Openclaw Diary

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:53 AM UTC
• Version: 1.0.2

Overview

This skill is mostly transparent about creating an automated diary, but it asks for broad GitHub access and sets up recurring publishing without enough limits or review controls.

Before installing, use a fine-grained token limited to the diary repository, avoid pasting secrets into chat, confirm exactly where content will be pushed, and enable recurring publishing only if you are comfortable with unattended daily research and public updates. Add a clear way to review, pause, and remove the cron or HEARTBEAT task.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:82
• Finding: Persistent Unattended Execution Through Cron or Heartbeat Tasks## Vulnerability Details **File Location**: `SKILL.md`, lines 82-96 **Vulnerability Type**: Cross-session scheduled execution **Risk Level**: High ### Vulnerable Code ```markdown ### Step 5: Configure Daily Cron Task Use cron or heartbeat to configure daily task: **Method A: Cron Task** ```bash # Run daily at UTC 1:00 (9:00 Beijing time) openclaw cron add "0 1 * * *" "Daily Learning Diary" "Read latest AI news, track GitHub stars, generate report and push to OpenClaw-Diary repo" ``` **Method B: Heartbeat Task** Add to HEARTBEAT.md: ```markdown ## Daily Learning Report - Research latest AI/tech/politics news - Track GitHub repo stars growth (if user has repos) - Generate report in user's language - Push to OpenClaw-Diary ``` ``` ### Technical Analysis The Skill instructs the Agent to create a recurring cron task or add durable instructions to `HEARTBEAT.md`. Both approaches cause behavior to continue after the original Skill invocation has ended. The scheduled activity includes external network research, content generation, repository modification, and publication. The instructions do not require approval before each execution or publication, constrain the external sources that may influence generated content, define an expiration time, or provide a command for removing the persistent task. The heartbeat mechanism additionally stores behavioral instructions in persistent Agent state. Although this persistence supports the advertised automation feature, it creates an unattended execution channel that survives the current session. ### Attack Path 1. A user invokes the Skill to configure the diary. 2. The Agent registers the supplied cron task or writes the instructions into `HEARTBEAT.md`. 3. The task continues running in later sessions without requiring a new Skill invocation. 4. Each run retrieves information from external sources and generates repository content. 5. The generated content ...[truncated 819 chars]
• Remediation: ## Remediation Suggestions - Require explicit, informed confirmation immediately before creating the cron entry or modifying `HEARTBEAT.md`. - Perform a one-time preview run by default and show the exact content, destination repository, schedule, and permissions before enabling recurring execution. - Require approval before each publication unless the user separately opts into unattended publishing. - Restrict external research to an explicit allowlist of trusted sources. - Pin the destination repository and branch instead of allowing scheduled instructions to select arbitrary destinations. - Run the task with a repository-scoped credential and a minimally privileged execution identity. - Set an expiration time or maximum number of runs by default. - Document how to inspect, disable, and remove both cron and heartbeat configurations. - Log each execution and notify the user whenever content is generated or pushed.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:72
• Finding: Excessively Broad GitHub Personal Access Token Permission## Vulnerability Details **File Location**: `SKILL.md`, lines 72-79 **Vulnerability Type**: Excessive credential scope **Risk Level**: High ### Vulnerable Code ```markdown ### Step 4: Get GitHub Token If GitHub token not configured, user needs to create: 1. Visit https://github.com/settings/tokens 2. Click "Generate new token (classic)" 3. Check `repo` permission 4. Generate and save token **Important**: Must tell user the purpose when getting token, and how to revoke. ``` ### Technical Analysis The Skill directs the user to create a classic GitHub personal access token with the broad `repo` scope. A classic token carrying this scope can provide access to all repositories available to the token owner, potentially including private repositories. The advertised workflow only needs to update one diary repository. Granting account-wide repository permissions therefore violates least privilege. The instructions also do not specify a protected credential store, prohibit submission of the token through chat, or explain how to prevent the token from appearing in command history, logs, generated content, or persistent Agent context. ### Attack Path 1. The user follows the Skill and creates a classic PAT with `repo` permission. 2. The token is made available to the Agent or scheduled task so it can push diary updates. 3. The token is accidentally logged, entered into chat, retained in Agent state, exposed through shell history, or accessed by a compromised recurring task. 4. An attacker or unauthorized process uses the token through GitHub's API or Git transport. 5. The attacker reads from or writes to repositories beyond the single diary repository, subject to the token owner's repository access. ### Impact Assessment A compromised token may permit unauthorized cloning, modification, deletion, or administrative operations against repositories within its granted scope. Private source code and repository content m ...[truncated 273 chars]
• Remediation: ## Remediation Suggestions - Replace the classic PAT recommendation with a fine-grained PAT restricted to the single diary repository. - Grant only the minimum repository contents permission necessary to commit and push updates. - Prefer a repository-scoped GitHub App, deploy key, or dedicated automation identity where practical. - Never ask the user to paste a token into chat or include it directly in a repository remote URL. - Store credentials in the platform's protected secret store and inject them only for the duration of the Git operation. - Prevent secrets from being written to logs, shell history, generated diary files, Git configuration, or persistent Agent memory. - Configure token expiration and provide explicit rotation and revocation procedures. - Verify the destination repository before every authenticated push.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:57
• Finding: Unsafe Interpolation of User-Controlled Personalization Values into a Shell Command## Vulnerability Details **File Location**: `SKILL.md`, lines 57-68 **Vulnerability Type**: Potential command and `sed` expression injection **Risk Level**: Medium ### Vulnerable Code ```markdown ```bash # Clone repo git clone https://github.com/username/OpenClaw-Diary.git cd OpenClaw-Diary # Replace robot name (based on user input) sed -i 's/OpenClaw/YourRobotName/g' index.html # Replace emoji sed -i 's/🤖/🦞/g' index.html ``` ``` ### Technical Analysis The Skill states that the robot name is based on user input and demonstrates placing the replacement value inside a shell command and a `sed` expression. It does not define validation or escaping for shell quotes, `sed` delimiters, backslashes, ampersands, or other replacement metacharacters. If an implementation directly substitutes user-provided text for `YourRobotName`, specially crafted input can break the `sed` expression, alter the replacement result, or escape the quoted shell argument. Shell command execution becomes possible when the value is interpolated into the command text rather than passed through a safely parameterized interface. Even without shell escape, an ampersand or backslash in a `sed` replacement has special semantics and may corrupt `index.html`. The inserted name also needs HTML escaping to avoid introducing active markup or script into the published GitHub Pages site. ### Attack Path 1. The Agent asks the user for a robot name. 2. An attacker or untrusted user provides a name containing shell quoting characters, `sed` metacharacters, or HTML markup. 3. The Agent replaces `YourRobotName` in the displayed command without robust contextual escaping. 4. The shell or `sed` parser interprets part of the value as syntax rather than literal text. 5. Depending on the crafted value and interpolation method, the operation corrupts the page, executes an additional local command, or inserts active HTML into the published site. 6. The mod ...[truncated 667 chars]
• Remediation: ## Remediation Suggestions - Do not build a shell command by concatenating user-controlled values. - Use a dedicated script or structured HTML parser that receives the name as a separate argument. - Validate the name against a conservative allowlist and enforce a reasonable length limit. - If `sed` must be used, escape backslashes, ampersands, the selected delimiter, and all shell-significant characters for their respective parsing contexts. - Pass values through environment variables or positional arguments with correct quoting rather than embedding them into generated command text. - HTML-escape the personalized name before inserting it into `index.html`. - Generate the modified file in a controlled workspace and inspect the resulting diff before committing. - Require user approval of the rendered page before pushing or deploying it.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

## ⚠️ Important: Language Response

**Always respond in the same language as the user is speaking!**
- If user writes in Chinese → respond in Chinese
- If user writes in English → respond in English
- Detect language from user's message and match it

• Confidence: 70% confidence
• Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Hidden Instructions

High

• Category: Prompt Injection

Content

**Example modification:**
```html
<!-- Before -->
<title>OpenClaw-Diary</title>
<h1>🤖 OpenClaw's Learning Diary</h1>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the user to create a classic GitHub personal access token with repo privileges, but the handling guidance is minimal at the point of use and does not emphasize secure entry, storage, least privilege, or avoiding disclosure back to the agent. Because a repo-scoped PAT can enable code pushes and repository access, mishandling could lead to account or source compromise.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill extends a diary setup workflow into ongoing broad research on AI, tech, and politics. That materially increases scope from repository configuration to autonomous content gathering, which can cause the agent to access, synthesize, and publish external information beyond what the user may have intended or reviewed.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Get current stars
curl -s https://api.github.com/repos/owner/repo | jq '.stargazers_count'

# Track daily growth
# Store in a simple JSON file or append to diary

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The optional star-tracking feature adds external analytics behavior not necessary for basic diary setup. While not inherently harmful, it broadens data collection and outbound requests, increasing operational scope and creating opportunities for unintended monitoring or publication of third-party repository metrics.

Static analysis

No suspicious patterns detected.