T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/collect-data.py:331- Finding
Excessive Collection and Cloud Disclosure of Local Identity and Memory Content
- Content
View full analysis
- Remediation
View remediation
Security audit
openclaw's digital card
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed OpenClaw profile-card generator, but it uses sensitive local profile and memory excerpts, so users should review privacy implications before running it.
Install only if you are comfortable with a card generator reading OpenClaw profile, identity, memory, skills, and session metadata. Before using a cloud model, review USER.md, IDENTITY.md, and MEMORY.md for sensitive content, prefer local or explicitly chosen excerpts when possible, clean up temporary JSON/HTML files, and only use trusted background image URLs or local image paths.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/render-background-card.py:21- Finding
HTML and CSS Injection Through the Unescaped Background Argument
- Content
View full analysis
str: """Return a background address that can be used directly in CSS url().""" if raw is None: return DEFAULT_BG_URL if raw.startswith(('http://', 'https://')): return raw return Path(raw).as_posix() ``` The resulting value is inserted without escaping: ```python bg = _resolve_bg(sys.argv[3] if len(sys.argv) > 3 else None) replacements = { '{{display_name}}': _esc(data.get('display_name', 'Unknown')), '{{role_title}}': _esc(data.get('role_title', '')), '{{recent_focus}}': _esc(data.get('recent_focus', '')), '{{default_model}}': _esc(data.get('default_model', 'Unknown')), '{{token_30d_short}}': _esc(shorten_tokens(data.get('token_30d_display', '0 tokens'))), '{{skills_count}}': _esc(str(data.get('skills_count', 0))), '{{skill_chips}}': ''.join([f'{_esc(s)}' for s in data.get('skill_names', [])]), '{{platform_count}}': _esc(str(len(data.get('platforms', [])))), '{{born_label}}': _esc(data.get('born_label', 'Born')), '{{born_date}}': _esc(data.get('born_date', '')), '{{generated_at}}': _esc(data.get('generated_at', '')), '{{platform_chips}}': ''.join([f'{_esc(p)}' for p in data.get('platforms', [])]), '{{openclaw_review}}': _esc(data.get('openclaw_review', '')), '{{background_image}}': bg, } ``` The template places it inside a quoted CSS URL: ```html background-image: linear-gradient(90deg, rgba(7,10,14,0.72) 0%, rgba(7,10,14,0.44) 34%, rgba(7,10,14,0.10) 60%, rgba(7,10,14,0.08) 100%), linear-gradient(180deg, rgba(7 ...[truncated 2321 chars]- Remediation
View remediation
`, encoded delimiters, and malformed URLs. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The description frames the skill as a read-only card generator, but the documented behavior includes extracting large excerpts from
USER.md,IDENTITY.md, andMEMORY.md, enumerating installed skills, inferring first-run dates from session history, and packaging these into structured outputs for LLM use. This mismatch is dangerous because users may consent to a cosmetic rendering task without realizing the skill performs broader local profiling and may send excerpts to a cloud model via the agent runtime.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The description frames the skill as a read-only card generator, but the documented behavior includes extracting large excerpts from
USER.md,IDENTITY.md, andMEMORY.md, enumerating installed skills, inferring first-run dates from session history, and packaging these into structured outputs for LLM use. This mismatch is dangerous because users may consent to a cosmetic rendering task without realizing the skill performs broader local profiling and may send excerpts to a cloud model via the agent runtime.- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 数据采集和 HTML 预览（`collect-data.py`、`render-background-card.py`）仅需 Python 3.10+。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 数据采集和 HTML 预览（`collect-data.py`、`render-background-card.py`）仅需 Python 3.10+。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 数据采集和 HTML 预览（`collect-data.py`、`render-background-card.py`）仅需 Python 3.10+。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 数据采集和 HTML 预览（`collect-data.py`、`render-background-card.py`）仅需 Python 3.10+。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 数据采集和 HTML 预览（`collect-data.py`、`render-background-card.py`）仅需 Python 3.10+。
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill declares no explicit tool scope even though its documented workflow clearly includes reading sensitive local files and writing temporary JSON/HTML outputs outside the skill directory. Without a restrictive permission declaration, an agent runtime may grant broader-than-necessary file access, increasing the chance of unintended data exposure from
~/.openclawworkspace and session artifacts.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The primary description text forces a specific language/locale for users without indicating that Chinese is optional or user-selected. Under the policy, language constraints should either be optional or clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The HTML root element sets lang="zh-CN", which imposes a specific language/locale in a file that otherwise contains English UI text and provides no opt-in or explanation. This matches the policy category for forcing a locale without user choice.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
These lines define AI-generated fields sourced from USER.md, IDENTITY.md, MEMORY.md, memory bullets, and stats summaries, which creates a direct natural-language exfiltration path from private local documents into rendered output. Because summarization and commentary can restate or infer sensitive facts, the danger is not only verbatim leakage but also derived disclosure of personal profile and behavioral data.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The execution flow states that collected local-file material is fed to the AI and then written back into JSON for rendering, formalizing a pipeline that transforms sensitive inputs into visible artifacts. This is risky because the output JSON/HTML/PNG may persist, be shared, or be inspected later, extending the exposure of data drawn from personal files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documented flow explicitly reads personal workspace, identity, memory, and session files and passes excerpts into an AI step, but the file shows no user-facing consent, minimization, or warning boundary around that data use. Even in a local-only skill, this creates a privacy vulnerability because sensitive content can be unintentionally surfaced in generated card text or logs beyond what the user expected from 'generate a card'.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The dependency summary confirms that personal and memory files are intentional AI source material, reinforcing that the skill is designed to ingest sensitive local context that may be surfaced in generated content. In the context of a personal card generator, this makes disclosure more dangerous because the final artifact is specifically meant for presentation and possible sharing.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This script embeds natural-language content in Chinese, including a Chinese-only docstring fallback description and later a hard-coded Chinese review string. Because the file provides no user opt-in or locale-selection mechanism, it appears to force a specific language, which matches the language/locale policy violation criteria.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script goes beyond the stated scope of reading identity info, config, and session statistics by collecting excerpts from USER.md, IDENTITY.md, MEMORY.md, and memory bullet content into copy_inputs for downstream generation. Even if it does not exfiltrate data itself, this broad aggregation increases exposure of sensitive personal context and creates a mismatch between declared behavior and actual data access, which can lead to overcollection and unintended disclosure in rendered outputs or later pipeline stages.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The value '一个对 AI 有自己想法的人。' is emitted as part of output data and is clearly user-facing natural language. Since the script does not provide any language preference handling or opt-in, this constitutes a likely locale policy violation under the stated rules.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes the skill as operating in '只读模式' while this script writes a rendered HTML file to the user-supplied output path. Although rendering an HTML preview is within the feature set, the explicit read-only claim creates a semantic mismatch because the code performs filesystem writes.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The docstring emphasizes a privacy-limited approach for session parsing, stating that no message body or other sensitive content is extracted. While that is true for this function itself, the overall script later collects sizeable excerpts from USER.md, IDENTITY.md, and MEMORY.md as generation material, which undercuts the file’s privacy-minimizing intent as documented. This creates an intent mismatch at the documentation level within the script.
- Content
Static analysis
No suspicious patterns detected.