Security audit

Date Night

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent date-night booking assistant, but it includes overbroad private-message access, sensitive local storage, and future automated messaging jobs that need user review.

Install only if you are comfortable granting this skill access to booking sites, local contact/location preferences, messaging connectors, calendar tools, and limited SMS/iMessage data. Before use, remove broad SMS-history fallbacks, require approval at delivery time for all scheduled messages, pin dependencies, and protect stored config and browser session files with restrictive permissions.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (7)

T06 · System Persistence

Error

Location: references/smart-features.md:54
Finding: Persistent scheduled jobs autonomously browse and send messages without contemporaneous approval
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/sms-codes.md:42
Finding: Broad SMS-history fallbacks can disclose unrelated messages and authentication codes
Content: View full analysis
/dev/null | jq -r 'select(.name | test("22395|opentable";"i")) | "\(.id) \(.name)"' 2>/dev/null || true # Or search recent messages for the verification sender only: imsg history --limit 10 2>/dev/null | grep -i "opentable\|22395\|verification code" || true ``` ```bash OT_CHAT=$(cat ~/.openclaw/skills/date-night/config.json | jq -r '.opentable_sms_chat_id // "unknown"') # Get latest code imsg history --chat-id ${OT_CHAT} --limit 1 2>/dev/null | grep -oE '[0-9]{6}' || true # If chat ID unknown, broad search: imsg history --limit 10 2>/dev/null | grep -oE '[0-9]{6}' | head -1 || true ``` ```bash # After triggering Resy SMS: imsg history --limit 10 2>/dev/null | grep -i "resy\|verification\|code" || true # Note the chat ID and update config similarly to OpenTable above ``` ### Technical Analysis The sender-specific `--chat-id` query is appropriately scoped, but the fallback invokes `imsg history --limit 10` without a chat identifier. That command reads the general recent-message stream before applying text filtering. The six-digit fallback is particularly unsafe because it accepts the first matching numeric sequence regardless of sender, message purpose, or timestamp. This contradicts the Skill metadata and `SKILL.md`, which declare that only the last one or two messages from known booking-service senders are read and that broad scans are not performed. ### Attack Path 1. A booking flow triggers SMS verification. 2. No valid OpenTable or Resy chat ID is stored in the configuration. 3. The Skill invokes the unrestricted ...[truncated 724 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/resy-flow.md:106
Finding: Sensitive PII and reusable browser authentication state are saved without restrictive permissions
Content: View full analysis
~/.openclaw/skills/date-night/config.json << 'EOF' { "name": "{name}", "first_name": "{first_name}", "last_name": "{last_name}", "user_email": "{email}", "user_phone": "{phone_digits}", "partner": "{partner_or_null}", "notify_channel": "{channel}", "dietary": ["{pref1}", "{pref2}"], "has_children": {true|false}, "children_count": {N}, "children_ages": "{ages_or_null}", "location": "{City, ST}", "zip": "{zip}", "preferred_theater": "{theater_or_null}", "babysitter_rate": {rate}, "calendar_tool": "{tool}", "onboarded_at": "{ISO_TIMESTAMP}" } EOF ``` ```bash mkdir -p ~/.openclaw/skills/date-night/state playwright-cli -s=resy state-save ~/.openclaw/skills/date-night/state/resy-auth.json ``` ### Technical Analysis The commands rely on the process's ambient `umask` and do not enforce access modes on either the data directory or the files. The configuration contains names, phone numbers, email addresses, family information, and location. The Resy state file can contain reusable session cookies and other browser storage representing an authenticated session. Plaintext storage is disclosed, but the implementation does not apply standard local secret protections such as a `0700` directory and `0600` files. Consent is also described in `SKILL.md`, but the shown Resy flow saves state directly after login without an explicit consent step in that workflow. ### Attack Path 1. The user completes onboarding or logs into Resy. 2. The Skill creates the destination directories using default permissions. 3. It writes PII to `config.json` and browser authentication material to `resy-auth.json`. 4. If the environment has a permissive `umask`, another local account o ...[truncated 490 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/smart-features.md:193
Finding: User-controlled values are interpolated directly into executable Python source
Content: View full analysis
/dev/null || true ``` ### Technical Analysis Template values such as `{Restaurant}` and `{notes}` are inserted into quoted Python literals, while `{actual}`, `{rating}`, and `{true|false}` are inserted as raw Python expressions. These values are neither encoded nor passed as data. A quote, newline, command substitution sequence, or crafted Python expression can alter the generated program. The outer program is also enclosed in a shell double-quoted argument. Consequently, shell substitutions embedded in an interpolated value may execute before Python starts, while Python quote-breaking payloads can execute inside the interpreter. ### Attack Path 1. An attacker influences a restaurant name, note, rating, or actual-spend value processed by the Skill. 2. The value is substituted into the `python3 -c` template without escaping. 3. The crafted input terminates the intended shell or Python string. 4. The remaining payload is interpreted as shell syntax or Python code. 5. The injected code executes with the same local privileges as the agent. 6. The final `|| true` and redirected standard error may hide evidence of failed or partial exploitation. ### Impact Assessment Successful exploitation provides arbitrary code execution under the agent' ...[truncated 284 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/sms-codes.md:35
Finding: Predictable shared temporary file enables symlink and race-condition attacks
Content: View full analysis
/tmp/conf.json && \ mv /tmp/conf.json ~/.openclaw/skills/date-night/config.json ``` ### Technical Analysis The update operation uses the fixed, globally predictable path `/tmp/conf.json`. Shared temporary directories are normally writable by other local users. A local attacker can pre-create the path as a symbolic link or repeatedly replace it during the update. The temporary file also inherits ambient permissions, potentially making a copy of the sensitive configuration readable before it is moved. Moving a file from `/tmp` does not automatically correct its mode. ### Attack Path 1. A local attacker predicts that the Skill will use `/tmp/conf.json`. 2. The attacker creates that path as a symbolic link to another file writable by the victim, or races the Skill's write and move operations. 3. The `jq` redirection follows the attacker-controlled path. 4. Data is written to an unintended target, or an attacker-controlled file is moved over the Skill configuration. 5. The attacker causes file corruption, unauthorized overwrite, or exposure of configuration data. ### Impact Assessment The flaw can corrupt the date-night configuration, disclose its PII, or overwrite another file writable by the agent account. The precise impact is constrained by the operating-system account's existing permissions, but no additional privilege is required beyond local access to the shared temporary directory. ]]>
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:37
Finding: Mutable latest-version package installation creates supply-chain execution risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/pre-evening.md:90
Finding: User location and itinerary details are transmitted to additional third-party services without sufficiently specific disclosure
Content: View full analysis
/dev/null | \ jq -r '.[0].formattedAddress' 2>/dev/null || true ``` ```bash # wttr.in — free, no API key curl -s "wttr.in/{config.location}?format=%l:+%t+%C+💧%p+💨%w" 2>/dev/null || true # Simpler format curl -s "wttr.in/{config.location}?format=3" 2>/dev/null || true ``` ```bash web_search "concerts near {config.location} {month} {year}" web_search "events near {config.zip} this weekend" web_search "comedy shows near {config.location} 2026" web_search "Broadway shows {config.location} 2026 season" ``` ### Technical Analysis The Skill sends configured location or ZIP data to search providers, Google Places, and `wttr.in`. Drive-time queries can combine the user's origin with a restaurant or venue destination, allowing a provider to infer itinerary information. Event and restaurant queries also disclose interests and approximate location. These transmissions are related to the declared weather, travel, restaurant, and event-search functionality. However, the Skill's privacy language focuses on transmitting name, email, and phone only to booking sites and does not clearly enumerate the additional recipients, transmitted location fields, retention implications, or combined itinerary data. ### Attack Path 1. The user supplies a city, ZIP code, or other location during onboarding. 2. A search, weather check, or post-booking intelligence workflow starts. 3. The Skill interpolates the stored location into a web-search, Places, or `wttr.in` request. 4. ...[truncated 570 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (52)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.
md
**Partner notifications:** Notifications are always **drafted and shown to the user for approval** before sending. The skill never sends messages autonomously. The messaging channel (iMessage/Telegram/Discord/Signal) is whatever the user configures in their OpenClaw instance — no additional credentials are stored by this skill. **Auth state persistence:** The Resy flow optionally saves browser session state to `~/.openclaw/skills/date-night/state/resy-auth.json` to avoid re-login. This file contains session cookies. To clear: `rm -rf ~/.openclaw/skills/date-night/state/`. The skill **never asks for or stores site passwords** — it uses interactive browser login and saves only the resulting session cookies with user consent. ### Data Persistence

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 304)May include surrounding context.
md
**Partner notifications:** Notifications are always **drafted and shown to the user for approval** before sending. The skill never sends messages autonomously. The messaging channel (iMessage/Telegram/Discord/Signal) is whatever the user configures in their OpenClaw instance — no additional credentials are stored by this skill. **Auth state persistence:** The Resy flow optionally saves browser session state to `~/.openclaw/skills/date-night/state/resy-auth.json` to avoid re-login. This file contains session cookies. To clear: `rm -rf ~/.openclaw/skills/date-night/state/`. The skill **never asks for or stores site passwords** — it uses interactive browser login and saves only the resulting session cookies with user consent. ### Data Persistence

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.
md
**Partner notifications:** Notifications are always **drafted and shown to the user for approval** before sending. The skill never sends messages autonomously. The messaging channel (iMessage/Telegram/Discord/Signal) is whatever the user configures in their OpenClaw instance — no additional credentials are stored by this skill. **Auth state persistence:** The Resy flow optionally saves browser session state to `~/.openclaw/skills/date-night/state/resy-auth.json` to avoid re-login. This file contains session cookies. To clear: `rm -rf ~/.openclaw/skills/date-night/state/`. The skill **never asks for or stores site passwords** — it uses interactive browser login and saves only the resulting session cookies with user consent. ### Data Persistence

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.
md
**Partner notifications:** Notifications are always **drafted and shown to the user for approval** before sending. The skill never sends messages autonomously. The messaging channel (iMessage/Telegram/Discord/Signal) is whatever the user configures in their OpenClaw instance — no additional credentials are stored by this skill. **Auth state persistence:** The Resy flow optionally saves browser session state to `~/.openclaw/skills/date-night/state/resy-auth.json` to avoid re-login. This file contains session cookies. To clear: `rm -rf ~/.openclaw/skills/date-night/state/`. The skill **never asks for or stores site passwords** — it uses interactive browser login and saves only the resulting session cookies with user consent. ### Data Persistence

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 304)May include surrounding context.
| ~/.openclaw/skills/date-night/history.jsonl | Date night log (restaurant, date, rating) | Low | | ~/.openclaw/skills/date-night/state/*.json | Browser session cookies (Resy only, opt-in) | Yes — auth tokens |

To purge all skill data: rm -rf ~/.openclaw/skills/date-night/

Pre-Flight Check

bash

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 304)May include surrounding context.
| ~/.openclaw/skills/date-night/history.jsonl | Date night log (restaurant, date, rating) | Low | | ~/.openclaw/skills/date-night/state/*.json | Browser session cookies (Resy only, opt-in) | Yes — auth tokens |

To purge all skill data: rm -rf ~/.openclaw/skills/date-night/

Pre-Flight Check

bash

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.
md
| Restaurant search | [references/search-restaurants.md](references/search-restaurants.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.
md
| Restaurant search | [references/search-restaurants.md](references/search-restaurants.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.
md
| Movie booking | [references/movie-booking.md](references/movie-booking.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 362)May include surrounding context.
md
| Movie booking | [references/movie-booking.md](references/movie-booking.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 324)May include surrounding context.
md
| Event tickets | [references/event-tickets.md](references/event-tickets.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 373)May include surrounding context.
md
| Event tickets | [references/event-tickets.md](references/event-tickets.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.
md
| Finding movies | [references/search-movies.md](references/search-movies.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 362)May include surrounding context.
md
| Finding movies | [references/search-movies.md](references/search-movies.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.
md
| Finding events | [references/search-events.md](references/search-events.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 327)May include surrounding context.
md
| Modify / Cancel | [references/modify-cancel.md](references/modify-cancel.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.
md
| SMS verification | [references/sms-codes.md](references/sms-codes.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 348)May include surrounding context.
md
| SMS verification | [references/sms-codes.md](references/sms-codes.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.
md
| Pre-evening intel | [references/pre-evening.md](references/pre-evening.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 330)May include surrounding context.
md
| Smart features | [references/smart-features.md](references/smart-features.md) |

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The flow explicitly instructs the agent to search the user's iMessage history for Resy verification codes, which exceeds the minimum access needed for booking and exposes unrelated private messages. In this date-night automation context, harvesting OTPs from a local message store creates a strong risk of unauthorized access to account-authentication data and broader privacy compromise.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill combines a long broad trigger list with open-ended natural-language examples, making invocation boundaries unclear. In a high-capability skill that performs browser automation, uses stored personal data, and may query messages or email, ambiguous activation materially raises the risk of unintended actions or data access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes broad everyday phrases like date ideas, events near me, and what's playing, which can cause the skill to activate in contexts where the user did not intend browser automation, ticket workflows, or access to stored preferences. Because this skill can read local PII, fetch SMS verification codes, and drive booking actions, accidental activation increases the chance of unintended sensitive operations.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T06 · System Persistence

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Pre-Flight Check

Tool Parameter Abuse

Pre-Flight Check

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Context-Inappropriate Capability

Vague Triggers

Vague Triggers

Rp1

Rp1