Daily Recorder Assistant

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:34 AM UTC
• Version: 1.1.3

Overview

This daily journaling skill is mostly purpose-aligned, but it needs Review because it can install persistent recurring reminders and its promised user isolation is not fully reflected in the storage design.

Install only if you are comfortable with a local journal of energy, tasks, plans, and reflections being stored under the OpenClaw workspace. Treat the cron setup as optional: before running setup_cron.py, confirm the destination user/channel, understand that it creates recurring jobs, and know how to list and remove OpenClaw cron jobs. This skill is best for single-user use unless storage is changed to separate notes by user/channel.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: scripts/setup_cron.py:107
• Finding: Persistent Recurring OpenClaw Jobs Installed Without Lifecycle Controls## Vulnerability Details **File Location**: `scripts/setup_cron.py:107-125` **Additional Location**: `scripts/setup_cron.py:158-183` **Vulnerability Type**: Persistent scheduled-task installation **Risk Level**: High ### Vulnerable Code ```python def execute_openclaw_cron(job_name, cron_expr, message): current_channel = load_active_channel() try: current_user_id = load_user_id_for_channel(current_channel) args = [ 'openclaw', 'cron', 'add', '--name', job_name, '--cron', cron_expr, '--tz', CURRENT_TZ, '--session', 'isolated', '--wake', 'now', '--channel', current_channel, '--to', current_user_id, '--message', message, '--announce' ] result = subprocess.run(args, capture_output=True, text=True) ``` The function is called by the main installation flow to create the following recurring jobs: - `daily-recorder-assistant-morning` with schedule `0 8 * * *` - `daily-recorder-assistant-evening` with schedule `0 18 * * *` ### Technical Analysis The setup script invokes `openclaw cron add` to create two recurring scheduled jobs. These jobs remain registered after the script and invoking session terminate, wake isolated OpenClaw sessions, and announce messages to the channel and user identifier loaded from persistent `state.json`. Scheduled reminders are related to the declared daily-recording functionality and installation is documented as a separate setup step. However, the persistence mechanism is not required for manual recording, analysis, or planning. It therefore exceeds the minimum privileges necessary for the Skill's core functionality unless the user explicitly opts into automated reminders. The script checks whether similarly named jobs already exist, but it continues installation when they are found. Consequently, repeated execution c ...[truncated 1913 chars]
• Remediation: ## Remediation Suggestions 1. Keep manual operation as the default and require an explicit `--install-reminders` option. 2. Display the exact schedules, destination channel, destination user, and persistence implications before installation. 3. Require interactive confirmation immediately before invoking `openclaw cron add`, with a noninteractive confirmation flag for controlled automation. 4. Abort when matching jobs already exist unless the user supplies an explicit `--force` or `--allow-duplicates` option. 5. Record the exact job IDs returned by OpenClaw in a dedicated state structure after successful installation. 6. Add an `--uninstall` mode that removes only the exact job IDs created by this Skill. 7. Support optional expiration dates or bounded reminder counts rather than indefinite recurrence. 8. Validate that the destination user ID is authorized and reject placeholder values such as unconfigured or pending authorization. 9. Document removal commands directly beside installation instructions. 10. Correct the initialization message that describes `setup_cron.py` as a system crontab mechanism; the reviewed implementation registers OpenClaw cron jobs instead.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (42)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill includes cron/task-management capability that is not reflected in the high-level purpose statement, meaning it can create persistent scheduled actions beyond what users may expect from a simple journaling assistant. Undeclared automation increases risk because it can continue messaging or operating after initial invocation and broadens the attack surface via CLI scheduling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill includes cron/task-management capability that is not reflected in the high-level purpose statement, meaning it can create persistent scheduled actions beyond what users may expect from a simple journaling assistant. Undeclared automation increases risk because it can continue messaging or operating after initial invocation and broadens the attack surface via CLI scheduling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill includes cron/task-management capability that is not reflected in the high-level purpose statement, meaning it can create persistent scheduled actions beyond what users may expect from a simple journaling assistant. Undeclared automation increases risk because it can continue messaging or operating after initial invocation and broadens the attack surface via CLI scheduling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: The skill includes cron/task-management capability that is not reflected in the high-level purpose statement, meaning it can create persistent scheduled actions beyond what users may expect from a simple journaling assistant. Undeclared automation increases risk because it can continue messaging or operating after initial invocation and broadens the attack surface via CLI scheduling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill includes cron/task-management capability that is not reflected in the high-level purpose statement, meaning it can create persistent scheduled actions beyond what users may expect from a simple journaling assistant. Undeclared automation increases risk because it can continue messaging or operating after initial invocation and broadens the attack surface via CLI scheduling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill includes cron/task-management capability that is not reflected in the high-level purpose statement, meaning it can create persistent scheduled actions beyond what users may expect from a simple journaling assistant. Undeclared automation increases risk because it can continue messaging or operating after initial invocation and broadens the attack surface via CLI scheduling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill includes cron/task-management capability that is not reflected in the high-level purpose statement, meaning it can create persistent scheduled actions beyond what users may expect from a simple journaling assistant. Undeclared automation increases risk because it can continue messaging or operating after initial invocation and broadens the attack surface via CLI scheduling.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill metadata promises per-User-ID isolation, but note creation uses a single daily filename under a shared directory with no user-specific path or filename component. In a multi-user deployment, one user's morning/evening entries can be written into the same note as another user's data, causing privacy leakage, record corruption, and possible cross-user prompt/context contamination.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares broad operational behavior including shell execution, file reads/writes, and environment-dependent actions, but it does not define any explicit tool scope or permissions boundary. In an agent environment, this increases the chance that the skill can be invoked with more capability than users expect, especially since it also documents subprocess-based CLI use and persistent filesystem writes.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill is explicitly designed to collect and persist personal status data over time and across channels, including energy, mental state, plans, and review content. In this context, that creates significant privacy risk, especially because the documentation does not clearly demonstrate robust per-user isolation, minimization, retention limits, or access controls.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Using broad natural-language patterns like generic energy statements as implicit triggers can cause accidental invocation and unintended recording. In this skill context, mistaken activation is more serious because the action leads to persistent storage of personal status information rather than a harmless one-off response.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The phrase 'user directly replies with energy/task information' is too ambiguous to safely gate data-modifying behavior. Without a clearly scoped interaction state, ordinary conversation content may be parsed and saved unintentionally, creating privacy and integrity issues in the stored records.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill describes automatic recording and state-file updates, but it does not prominently obtain or confirm consent for persistent storage of user-provided content. Because the stored data includes subjective status and planning details, silent persistence raises privacy and compliance concerns.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Automatic parsing and storage of all user feedback without tight minimization boundaries can lead to over-collection of sensitive data, including health-adjacent or emotionally revealing information. The danger is elevated here because the skill encourages natural-language replies, making users more likely to disclose extra details that will be silently persisted.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The examples normalize long-term storage of detailed personal reflections, barriers, plans, and progress metrics, which can reveal sensitive behavioral patterns over time. If user isolation, consent, or retention controls are weak, this dataset becomes a high-value privacy target and may enable profiling or cross-user exposure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The template states that the assistant automatically records user notes and uses them for later periodic analysis, but it provides no notice about retention, visibility, consent, or handling of potentially sensitive personal productivity and wellbeing data. In a journaling-style skill that captures daily status, energy, problems, and plans, this creates a real privacy risk because users may disclose personal or work-sensitive information without understanding how it is stored or reused.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The entire template is written in Chinese, including headings, labels, and the generation note, with no indication that users can select another language. This creates a locale/language policy concern because the skill appears to impose a specific language by default rather than offering opt-in or documenting a justified region-specific restriction.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This markdown file presents itself as an English interaction template set, yet several lines include Chinese phrases such as use-case notes and embedded template text. That creates a language/locale policy issue because the skill content effectively mixes languages without documenting user opt-in or offering a language selection.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The title explicitly labels the template library as a Chinese-only version, which indicates a fixed language choice. Under the policy rules, forcing a specific language without offering user opt-in or alternatives is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This is a natural-language policy issue because the file hard-codes a specific language for the docstring and later console output, with no opt-in or alternative locale. The stated policy says to flag language or locale constraints unless the skill offers user choice or clearly documents a justified regional scope.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code file contains natural-language documentation and output strings entirely in Chinese, including the module description and user-facing report text. Under the policy rule, forcing a specific language without user opt-in is a locale-policy violation unless the regional constraint is explicitly documented and justified, which is not present here.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The header documentation describes a read/generate flow: read yesterday's record, select templates, inject variables, and output the final query text. In contrast, the main function includes a record_feedback mode that parses user input and invokes record_feedback.main to persist data, which is a contradictory side effect relative to the documented intent.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The language-selection logic falls back to 'zh' whenever the message is absent or does not match a small set of English triggers, and several prompts/messages are hardcoded in Chinese. This forces a specific language by default rather than offering the user a language choice or documenting a justified locale restriction.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The status-report path prints a stored feishu user ID from persistent state, which is personal identifier data not necessary for a typical journaling status response. If status_query can be invoked by the wrong user or surfaced in shared logs/channels, it leaks identifying information and weakens user privacy.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This script's stated purpose is generating daily prompts, but in record_feedback mode it also parses user input and invokes record_feedback.main(), which can persist user-provided content to notes. That hidden write capability expands the trust boundary and can surprise integrators or users who expect a read/generate-only component, increasing privacy and integrity risk for journaling data.

Static analysis

No suspicious patterns detected.