ClawHub
Back to skill

Security audit

Personal Fit Coach

Security checks for vulnerabilities and agentic risk

Overview

This fitness-tracking skill is coherent and disclosed, but it stores sensitive health records as local plaintext Markdown files.

Install only if you are comfortable keeping weight, diet, exercise, injury, and related health notes in local Markdown files. On shared or synchronized machines, secure ~/.openclaw/private/personal-fit-coach/ with restrictive permissions before storing sensitive details.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:118
Finding

Sensitive Health Data Stored in Plaintext Without Required Access Controls

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 118–186
Vulnerability Type: Plaintext sensitive-data storage with insufficient filesystem protections
Risk Level: Medium

Vulnerable Code

markdown
Store all personal fitness data only inside:

```text
~/.openclaw/private/personal-fit-coach/

Create this directory when needed. Use these files:

text
~/.openclaw/private/personal-fit-coach/profile.md
~/.openclaw/private/personal-fit-coach/goals.md
~/.openclaw/private/personal-fit-coach/food-options.md
~/.openclaw/private/personal-fit-coach/current-plan.md
~/.openclaw/private/personal-fit-coach/daily-log.md
~/.openclaw/private/personal-fit-coach/weekly-review.md

profile.md

Stable health-related profile information.

markdown
# Personal Fit Profile

- Height:
- Age:
- Sex:
- Current weight:
- Body measurements:
- Known constraints:
- Injury history:
- Training level:
- Diet preferences:
- Exercise preferences:
- Health warnings:
text

### Technical Analysis

The skill requires persistent storage of sensitive personal and health information in ordinary Markdown files. The stored fields can include sex, body measurements, injury history, health warnings, weight, diet, exercise, sleep, and behavioral records.

Although the destination directory is named `private`, the instructions do not require restrictive permissions, ownership verification, encryption at rest, safe file creation, or protection against symbolic-link substitution. A directory name alone does not enforce confidentiality. Newly created files may inherit permissions from the host process and its `umask`, potentially making them readable by other local users or processes.

The skill also directs plan generation, weekly reviews, and overview operations to read all six files. This expands the volume of sensitive information exposed if the agent process, filesystem account, or tool o
...[truncated 1438 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require creation of ~/.openclaw/private/personal-fit-coach/ with mode 0700.
  2. Require each health-data file to be created with mode 0600, using an atomic exclusive-create operation where supported.
  3. Verify that the directory and files are owned by the expected user before every read or write.
  4. Reject symbolic links and unexpected non-regular files. Use no-follow semantics and validate the resolved path remains within the intended private directory.
  5. Apply restrictive permissions to existing files during initialization and fail closed if permissions cannot be secured.
  6. Consider encryption at rest using an operating-system credential store or a user-controlled key where the host threat model includes other local users.
  7. Minimize data retention and avoid reading all six files when only a subset is necessary.
  8. Document that the privacy boundary depends on filesystem permissions and that the records must not be stored in shared, synchronized, or broadly backed-up locations without explicit consent.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Rogue AgentSelf-Modification, Session Persistence
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.

md
- No more than three action items.
- Ask no more than two follow-up questions.
- Do not moralize overeating.
- Do not encourage extreme dieting.
- Do not praise or scold.
- Use approximate language when calories are unknown.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
- If a SnapMind-style message includes `/fit`, `fit`, or a clear fitness
  tracking keyword, store only the health-management parts in this skill's
  private files.
- Do not write health data into OpenClaw global memory.
- Do not modify SnapMind records or assume SnapMind storage behavior.
- If the user explicitly asks to send something to SnapMind, let the SnapMind
  workflow handle that separately. This skill only governs the private fitness

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill requires multiple response formats with Chinese section headers and phrasing, effectively forcing a specific language for normal operation. This is a natural-language policy issue because the file does not provide any user opt-in or alternative locale choice, and the skill is not clearly limited to a Chinese-only regional context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The command templates for /fit, /fit log, /fit food, and /fit goal are written as required Chinese outputs, with no instruction to adapt to the user's language. Because the skill can be triggered by English terms such as /fit and fit, this creates a locale constraint that is not justified or user-selectable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.