructions and user-facing descriptions exclusively in Chinese, including headings, feature descriptions, and usage notes. Under the stated policy, forcing a specific language without user opt-in or justification is a natural-language policy violation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
L53 明确宣称该技能“完全本地化”，这会让读者理解为技能相关操作不涉及外部网络或远程服务。但本文件 L15-L27、L33-L45 又指导用户使用 clawhub login/publish/install 与远程平台交互，和“完全本地化”的表述存在直接张力。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs use of shell execution (
exec,bash,curl) and filesystem writes, but does not declare any tool scope or allowed-tools boundary. This creates an authorization and transparency gap: a reviewer or runtime may underestimate the skill's ability to execute commands, write persistent files, or fetch remote content.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to automatically record any life-related user statement without explicit opt-in. This is unsafe because users may casually disclose sensitive personal information in conversation without realizing it will be persistently logged to disk.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 83% confidence
- Finding
Creating persistent directories under
~/.openclaw/workspace/life-books/is not inherently malicious, but it does establish session persistence for sensitive user data. In a biography skill, persistent storage materially increases privacy and data retention risk, especially when combined with automatic recording defaults.- Content
初始化目录（首次使用时）：
bash mkdir -p ~/.openclaw/workspace/life-books/default/{chapters,materials,raw}3. 章节映射
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The follow-up strategy is explicitly designed to solicit additional personal detail after each write, which expands the volume and sensitivity of collected data. In this context, the elicitation behavior makes the privacy risk worse because it turns casual sharing into systematic profiling without corresponding consent safeguards.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill describes network-based enrichment without warning that user-supplied topics may be sent to third-party search services. In a biography context, those topics can include identifiable people, locations, or events, creating a privacy exposure beyond the local workspace.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Comments, status messages, and usage text are written exclusively in Chinese, which can force a specific language experience without user opt-in. The file does not indicate that the skill is intentionally region-specific or provide an alternative language option.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The default configuration hard-codes the language to "zh-CN", and the skill's prompts/help are also written in Chinese without any user selection flow. This is a language/locale policy issue because the skill imposes a specific locale rather than offering a choice or clearly documenting a justified region-specific constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script collects highly sensitive autobiographical data and writes it to local markdown files under the user's home directory without any explicit privacy notice, consent prompt, encryption, access-control hardening, or warning about where the data will persist. In this skill context, the content is especially sensitive because it solicits life history, relationships, and major life events, increasing the risk of privacy harm if the workstation is shared, backed up insecurely, or later accessed by other tools/users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill downloads arbitrary remote content into the user's workspace via curl with no warning, trust prompt, file-type validation, size limits, or provenance checks. While it is not executing the content directly, silently importing attacker-controlled files into a personal archive can expose the user to malicious documents, unexpected tracking URLs, oversized downloads, or later unsafe handling by other tools.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This line causes the tool to make an outbound network request to a user-supplied URL and store the response locally, which is an external transmission/data ingress behavior with security implications. In this skill's context, importing web materials may be expected, but the danger is increased by the lack of user warning, URL validation, and download safeguards, especially since the workspace contains sensitive personal biography data nearby.
- Content
sh elif [[ "${source}" =~ ^https?:// ]]; then log_info "导入网络资料: ${source}" local filename=$(basename "${source}") curl -sL "${source}" -o "${user_dir}/materials/${filename}" log_success "导入完成" else log_error "无效的资料源: ${source}"
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
All headings, examples, trigger phrases, chapter mappings, and response guidance are exclusively in Chinese, which implies a fixed language behavior. The file does not offer opt-in language selection or explain that the skill is intentionally limited to a Chinese-language context.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This shell script creates new chapter files and appends content to existing markdown files under the user's workspace. Although it prints a success message after appending, there is no prior disclosure or warning in comments/help text that running the append action will modify persistent user data.
- Content