Productivity Helper #5

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:49 AM UTC
• Version: 1.0.0

Overview

This looks like a simple productivity helper, but it asks for broad shell and file access that its instructions do not justify.

Review this skill carefully before installing. It does not show destructive or exfiltration behavior, but a productivity planner should not usually need shell execution or broad file read/write access. Prefer a version with narrower activation, no Bash access, scoped storage only if needed, and pinned or verified installation sources.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:7

Finding

Installation Uses Mutable and Unverified Upstream Sources

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 7-16
Vulnerability Type: Supply-chain risk caused by unpinned and unverified installation sources
Risk Level: Medium

bash

### Via ClawHub
```bash
clawhub install toby-productivity-helper

Manual Installation

bash

git clone https://github.com/TobeyRebecca/productivity-helper.git
cp -r productivity-helper ~/.openclaw/skills/productivity-helper

text

### Technical Analysis

The documented installation process retrieves the current package or default Git branch without specifying a reviewed version, immutable commit hash, checksum, or cryptographic signature. The ClawHub package identifier and GitHub repository name also differ, making it more difficult for users to verify that both methods deliver the same reviewed artifact.

Because the default branch and registry package are mutable, their contents can change after this version of the documentation has been audited. An attacker who compromises the upstream repository, publisher account, or package-distribution process could introduce malicious skill instructions or executable content. Users following these commands would then install that changed content directly into the OpenClaw skills directory.

### Attack Path

1. An attacker compromises the GitHub account, repository, ClawHub publisher account, or another upstream publication channel.
2. The attacker modifies the default branch or published package to include malicious instructions or code.
3. A user executes one of the documented installation commands without pinning or integrity verification.
4. The mutable upstream content is downloaded and, in the manual workflow, copied into `~/.openclaw/skills/productivity-helper`.
5. OpenClaw subsequently loads the attacker-controlled skill content.
6. Any resulting impact depends on the tools and operating-system privileges available to the OpenClaw process.

### Impact Assessment

Successful exploitation could replace the revi
...[truncated 397 chars]

Remediation

View remediation

Remediation Suggestions

• Pin manual installation to a reviewed, immutable commit or signed release tag rather than the repository's current default branch.
• Publish and verify a SHA-256 or stronger cryptographic digest for the exact installed artifact.
• Require signed releases or repository commits and document how users should verify signatures.
• Pin the ClawHub installation to an explicit immutable version if the package manager supports version selection.
• Use one canonical package identity across ClawHub, GitHub, the skill metadata, and the installation documentation.
• Avoid copying downloaded content into the trusted skills directory until its provenance and integrity have been verified.
• Add a release process that reviews the complete packaged artifact and records its commit, version, and checksum.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Skill Requests Tools Beyond Its Documented Functional Requirements

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Excessive tool authorization and violation of least privilege
Risk Level: Medium

yaml

allowed-tools: Bash, Read, Write

Technical Analysis

The skill declares access to shell execution and file-reading and file-writing tools. Its documented functions are task organization, daily planning, prioritization, time tracking, workflow optimization, and progress review. The project does not document a feature that requires arbitrary command execution or unrestricted local file access.

Granting Bash, Read, and Write increases the consequences of future instruction manipulation, supply-chain compromise, or unsafe model behavior. In particular, shell access can execute commands with the privileges of the OpenClaw process, while read and write access can expose or modify files reachable by that process. The declaration does not identify path restrictions, command allowlists, user-confirmation requirements, or other controls that would constrain these capabilities.

Attack Path

1. An attacker introduces malicious instructions through a compromised skill distribution source, a modified external instruction source, or content interpreted by the skill.
2. The malicious instructions direct the agent to invoke one or more preauthorized tools.
3. Read is used to inspect files available to the OpenClaw process, Write is used to modify accessible files, or Bash is used to execute local commands.
4. The commands or file operations run within the OpenClaw process's operating-system permissions.
5. Data exposure, unauthorized modification, or command execution occurs without being necessary for the advertised productivity-planning task.

This finding establishes unnecessary capability exposure; the reviewed local skill text itself does not contain instructions that actively perform these malicious actions.

Impact Assessment

If the excessive permissions are abu ...[truncated 453 chars]

Remediation

View remediation

Remediation Suggestions

• Remove Bash, Read, and Write from allowed-tools when the skill is used only for conversational planning and prioritization.
• If persistence is required, grant only a narrowly scoped storage tool restricted to a dedicated skill data directory.
• Avoid general shell access; expose specific, validated operations instead of arbitrary commands.
• Restrict readable and writable paths through sandboxing and explicit allowlists.
• Require user confirmation before accessing files, modifying data, or executing any command with external effects.
• Document why every authorized tool is required and periodically review permissions against implemented features.
• Run the skill under a minimally privileged operating-system account and isolate it from credentials and unrelated user files.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance is extremely broad and matches ordinary productivity requests like organizing tasks, planning a day, or reviewing progress. This creates a high likelihood of unintended activation across common conversations, which can cause the skill to engage when not explicitly requested and unnecessarily grant it access to its allowed tools.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example trigger phrase, "Help me plan my day with 5 tasks," is a routine user request that could appear in many normal interactions unrelated to this specific skill. Using such a vague example trains or encourages activation on generic language, increasing the risk of accidental invocation and tool exposure without a clear, scoped request for this skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.