moyu-journal-auto

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

This skill is a local workplace-activity journal, but it asks for broad filesystem and sensitive history access while making unclear or unsupported privacy claims.

Review before installing. Use it only if you are comfortable storing workplace activity notes locally in plaintext-like journal files, and avoid enabling browser history, calendar, or broad filesystem access unless you understand the privacy exposure. Do not rely on the encrypted-storage claim unless the publisher provides an actual encryption design and controls for retention and deletion.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:23
• Finding: Overprivileged Access to Filesystem and Sensitive Activity Sources## Vulnerability Details **File Location**: `SKILL.md:23-25`, `SKILL.md:50-53`, `README.md:48-52`, and `README.md:81-84` **Vulnerability Type**: Excessive permissions and access to sensitive user data **Risk Level**: Medium ### Complete Vulnerable Snippets English rendering of `SKILL.md:23-25`: ```markdown 2. Today's activity statistics: - Calculate the total duration of all sessions for the current day. - Review today's chat history, browser history (if permitted), and calendar events to infer activities. ``` English rendering of `SKILL.md:50-53`: ```markdown ## Required Tools and Permissions - File access: allow_filesystem = true - Memory review: use long-term memory or chat-history queries for current-day and current-week conversations. - Optional: browser history and calendar access. ``` Relevant configuration command from `README.md:48-52`: ```text openclaw config set tools.allow_filesystem true openclaw restart ``` English rendering of `README.md:81-84`: ```markdown ## Permission Requirements - tools.allow_filesystem = true, required to read and write local journal files. - Optional browser-history and calendar tools may be used to infer activities more accurately. ``` ### Technical Analysis The Skill's legitimate persistence requirement is limited to reading and writing journal records under `~/.openclaw/moyu-journal/`. Instead of requesting access scoped to that directory, its installation instructions enable a general filesystem capability. The Skill also instructs the Agent to inspect long-term memory, chat history, browser history, and calendar events. These sources can contain authentication material, confidential correspondence, medical or financial searches, private appointments, employer information, and other data unrelated to activity journaling. Although browser-history and calendar access are described as optional, the instructions do not define per-query consent, purpose limitation, filtering, data minimization, or safegu ...[truncated 1624 chars]
• Remediation: ## Remediation Suggestions 1. Replace global filesystem permission with read and write access restricted to `~/.openclaw/moyu-journal/`. 2. Do not require users to enable a general filesystem capability when a directory-scoped grant is sufficient. 3. Disable access to browser history, calendars, long-term memory, and prior conversations by default. 4. Obtain explicit, source-specific consent immediately before each optional data query. 5. Clearly display which source will be read, the requested time range, and how the resulting data will be used or stored. 6. Prefer activity information supplied directly by the user rather than inferring it from unrelated private sources. 7. Filter retrieved records to the minimum necessary time range and avoid storing raw history, event descriptions, URLs, or conversation contents. 8. Add retention controls and a command that lets users inspect and permanently delete stored journal data. 9. Document the exact filesystem boundary and test that attempts to access paths outside the journal directory are denied.

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:17
• Finding: Plaintext Storage Contradicts the Encrypted-Storage Privacy Claim## Vulnerability Details **File Location**: `README.md:17`, `SKILL.md:19-21`, and `SKILL.md:57` **Vulnerability Type**: Plaintext storage of sensitive workplace activity data and misleading security documentation **Risk Level**: Medium ### Complete Vulnerable Snippets English rendering of the claim in `README.md:17`: ```markdown Want to keep a self-deprecating activity memoir without your boss finding it? Local encrypted storage is extremely secure. ``` English rendering of the storage instructions in `SKILL.md:19-21`: ```markdown 1. Recording trigger: - Create or append to: ~/.openclaw/moyu-journal/daily/$(date +%Y-%m-%d).json - Content format: {"date": "YYYY-MM-DD", "sessions": [{"start": "HH:MM", "end": "HH:MM", "duration_min": N, "note": "user input"}]} ``` English rendering of the privacy statement in `SKILL.md:57`: ```markdown Privacy: all data is stored locally under ~/.openclaw/moyu-journal/ and is never uploaded unless the user purchases the cloud-backup extension. ``` ### Technical Analysis The README claims that journal records use secure local encryption, but the operational instructions specify ordinary JSON files containing dates, times, durations, and the user's original notes. The project contains no encryption routine, encrypted file format, key-generation procedure, key storage mechanism, access-control setup, or authenticated-decryption process. Local storage is not equivalent to encrypted storage. Plaintext files remain readable by other processes operating with the same account permissions, malware, administrators, backup software, indexing services, or synchronization tools. The contents are particularly sensitive because they document workplace behavior and may include inferred browser, calendar, or conversation activity. The statement that data is never uploaded also contains an exception for a paid cloud-backup feature, but the reviewed package supplies no implementation or security design for that feature. No ...[truncated 1546 chars]
• Remediation: ## Remediation Suggestions 1. Immediately remove the encrypted-storage claim unless encryption is actually implemented and independently verified. 2. If encryption is required, use a maintained authenticated-encryption construction such as AES-GCM or ChaCha20-Poly1305. 3. Generate a unique random nonce for every encrypted record and never reuse a nonce with the same key. 4. Store encryption keys in an operating-system credential store or hardware-backed key service rather than beside the journal files. 5. Apply restrictive filesystem permissions to the journal directory and files, such as owner-only access where supported. 6. Avoid writing sensitive temporary plaintext files during encryption, updates, or report generation. 7. Define retention limits and provide commands for secure export, deletion, and key rotation. 8. Clearly explain that local storage may still be captured by backups, synchronization utilities, malware, or privileged administrators. 9. Before implementing cloud backup, document explicit opt-in consent, transport encryption, server-side retention, account deletion, key ownership, and whether the provider can decrypt uploaded records. 10. Add automated tests verifying that journal files do not contain plaintext dates, notes, or activity descriptions when encryption is advertised.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The README is entirely written in Chinese and the activation phrases/examples are all Chinese, with no indication that other languages are supported or that the Chinese-only scope is intentional and required. Under the policy, imposing a specific language without user opt-in or documented justification is a natural-language policy concern.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill requests filesystem permission to persist logs of potentially embarrassing or employment-sensitive behavior, but the README does not clearly warn users about the sensitivity, retention, and exact storage behavior of those files. Persistent local storage of such records can expose users if the machine is shared, compromised, backed up insecurely, or inspected by an employer.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The README explicitly suggests enabling access to browser history and calendar data to infer 'moyu' activity, which expands data collection beyond the core journaling purpose. This creates unnecessary exposure of sensitive personal and work information, especially given the skill is framed as a workplace deception/logging tool where browsing and calendar contents may be highly sensitive.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger conditions are broad enough to activate on ordinary conversation about slacking off, which can cause the skill to run and begin recording/storing user content without a sufficiently explicit invocation. In this skill’s context, unintended activation is more dangerous because the skill persists data locally and may later summarize sensitive behavioral information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to infer activities from browser history and calendar data, which are highly sensitive sources, but it does not require a just-in-time consent flow or prominent warning before inspection. This is particularly risky here because the skill profiles user behavior related to personal habits and work patterns, increasing privacy exposure beyond the user’s typed input.

Description-Behavior Mismatch

Low

• Confidence: 78% confidence
• Finding: The README markets the skill as keeping records local while also advertising paid cloud backup, which is a misleading privacy claim unless the distinction is made explicit. Users may rely on the 'never uploaded' messaging and underestimate the risk of future remote storage of sensitive diary and workplace activity data.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: All user-facing triggers, outputs, and examples are specified only in Chinese, with no indication that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale limitation is explicit and justified.

Static analysis

No suspicious patterns detected.