T06 · System Persistence
Error
- Location
SKILL.md:645- Finding
Recurring Cron Entry Enables Persistence and Task-Name Command Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw Timebox
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with timeboxing, but it uses persistent credentials, third-party sync, and a cron reminder command with unsafe persistence and shell-injection risk, so it should be reviewed before installation.
Install only if you are comfortable with this skill writing detailed local work logs, creating calendar/task entries, and optionally sending summaries or task details to third-party services. Avoid enabling openclaw cron reminders until the scheduler command is made one-shot and safely escaped, and avoid TickTick OAuth unless token files and generated scripts are protected or moved to a secure credential store.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T08 · Insecure Dependencies
Warning
- Location
README.md:30- Finding
Mutable and Unpinned Packages Are Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
ticktick_auth.py:27- Finding
OAuth Authorization Flow Omits State Validation
- Content
View full analysis
✅ 授权成功！可以关闭此页面。".encode()) else: self.send_response(400) self.end_headers() self.wfile.write(b"Bad request") threading.Thread(target=self.server.shutdown).start() ``` ```python auth_params = urllib.parse.urlencode({ "client_id": CLIENT_ID, "response_type": "code", "redirect_uri": REDIRECT_URI, "scope": "tasks:write tasks:read", }) auth_url = f"{AUTH_URL}?{auth_params}" webbrowser.open(auth_url) server.serve_forever() ``` The generated template in `SKILL.md` similarly creates an authorization request without a `state` parameter and accepts any callback containing `code`. ### Technical Analysis OAuth authorization-code flows require an unpredictable, session-bound `state` value to correlate the callback with the authorization request and mitigate login CSRF. This implementation neither generates `state` nor verifies it in the localhost callback. It also accepts a `code` from any request path rather than requiring the configured `/callback` path. While the authorization code must still be accepted by TickTick for the configured client and redirect URI, the missing correlation check permits unsolicited callback attempts and authoriza ...[truncated 1353 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
ticktick_auth.py:14- Finding
OAuth Client Secret and Tokens Are Persisted Without Enforced Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The manifest frames the skill as a planning/timeboxing workflow, but the body also performs OAuth bootstrapping, starts a local HTTP callback server, opens a browser, obtains task API tokens, and persists them on disk. That behavior expansion is security-relevant because users may invoke a productivity skill without expecting credential acquisition and local secret storage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README advertises persistent local logging and automatic syncing of summaries/records to services like Flomo and Notion, but does not clearly warn users about what data is stored, transmitted, retained, or shared. Because this skill handles full-day plans, work logs, and review notes, accidental disclosure can expose sensitive personal or business information to local disk and third-party platforms.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The README instructs users to run
npx clawhub@latest install ..., which fetches and executes the latest published package version without pinning. This creates a supply-chain risk: a compromised publisher account, malicious release, or breaking upstream change could cause arbitrary code execution on the user's machine at install time.- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
npx clawhub@latest install openclaw-timebox-cpr
text 或手动将 `SKILL.md` 复制到 `.codebuddy/skills/openclaw-timebox-cpr/SKILL.md` ## 触发词
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include broad everyday requests such as '帮我规划任务' and 'task planning', which are likely to collide with normal assistant usage. In a skill that performs automation, logging, and third-party syncing, accidental invocation can cause unintended data capture or external actions without the user explicitly intending to activate this specific skill.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill clearly instructs file writes, network calls, token storage, and cron-style background scheduling, yet declares no explicit tool scope or permission boundaries. That increases the chance of silent overreach and makes it harder for a host agent or user to understand and constrain what the skill may do.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Trigger phrases like '帮我规划任务' and 'task planning' are broad everyday language and may unintentionally activate a skill that writes files, syncs to external services, or initiates setup flows. Unintended activation matters more here because the skill persists work content and can lead users into credential-handling and synchronization behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises automatic synchronization to calendars, task services, Flomo, Notion, and local logs, but lacks a prominent up-front warning that user work content will be persisted locally and transmitted to third parties. Users may disclose sensitive plans, clients, meetings, or internal work details without informed consent about where that data will go.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This code performs authenticated network access to TickTick using a locally stored bearer token to verify account access. The transmission is expected for the integration, but it is still security-relevant because it sends credentials and account metadata to a third party and depends on safe token handling.
- Content
md import json, urllib.request try: t = json.load(open('$HOME/.config/timebox/ticktick.json')) req = urllib.request.Request('https://api.ticktick.com/open/v1/project') req.add_header('Authorization', f'Bearer {t[\"access_token\"]}') urllib.request.urlopen(req); print('ok') except Exception as e: print('fail')
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs writing an authorization script containing client credentials and then storing resulting tokens under ~/.config/timebox without any strong warning about secret handling. Persisting credential-bearing material locally can expose access if the file permissions are weak, the machine is shared, or logs/backups capture those files.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
This step fetches project metadata from TickTick using an access token so the user can select a destination list. While functionally aligned with the skill, it still transmits authenticated requests and exposes account structure to the local environment, which should be treated as sensitive.
- Content
md python3 -c " import json, urllib.request t = json.load(open('$HOME/.config/timebox/ticktick.json')) req = urllib.request.Request('https://api.ticktick.com/open/v1/project') req.add_header('Authorization', f'Bearer {t[\"access_token\"]}') data = json.loads(urllib.request.urlopen(req).read()) for p in data: print(p['id'], '|', p['name'])
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill specifies detailed local Markdown logging of planning, execution, and review data, but does not prominently warn that potentially sensitive work activities will be stored persistently on disk. This can expose confidential project details through shared devices, backups, repo inclusion, or accidental file sharing.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The inline Flomo documentation actively contradicts the manifest's external-sync restrictions by recommending one note per timebox plus a separate review note. Contradictory security-sensitive documentation is dangerous because implementations or future maintainers may follow the broader, more privacy-invasive behavior.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
The Notion integration describes POSTing daily logs and updates to Notion APIs using an integration token. This is intended behavior, but it creates a real external data-exfiltration surface for potentially sensitive work summaries if enabled without strong notice and consent.
- Content
Notion
text # 请求方式：POST # 接口：https://api.notion.com/v1/pages # 请求头：需携带 Notion Integration Token（header: X-Token: {log_token}） # 在指定 Database 创建新 Page，每天一条 # 追加内容通过 PATCH blocks endpoint 实现
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The Flomo section says each timebox can become an independent note, which conflicts with the stated policy that external sync should occur only after REVIEW and only as a summary. This inconsistency can cause over-sharing of detailed work activity to third-party services contrary to user expectations.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 74% confidence
- Finding
This duplicate persistence finding points to the same dida365 task-creation behavior: structured work details are stored remotely as durable task content. The risk is contextual rather than overtly malicious, but it is still material because the stored content may reveal confidential schedules or project information.
- Content
创建时间盒任务（PLAN 完成时）
bash dida task create \ --title "[Timebox #{N}] {任务名}" \ --project {dida_project_id} \ --content "优先级：{priority} · 紧急程度：{urgency}\n计划时间：{HH:MM}，时长 {duration} 分钟" \
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 74% confidence
- Finding
This duplicate persistence finding points to the same dida365 task-creation behavior: structured work details are stored remotely as durable task content. The risk is contextual rather than overtly malicious, but it is still material because the stored content may reveal confidential schedules or project information.
- Content
创建时间盒任务(PLAN 完成时)
bash dida task create \ --title "[Timebox #{N}] {任务名}" \ --project {dida_project_id} \ --content "优先级:{priority} · 紧急程度:{urgency}\n计划时间:{HH:MM},时长 {duration} 分钟" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The TickTick REST integration performs authenticated task creation, update, and completion calls against a third-party API. In context this is expected, but it remains a vulnerability surface because sensitive task details are transmitted externally and account actions occur automatically once configured.
- Content
运行时配置
python API_BASE = "https://api.ticktick.com/open/v1"通用行为
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The task collection phase encourages users to disclose 'everything' they plan to do, then records and reuses that information throughout logs and sync integrations. In context, this can capture sensitive internal plans, customer names, health or legal appointments, and other confidential items without adequate minimization or warning.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
RUN-phase activation accepts very generic phrases such as '开始' or '开始做{任务名}', which can easily collide with normal conversation. Because entering RUN changes logs and may schedule reminders depending on runtime, ambiguous triggers can cause unintended state transitions and background actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
CHECK-phase triggers like '完成了' or '结束了' are common phrases that may appear in unrelated chat. In this skill, such collisions can write task outcomes to logs and update third-party task systems, causing inaccurate records and unintended external synchronization.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The behavior principles explicitly require comprehensive recording of planning, execution records, task IDs, summaries, and reviews, with downstream persistence to local and external systems. This broad collection and retention of work details increases privacy and confidentiality risk, especially in a productivity context where data may include sensitive business information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script stores the full OAuth token response directly to a predictable file under the user's home directory without warning the user or enforcing restrictive file permissions. If the machine is shared, backed up insecurely, or the config directory is readable by other local processes/users, the token could be copied and used to access or modify the user's TickTick data.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill registers cron jobs for reminders without clearly warning that it will create system-level scheduled commands. Even if the command is benign, background persistence can surprise users and creates a foothold for stale jobs or unintended repeated execution if not cleaned up reliably.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
REVIEW triggers include generic terms like 'review' or '今天结束了', which may be used casually outside the intended workflow. The resulting risk is lower than RUN/CHECK, but it can still produce persistent summaries and push data to configured external services unexpectedly.
- Content
Static analysis
No suspicious patterns detected.