生命之书 (Life Book)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:17 AM UTC
• Version: 1.0.0

Overview

This biography skill is purpose-aligned but needs Review because it automatically stores sensitive life-story content and has weak controls around privacy, paths, and network imports.

Install only if you are comfortable with the agent saving personal life details to local files automatically. Treat imported URLs as untrusted, avoid sensitive or third-party details unless you manually control what is saved, and do not rely on the [私密] marker to be filtered from generated books in this version.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:17
• Finding: Automatic Persistent Collection of Personal Information Without Explicit Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-25` **Vulnerability Type**: Automatic persistent personal-data collection **Risk Level**: High ### Vulnerable Code ```markdown ### 1. 对话即记录 每当用户分享任何人生经历时，立即： 1. 判断内容属于哪个章节（见章节映射） 2. 用 `exec` 工具将内容追加写入对应章节文件 3. 继续对话，自然地追问细节 **不要等用户说"开始记录"，随时随地都在沉淀。** ``` ### Technical Analysis The skill instructs the agent to write personal-life information to persistent local storage whenever such information appears in ordinary conversation. It explicitly says not to wait for the user to request recording. Loading the skill therefore changes the agent's behavior from conversational assistance to automatic collection and persistence of potentially sensitive information. Although the information remains local, local persistence is still a security and privacy boundary, especially for content concerning family, relationships, employment, health-related life events, and other identifying information. The instructions also require use of the `exec` tool, turning conversational content into filesystem writes without a separate authorization step. ### Attack Path 1. The skill is loaded into an agent session. 2. A user casually discusses a personal experience without asking the agent to record it. 3. The skill instructs the agent to classify the statement into a biography chapter. 4. The agent invokes an executable script through `exec`. 5. The statement is persistently written under `~/.openclaw/workspace/life-books/`. 6. The information remains available to later processes or users with access to the same account. ### Impact Assessment The issue does not grant additional operating-system privileges, but it causes unauthorized persistence within the privileges of the agent process. Its scope includes any personal information disclosed during a session in which the skill is active. The resulting files may contain a detailed, aggregated profile of the user and can be read by other processes or users that a ...[truncated 60 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed opt-in before making the first persistent write. 2. Clearly display whether recording is active and identify the destination directory. 3. Do not treat ordinary conversation as implicit consent to record. 4. Add explicit `start recording`, `pause recording`, `review`, and `delete` controls. 5. Ask for confirmation before storing categories likely to contain highly sensitive information. 6. Avoid invoking `exec` for persistence unless the user has directly authorized the operation. 7. Document retention behavior and provide a simple mechanism to delete all collected data. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: life-book.sh:30
• Finding: Path Traversal Through Unvalidated User and Chapter Names<![CDATA[ ## Vulnerability Details **File Location**: `life-book.sh:30-31, 177-184, 203-206`; `append.sh:13-14, 35-40` **Vulnerability Type**: Path traversal and unintended filesystem access **Risk Level**: High ### Vulnerable Code ```bash # life-book.sh init_workspace() { local user_name="${1:-default}" local user_dir="${WORKSPACE}/${user_name}" ``` ```bash # life-book.sh add_chapter() { local user_name="${1:-default}" local chapter_name="$2" local user_dir="${WORKSPACE}/${user_name}" [[ ! -d "${user_dir}" ]] && log_error "项目不存在，请先运行 'life-book start'" && exit 1 local chapter_file="${user_dir}/chapters/$(echo "${chapter_name}" | tr ' ' '_').md" ``` ```bash # life-book.sh import_materials() { local user_name="${1:-default}" local source="$2" local user_dir="${WORKSPACE}/${user_name}" ``` ```bash # append.sh init_user() { local user_name="${1:-default}" local user_dir="${WORKSPACE}/${user_name}" ``` ```bash # append.sh append_to_chapter() { local user_name="$1" local chapter_name="$2" local content="$3" local user_dir=$(init_user "${user_name}") local chapter_file="${user_dir}/chapters/${chapter_name}.md" ``` ### Technical Analysis The scripts concatenate externally supplied user and chapter names directly into filesystem paths. Shell quoting prevents word splitting and shell metacharacter expansion, but it does not prevent path traversal. Values containing `../`, path separators, or symlink-based escapes can resolve outside the intended `life-books` directory. Replacing spaces in chapter names with underscores is not sufficient sanitization because traversal components and `/` remain accepted. The scripts also do not canonicalize the resulting paths or verify that they remain descendants of the workspace. Depending on the selected command, the affected paths are used for directory creation, file creation, file overwrite, chapter reads, generated-book writes, and materi ...[truncated 1482 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate usernames and chapter identifiers against a strict allowlist, such as `^[A-Za-z0-9_-]+$`. 2. If internationalized display names are required, store them as metadata while using generated internal identifiers for paths. 3. Reject `/`, `\`, `..`, control characters, and empty identifiers. 4. Canonicalize the workspace and destination with `realpath` or `realpath -m`. 5. Verify that every canonical destination starts with the canonical workspace path followed by a path separator. 6. Reject destinations containing symlink components, or operate through directory file descriptors with no-follow semantics. 7. Create files with restrictive permissions and fail if a destination already exists unexpectedly. 8. Apply identical validation in both `life-book.sh` and `append.sh`. 9. Add regression tests covering traversal strings, absolute paths, Unicode separators, and symlink escapes. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: life-book.sh:213
• Finding: Server-Side Request Forgery Through Unrestricted Remote Material Import<![CDATA[ ## Vulnerability Details **File Location**: `life-book.sh:213-218` **Vulnerability Type**: Unrestricted outbound HTTP requests and SSRF **Risk Level**: High ### Vulnerable Code ```bash elif [[ "${source}" =~ ^https?:// ]]; then log_info "导入网络资料: ${source}" local filename=$(basename "${source}") curl -sL "${source}" -o "${user_dir}/materials/${filename}" log_success "导入完成" ``` ### Technical Analysis The import function accepts any URL beginning with HTTP or HTTPS and passes it to `curl`. It follows redirects through `-L` without validating either the initial destination or subsequent redirect targets. There is no rejection of: - Loopback addresses. - Private network ranges. - Link-local addresses. - Cloud metadata endpoints. - Reserved or otherwise non-public addresses. - DNS names that resolve to internal addresses. - Redirects from a public address to an internal address. There are also no connection timeouts, total transfer timeouts, response-size limits, or content validation controls. Consequently, the feature can be used as an SSRF primitive and can also consume excessive disk space. ### Attack Path 1. The attacker supplies a URL to the `import` command. 2. The URL directly references an internal service, or references a public endpoint that redirects to one. 3. The script accepts the URL because it begins with `http://` or `https://`. 4. `curl -L` connects to the selected destination and follows redirects. 5. The response from the internal service is saved in the user's `materials` directory. 6. A later command or an actor with local file access can inspect the saved response. Possible destinations include loopback-only administrative interfaces, private-network services, and environment-specific metadata services. ### Impact Assessment The request is made with the network reachability of the host running the skill. This can expose services that are inaccessible to the user from outside that host or network. Potenti ...[truncated 499 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer removing arbitrary URL import unless it is essential to the skill. 2. Use an allowlist of approved HTTPS domains and reject all other destinations. 3. Resolve hostnames before connecting and reject loopback, private, link-local, multicast, reserved, and unspecified address ranges for both IPv4 and IPv6. 4. Disable automatic redirects or validate every redirect destination before following it. 5. Protect against DNS rebinding by binding validation and connection to the same resolved address. 6. Require HTTPS and perform normal certificate verification. 7. Add conservative `curl` limits, including connection timeout, total timeout, maximum redirects, and maximum file size. 8. Generate a safe local filename rather than deriving it directly from the URL. 9. Validate expected media types and avoid making imported responses available to execution paths. 10. Log the final validated destination without recording credentials or sensitive query parameters. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: life-book.sh:266
• Finding: Documented Privacy Filtering Is Not Enforced During Book Generation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:151-155`; `EXAMPLES.md:147-151`; `life-book.sh:227-299` **Vulnerability Type**: Missing enforcement of a documented privacy control **Risk Level**: Medium ### Vulnerable Code The skill documentation promises filtering for entries marked as private: ```markdown ## 隐私保护 - 所有数据存储在本地 `~/.openclaw/workspace/life-books/` - 不上传任何内容到外部服务器 - 敏感内容用户可标记 `[私密]`，生成成书时可选择过滤 ``` The generation implementation copies chapter content without checking for the private marker: ```bash # 合并章节 chapter_num=1 for chapter_file in "${user_dir}"/chapters/*.md; do [[ ! -f "${chapter_file}" ]] && continue echo "## 第${chapter_num}章" >> "${book_file}" echo >> "${book_file}" # 跳过原文件的标题行 tail -n +2 "${chapter_file}" >> "${book_file}" echo >> "${book_file}" echo "---" >> "${book_file}" echo >> "${book_file}" ((chapter_num++)) done ``` ### Technical Analysis The documentation tells users that sensitive entries can be marked `[私密]` and filtered when generating the final book. However, `generate_book` unconditionally appends all chapter lines after the first line to `book.md`. No command-line option, configuration setting, parser, or filtering condition implements the promised behavior. This creates a security-control mismatch: users may disclose or retain sensitive information based on the belief that the marker prevents inclusion in generated output, while the actual implementation includes it unchanged. ### Attack Path 1. A user records sensitive personal information in a chapter. 2. The user applies the documented `[私密]` marker. 3. The user invokes `life-book.sh generate`, expecting private content to be excluded. 4. The generation loop uses `tail -n +2` to copy the complete chapter body. 5. The private entry is written into `book.md`. 6. The generated book may subsequently be viewed, copied, backed up, or shared with the sensitive content included. ### Impact Ass ...[truncated 418 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Implement an explicit and tested privacy-filtering mode. 2. Default to excluding entries marked private from generated books. 3. Define a structured private-entry format rather than relying on ambiguous inline text matching. 4. Add a command-line option such as `--include-private` that requires deliberate user action. 5. Display a warning and request confirmation before generating a book that contains private entries. 6. Report how many private entries were excluded or included without revealing their content. 7. Add tests proving that private entries cannot appear in default output. 8. Until filtering is implemented, remove the privacy claim and clearly warn that generation includes all chapter content. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This variant of the mismatch is more serious because the skill also advertises local and network material collection while the metadata does not clearly surface that user topics may trigger remote retrieval (`curl`/web search) and persistent storage. Users may disclose sensitive biographical data believing it remains local or limited in scope, when the skill can interact with external resources and save data durably.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This variant of the mismatch is more serious because the skill also advertises local and network material collection while the metadata does not clearly surface that user topics may trigger remote retrieval (`curl`/web search) and persistent storage. Users may disclose sensitive biographical data believing it remains local or limited in scope, when the skill can interact with external resources and save data durably.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The operating instructions direct silent persistence of highly personal life details to local files without an upfront warning or consent notice. Because the skill is specifically designed to elicit autobiographical content, the context increases the danger: the data is likely to include names, relationships, health, finances, trauma, and other sensitive material.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill defaults to continuous recording of all life details and places the burden on users to mark items as private afterward. That design is dangerous because it encourages overcollection of sensitive personal data first and relies on users to recognize and annotate privacy risks in real time.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill directs automatic logging of user-provided autobiographical content into persistent chapter files under a fixed workspace path. Persistent structured storage of personal narratives increases the risk of later unauthorized access, unintended reuse, or aggregation of sensitive information.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The privacy section says no content is uploaded externally, yet the instructions direct use of `web_search` to fetch background material based on user-provided topics. Even if raw content is not uploaded verbatim, user topics, names, places, or events may be sent to external services, making the privacy claim misleading and potentially causing unintended disclosure.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The guidance says user statements should be recorded immediately and broadly treated as source material, without clear minimization limits. In this skill context, that encourages bulk retention of sensitive biographical information, including data about third parties, which increases privacy harm, accidental over-collection, and downstream misuse if the stored book is exposed.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The examples direct the agent to automatically persist intimate personal details as the conversation proceeds, but do not require an upfront notice or consent step. In a biography-building skill, this can silently collect and retain highly sensitive life history, relationship, education, and work information the user may not expect to be stored permanently.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documentation asserts that all data is stored locally, but the example workflow explicitly instructs using web_search to gather external material. That creates a misleading privacy guarantee and can cause personal context about the user's life story to be sent to external services, increasing disclosure risk for sensitive biographical data.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This file presents all operational instructions and user-facing descriptions exclusively in Chinese, including headings, feature descriptions, and usage notes. Under the stated policy, forcing a specific language without user opt-in or justification is a natural-language policy violation.

Intent-Code Divergence

Medium

• Confidence: 81% confidence
• Finding: L53 明确宣称该技能“完全本地化”，这会让读者理解为技能相关操作不涉及外部网络或远程服务。但本文件 L15-L27、L33-L45 又指导用户使用 clawhub login/publish/install 与远程平台交互，和“完全本地化”的表述存在直接张力。

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill explicitly instructs use of shell execution (`exec`, `bash`, `curl`) and filesystem writes, but does not declare any tool scope or allowed-tools boundary. This creates an authorization and transparency gap: a reviewer or runtime may underestimate the skill's ability to execute commands, write persistent files, or fetch remote content.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to automatically record any life-related user statement without explicit opt-in. This is unsafe because users may casually disclose sensitive personal information in conversation without realizing it will be persistently logged to disk.

Session Persistence

Medium

• Category: Rogue Agent

Content

初始化目录（首次使用时）：
```bash
mkdir -p ~/.openclaw/workspace/life-books/default/{chapters,materials,raw}
```

### 3. 章节映射

• Confidence: 83% confidence
• Finding: Creating persistent directories under `~/.openclaw/workspace/life-books/` is not inherently malicious, but it does establish session persistence for sensitive user data. In a biography skill, persistent storage materially increases privacy and data retention risk, especially when combined with automatic recording defaults.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The follow-up strategy is explicitly designed to solicit additional personal detail after each write, which expands the volume and sensitivity of collected data. In this context, the elicitation behavior makes the privacy risk worse because it turns casual sharing into systematic profiling without corresponding consent safeguards.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill describes network-based enrichment without warning that user-supplied topics may be sent to third-party search services. In a biography context, those topics can include identifiable people, locations, or events, creating a privacy exposure beyond the local workspace.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: Comments, status messages, and usage text are written exclusively in Chinese, which can force a specific language experience without user opt-in. The file does not indicate that the skill is intentionally region-specific or provide an alternative language option.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The default configuration hard-codes the language to "zh-CN", and the skill's prompts/help are also written in Chinese without any user selection flow. This is a language/locale policy issue because the skill imposes a specific locale rather than offering a choice or clearly documenting a justified region-specific constraint.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script collects highly sensitive autobiographical data and writes it to local markdown files under the user's home directory without any explicit privacy notice, consent prompt, encryption, access-control hardening, or warning about where the data will persist. In this skill context, the content is especially sensitive because it solicits life history, relationships, and major life events, increasing the risk of privacy harm if the workstation is shared, backed up insecurely, or later accessed by other tools/users.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill downloads arbitrary remote content into the user's workspace via curl with no warning, trust prompt, file-type validation, size limits, or provenance checks. While it is not executing the content directly, silently importing attacker-controlled files into a personal archive can expose the user to malicious documents, unexpected tracking URLs, oversized downloads, or later unsafe handling by other tools.

External Transmission

Medium

• Category: Data Exfiltration

Content

elif [[ "${source}" =~ ^https?:// ]]; then
        log_info "导入网络资料: ${source}"
        local filename=$(basename "${source}")
        curl -sL "${source}" -o "${user_dir}/materials/${filename}"
        log_success "导入完成"
    else
        log_error "无效的资料源: ${source}"

• Confidence: 86% confidence
• Finding: This line causes the tool to make an outbound network request to a user-supplied URL and store the response locally, which is an external transmission/data ingress behavior with security implications. In this skill's context, importing web materials may be expected, but the danger is increased by the lack of user warning, URL validation, and download safeguards, especially since the workspace contains sensitive personal biography data nearby.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: All headings, examples, trigger phrases, chapter mappings, and response guidance are exclusively in Chinese, which implies a fixed language behavior. The file does not offer opt-in language selection or explain that the skill is intentionally limited to a Chinese-language context.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: This shell script creates new chapter files and appends content to existing markdown files under the user's workspace. Although it prints a success message after appending, there is no prior disclosure or warning in comments/help text that running the append action will modify persistent user data.

Static analysis

No suspicious patterns detected.