Productivity Helper #1

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:49 AM UTC
• Version: 1.0.0

Overview

This looks like a simple productivity helper, but it grants broad shell and file access and can activate on ordinary planning requests without clear limits.

Review carefully before installing. This skill contains no bundled executable scripts or obvious malicious instructions, but it gives an agent shell and file read/write authority for very broad productivity prompts. Install only from a trusted, versioned source, avoid following mutable external setup instructions without verification, and consider narrowing tool permissions or activation wording before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:7
• Finding: Mutable and Unverified Remote Sources Used for Skill Installation## Vulnerability Details **File Location**: `README.md:7-15`; `SKILL.md:10` **Vulnerability Type**: Unpinned and unverified remote dependencies **Risk Level**: Medium The project instructs users to obtain installation material from mutable remote sources without pinning a release, commit, checksum, or cryptographic signature. Complete affected code from `README.md:7-15`: ```markdown ### Via ClawHub ```bash clawhub install toby-productivity-helper ``` ### Manual Installation ```bash git clone https://github.com/TobeyRebecca/productivity-helper.git cp -r productivity-helper ~/.openclaw/skills/productivity-helper ``` ``` Related external setup reference from `SKILL.md:10`: ```markdown > 📖 **Complete setup guide**: https://skillboss.co/skill.md ``` ### Technical Analysis Both documented installation methods resolve mutable remote content. The ClawHub command does not specify a reviewed version, while the Git command clones the repository's current default branch rather than an immutable commit. The downloaded repository is subsequently copied into the active OpenClaw skills directory. The externally hosted setup guide is also outside the audited artifact and can change independently after review. No checksum, signature, expected commit identifier, or trusted release manifest is supplied for any of these sources. Consequently, the content installed or followed by a user may differ from the two documentation files examined during this audit. This is a supply-chain trust weakness rather than evidence that the current repository contains malicious code. Exploitation requires compromise or unauthorized modification of a referenced registry entry, repository, hosting account, or external guide, followed by a user performing the documented installation or setup procedure. ### Attack Path 1. An attacker compromises or gains publishing access to the referenced ClawHub package, GitHub repository, DNS/hosting inf ...[truncated 1521 chars]
• Remediation: ## Remediation Suggestions 1. Publish versioned, immutable releases and instruct users to install an explicitly reviewed version. 2. For Git-based installation, pin the command to a full commit hash or signed release tag rather than the mutable default branch. 3. Publish SHA-256 checksums or a signed manifest for release archives and require verification before installation. 4. Use signed commits and release artifacts, and document how users should verify the maintainer signature. 5. Pin the ClawHub command to a specific package version if the registry supports version selection. 6. Include all required setup instructions inside the reviewed repository instead of relying on a mutable external setup page. 7. If an external guide remains necessary, link to an immutable version and clearly identify its expected digest or revision. 8. Review downloaded contents before copying them into the active OpenClaw skills directory. 9. Remove the unnecessary `Bash`, `Read`, and `Write` tool permissions unless concrete Skill functionality requires them, thereby reducing the impact of a future supply-chain compromise.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation guidance is broad enough to match ordinary productivity requests such as organizing tasks, planning a day, or tracking time. This can cause the skill to be invoked unintentionally in many normal conversations, expanding the circumstances under which its tools and instructions become active without clear user intent.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The example phrase, 'Help me plan my day with 5 tasks,' is indistinguishable from common everyday speech. If used as a trigger exemplar, it increases the chance of accidental activation during routine user requests, which may unexpectedly enable the skill's Bash/Read/Write tool access in otherwise ordinary interactions.

Static analysis

No suspicious patterns detected.