Security audit

Daily Health Report

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for Raspberry Pi health reporting, but its launcher runs an unaudited user-specific script and leaves report publishing too loosely scoped.

Before installing, replace the hard-coded external script dependency with a packaged or verified health-report script, set an explicit approved publish destination, and ensure the log directory is private. Do not schedule it automatically until the executable being run is reviewed and trusted.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/run.sh:2
Finding: Execution of an Unverified External Script Outside the Audited Package
Content: View full analysis
&1 | tee "$LATEST" ``` ### Technical Analysis The launcher delegates its primary behavior to `/home/welderjustin/.openclaw/workspace/scripts/health_report.sh`, which is outside the audited project and is not included in the package. Before execution, `run.sh` does not verify that the target is a regular file, that it has trusted ownership and permissions, or that its contents match an approved cryptographic digest. As a result, the code that ultimately executes can be changed independently of this reviewed Skill. An attacker who already has permission to create, replace, or modify the external script can cause arbitrary commands to run when the Skill is invoked. The command also merges standard error into standard output using `2>&1` and persists the combined stream through `tee`. If the delegated script prints sensitive diagnostics, environment details, or secrets, those values may be stored in `latest-health-report.txt`. This issue does not itself grant write access to the external script or elevate privileges. Exploitation requires an existing ability to modify the referenced file or manipulate a writable component of its path. ### Attack Path 1. The attacker obtains write access to `/home/welderjustin/.openclaw/workspace/scripts/health_report.sh`, or can replace a writable file or path component leading to it. 2. The attacker replaces or modifies the script to include arbitrary shell commands. 3. A user, agent, or scheduler invokes `scripts/run.sh`. 4. The attacker-controlled script executes with the opera ...[truncated 927 chars]
Remediation: View remediation
&1` unless error persistence is explicitly required, and ensure the log directory and report file have restrictive permissions. 8. Enable strict shell error handling, including `set -euo pipefail`, so failures in the delegated script are not hidden by a successful `tee` process. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill states that it gathers local Raspberry Pi health data and publishes it, but it does not warn that this information leaves the local system or may be sent to an external channel. System metrics such as uptime, disk state, load, and temperature can reveal operational patterns and device characteristics that aid reconnaissance, especially when automatically logged or transmitted.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The invocation text is ambiguous because it says to publish the script output to a 'chosen channel' or integrate with the main agent without defining who chooses the destination or what authorization is required. In an agent setting, this broad trigger and action scope can cause unintended activation and disclosure of host health data to places the user did not explicitly approve.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.