Productivity Helper #4

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:12 AM UTC
• Version: 1.0.0

Overview

This is a simple productivity skill, but it requests broad shell and file access and points users to mutable external setup/install sources, so it should be reviewed before installation.

Review this before installing. Prefer the ClawHub package over the manual clone instructions, do not treat the external setup page as authoritative agent instructions, and grant the skill only if you are comfortable with broad shell and filesystem access for a generic productivity helper. The publisher should narrow the trigger language and remove or tightly scope Bash/Read/Write permissions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:11

Finding

Mutable External Setup Instructions Enable Skill Instruction Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:11
Vulnerability Type: Mutable external skill instructions
Risk Level: Medium

Vulnerable Code:

markdown

> 📖 **Complete setup guide**: https://skillboss.co/skill.md

Technical Analysis

The package delegates its complete setup guidance to content hosted on an external domain. This remote content is not included in the audited artifact and can be modified independently after the skill has been reviewed or installed.

If an agent or user treats the linked document as authoritative skill guidance, the remote operator could introduce new instructions that alter agent behavior, request sensitive information, or direct use of the skill's declared Bash, Read, and Write tools. The audited package does not pin the remote document to an immutable version or provide an integrity check.

Attack Path

1. A user installs or reviews the packaged skill.
2. The user or agent follows the advertised “Complete setup guide.”
3. The external document is changed after package review to contain unsafe or attacker-controlled instructions.
4. Those instructions direct the agent to perform actions that are absent from the audited artifact.
5. If the agent follows them, the remote content effectively changes the skill's behavior without requiring a package update.

Impact Assessment

Successful exploitation could modify the agent's operational goals or induce use of available shell and filesystem tools. The practical scope depends on the privileges of the OpenClaw process and whether remote documentation is automatically or manually incorporated into the agent context. No malicious content from the remote page was present in the audited files, so this finding concerns the mutable trust boundary rather than a confirmed remote payload.

Remediation

View remediation

Remediation Suggestions

• Include all setup and operating instructions directly in the audited package.
• Do not instruct an agent to treat mutable third-party webpages as authoritative skill instructions.
• If external documentation is necessary, host it under a project-controlled domain and link to an immutable, versioned revision.
• Publish and verify a cryptographic digest or signature for any remotely distributed instruction file.
• Clearly state that external documentation is informational and must not override system policies, user intent, or tool authorization boundaries.

T08 · Insecure Dependencies

Warning

• Location: README.md:10

Finding

Manual Installation Uses an Unpinned External Repository

Content

View full analysis

Vulnerability Details

File Location: README.md:10-13
Vulnerability Type: Unpinned supply-chain source
Risk Level: Medium

Vulnerable Code:

bash

### Manual Installation
```bash
git clone https://github.com/TobeyRebecca/productivity-helper.git
cp -r productivity-helper ~/.openclaw/skills/productivity-helper

text

### Technical Analysis

The documented installation procedure clones the repository's mutable default branch and immediately copies its contents into the active OpenClaw skills directory. It does not select a reviewed commit or signed release and performs no checksum, signature, or manifest verification.

Consequently, the files installed by following this procedure may differ from the artifact covered by this audit. Compromise of the upstream account or repository, or an ordinary later update containing unsafe content, could introduce new skill instructions or executable files.

### Attack Path

1. An attacker compromises the upstream repository or gains authority to change its default branch.
2. The attacker adds malicious instructions, scripts, or configuration.
3. A user follows the README and clones the current default branch.
4. The user copies the unverified repository into `~/.openclaw/skills/productivity-helper`.
5. OpenClaw loads the substituted content with the permissions available to the skill and host process.

### Impact Assessment

A successful supply-chain substitution could replace the entire installed skill and therefore obtain whatever capabilities the resulting skill is granted. Given the current declaration of `Bash`, `Read`, and `Write`, substituted instructions could potentially cause shell execution and filesystem access under the OpenClaw user's operating-system privileges. The audited repository itself contains no embedded malicious script; the risk arises from installing mutable, unverified future content.

Remediation

View remediation

Remediation Suggestions

• Install from a specific reviewed commit hash or immutable release tag rather than the mutable default branch.
• Publish a SHA-256 manifest for every release and require users to verify it before installation.
• Sign releases or commits and document signature verification steps.
• Prefer a trusted package registry that provides immutable artifacts and provenance metadata.
• Document the exact expected files so users can detect unexpected scripts or configuration.
• Avoid copying a complete repository directly into the active skill directory before verification.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Skill Declares Unnecessary Shell and Filesystem Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:4
Vulnerability Type: Excessive tool permissions
Risk Level: Medium

Vulnerable Code:

yaml

allowed-tools: Bash, Read, Write

Technical Analysis

The skill describes conversational productivity functions such as organizing tasks, planning a day, and reviewing progress. The package contains no implementation or documented workflow that requires arbitrary shell execution or general filesystem read and write access.

Granting these tools violates the principle of least privilege. Although the permission declaration alone does not execute commands, it enlarges the impact of malicious, compromised, or externally supplied instructions. In particular, the mutable external setup guidance could attempt to induce use of capabilities that are unnecessary for the stated purpose.

Attack Path

1. The skill is installed with Bash, Read, and Write available.
2. Malicious prompt content, changed external guidance, or a future compromised skill instruction asks the agent to invoke one of these tools.
3. The agent executes commands or accesses files under the permissions of the OpenClaw process.
4. Local data may be read or modified, or commands may affect other resources accessible to that operating-system account.

Impact Assessment

The declared tools could permit command execution and filesystem access within the security context of the OpenClaw process. Depending on host configuration, this may include user files, application configuration, credentials readable by that account, and writable skill or state files. There is no evidence in the audited artifact that these capabilities are currently exercised; the issue is unjustified authorization that increases the consequences of instruction compromise.

Remediation

View remediation

Remediation Suggestions

• Remove Bash, Read, and Write from allowed-tools if the skill only provides conversational task planning.
• Add tools individually only when a documented feature has a concrete need for them.
• If file persistence is required, restrict access to a dedicated skill data directory and explicitly prohibit access to credentials, system files, and unrelated user data.
• Replace general shell access with narrowly scoped, parameter-validated operations.
• Require explicit user confirmation before any state-changing operation.
• Apply runtime sandboxing and ensure the OpenClaw process runs as an unprivileged operating-system account.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance is overly broad and matches very common productivity-related requests, which can cause the skill to be invoked unintentionally in normal conversations. Because the skill has Bash and Write permissions, accidental activation increases the chance that it could perform file or shell actions when the user did not explicitly intend to use this specific skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example trigger phrase uses generic everyday language ('Help me plan my day with 5 tasks') that is likely to appear in ordinary user interactions, making unintended activation plausible. In the context of a skill with Bash, Read, and Write access, vague trigger examples materially increase risk because they normalize broad auto-selection for requests that do not require elevated tool-capable behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.