yoooclaw-world-cup-match-talk-scene

• Outcome: Review
• Latest audit: Jun 18, 2026 · 6:33 PM UTC
• Version: 1.0.4

Overview

This skill is mostly a disclosed World Cup talking-points helper, but it can read broad phone notifications without clear consent or source limits.

Review this skill before installing if you are uncomfortable with an agent reading phone notifications. Only use the notification features with explicit app, group, and time limits, and avoid relying on scraped web results until TLS verification is fixed. The artifacts do not show exfiltration or destructive behavior, but the default notification scope is too broad for a benign auto-approve result.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill says that when notification context is needed and no source scope is provided, it may query recent notifications without limiting the scope to specific apps or groups first. That creates a privacy risk because phone notifications can contain sensitive personal, financial, work, or health data unrelated to the user's football request.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This section mandates running `openclaw ntf search` for notification-related requests and defaults to collecting all notifications from yesterday to now if no time range is provided. That is overbroad sensitive-data access and lacks a prominent consent/notice step before retrieving potentially private messages, OTPs, work alerts, and other unrelated content.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The template explicitly instructs the system to derive discussion material from the user's phone notifications, which can expose private communications, group memberships, and behavioral data without any privacy notice or minimization guidance. In this skill's context, that is more dangerous because sports/fan-group notifications are not necessary for the core content-generation task and the template normalizes using personal device data as input.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The language assumes access to the user's phone notifications and directs output based on them without explicit consent language, which risks unauthorized access or inference from sensitive personal data. This is especially concerning here because the skill description already mentions proactively querying notifications, so the template reinforces a consent-free workflow rather than a user-initiated, privacy-preserving one.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: TLS certificate verification is explicitly disabled via ssl._create_unverified_context(), which allows man-in-the-middle interception and tampering of all fetched content. Because the script scrapes search results and article pages that may influence downstream generated output, an attacker on the network path could inject false content or malicious links without detection.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Allowing the skill to search recent notifications broadly when the user has not specified a source range violates data minimization principles. Even if the skill later filters results, the initial access still exposes unrelated private notification content to the agent pipeline.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The default behavior instructs collecting all notifications over a substantial time range, which is excessive relative to the task of generating football talking points. This broad retrieval increases the chance of incidental collection of sensitive unrelated data and creates unnecessary privacy exposure even if only some results are later used.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/probe_cn_football_sources.py:195