Security audit
Security checks for vulnerabilities and agentic risk
The skill matches its learning-card purpose, but it automatically processes private conversations and sends derived content to hardcoded external destinations without clear consent or scoping.
Review carefully before installing. This skill should only be used if you are comfortable with automated reading of OpenClaw conversation memory, persistent storage of summaries/raw excerpts, scheduled cron execution, and outbound delivery. Replace or remove hardcoded Feishu targets and the hardcoded API key, require explicit opt-in for external AI processing, verify the recipient before enabling cron, and add redaction/retention controls for sensitive chats.
The script advertises stdout-based delivery via OpenClaw --announce, but it also performs an explicit outbound Feishu send later. This mismatch can cause unintended duplicate transmission of user-derived content and hides a data egress behavior from operators who may believe the skill only emits local stdout output.
The top-level comments describe a limited workflow of reading memory, generating cards, and outputting a summary, but the implementation additionally sends the summary to Feishu and marks the card as sent. Hidden side effects that perform network transmission and mutate state are security-relevant because they can bypass user expectations, audit assumptions, and consent boundaries.
The script forwards conversation content to an external agent process by constructing a shell command and passing the prompt text into openclaw agent. Even though it writes the prompt to a temp file first, this still transfers potentially sensitive chat data outside the local summarization logic and creates an additional trust boundary where data may be logged, retained, or further exfiltrated.
The README states that conversation-derived learning cards are automatically generated and sent to Feishu, but it does not clearly warn users that their conversation content may be persisted and transmitted to a third-party platform. That creates a real privacy and data-sharing risk because sensitive user content could be forwarded without explicit, informed consent or scope controls.
The skill explicitly states it will automatically extract and aggregate conversation records from multiple channels, but the description does not present a clear privacy notice, consent step, retention policy, or warning that personal/sensitive chat content may be processed and redistributed. In this context, omission is security-relevant because the skill is designed around cross-channel data collection and summarization, which materially increases the chance of unintentional exposure of sensitive information.
The script transmits generated learning summaries to a Feishu target without an in-band warning, confirmation, or obvious opt-in near the send logic. Because the content is derived from workspace memory, this creates a meaningful risk of unreviewed disclosure of potentially sensitive personal or organizational information to an external messaging channel.
The script captures all stdout/stderr from the Node.js memory-refinement process and writes it directly into a persistent log file. Because this skill processes 'memory' content, the output may reasonably contain sensitive personal data, prompts, model responses, or secrets, and logging it wholesale creates an unnecessary disclosure surface if logs are read by other local users, backup systems, or monitoring tools.
The code sends the full generated prompt, including conversation excerpts, to another agent process without any visible notice, consent flow, or disclosure to the user. This is a privacy and transparency issue because users may reasonably expect their chat history to remain local rather than being forwarded for secondary processing.
The script sends raw conversation content to an external AI endpoint for processing, including potentially sensitive personal, operational, or proprietary data, without consent controls, minimization, or disclosure. In this skill's context, it is explicitly reading memory/workspace conversation logs, so outbound transmission materially increases privacy and data-governance risk.
The script automatically transmits aggregated learning activity data to an external Feishu target using a hard-coded recipient ID, with no consent gate, classification check, or configurable opt-out. In an agent/workspace context, these summaries may contain sensitive internal knowledge, mistakes, or operational details, creating a real data-exfiltration/privacy risk if the channel or recipient is inappropriate.
The skill is described as recording conversations into memory, extracting content, and automatically sending summaries/cards. This is a genuine data leakage risk because natural-language conversations often contain secrets, personal data, or confidential work content that may be retained and retransmitted beyond the original conversation context.
The example output and card description indicate that extracted conversation-derived material is stored in persistent Markdown files and included in pushed summaries. Persisting and reusing all extracted content increases exposure if the files are accessed by other users, backed up insecurely, or if summaries reveal sensitive details in notifications.
The documented workflow explicitly describes ongoing ingestion of daily conversation memory files and automatic delivery of generated summaries. In this context, the automation makes the risk more dangerous because collection and retransmission happen routinely, increasing the chance that sensitive content is forwarded without contemporaneous user awareness.
The skill is explicitly designed to collect conversation records from multiple messaging channels, merge them, generate summaries, and push the derived content onward. That creates a concrete data-leak risk because sensitive or compartmentalized information from one channel may be surfaced into another destination, broadening access and violating user expectations or organizational data-boundary rules.
The setup flow instructs the agent to save destination identifiers and then automatically deliver conversation-derived summaries to the selected channel on a schedule. This is dangerous because a misconfigured, spoofed, or unintended target can cause recurring disclosure of private chat content to the wrong recipient, and the automation increases blast radius by repeating the leak without fresh confirmation.
The prompt explicitly asks the AI to extract verbatim user quotes and preserve them as 'golden quotes', which increases the chance that sensitive information, secrets, personal data, or confidential statements are copied into durable memory artifacts. This creates a natural-language leakage path because content that was ephemeral in chat becomes highlighted and retained.
The generated markdown file embeds a raw transcript section containing conversation content, which republishes user messages into a persistent file under the workspace memory directory. Durable storage broadens exposure to anyone or any process with filesystem access and may defeat users' expectations about data minimization or message ephemerality.
The prompt instructs the model to preserve detailed factors and extract broad technical concepts from raw dialogue, encouraging expansive restatement of sensitive user content. In a memory-processing skill, this increases the chance that secrets, internal decisions, or personal details are copied into derived artifacts and retained longer than necessary.
The generated memory file includes a visible excerpt of the original conversation, which can re-expose sensitive content to anyone who can read the structured memory file. This widens the disclosure surface because data that was previously confined to a raw log is duplicated into a curated artifact likely to be consulted more often.
Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal
