T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/skill-health-check.mjs:99- Finding
Unrestricted Reading of Agent Session Transcripts
- Content
View full analysis
- Remediation
View remediation
Security audit
Openclaw Skill Self Improvement
Security checks for vulnerabilities and agentic risk
Overview
This is a legitimate skill-maintenance tool, but it needs review because it broadly reads local Agent transcripts and contains an unsafe heartbeat command runner.
Review the scripts before installing in a sensitive environment. Run only against workspaces and Agent data you are comfortable having locally scanned, and avoid the daily heartbeat until the shell command construction is fixed or you can guarantee the workspace path is trusted and simple. Prefer a test workspace or a least-privileged account.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/daily-health-heartbeat.mjs:13- Finding
Shell Command Injection Through the Workspace Argument
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/skill-health-check.mjs /path/to/workspace
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/skill-health-check.mjs /path/to/workspace
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JSON file is a manifest-like evaluation file, so vague-trigger review applies. The input phrase "do a retro for this week" relies on the broad phrase "do a retro," which is common workplace language and could ambiguously match multiple retrospective or meeting-related skills without additional scope constraints or negative examples in the trigger itself.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script recursively scans agent session transcript JSONL files under a fixed agents directory and infers skill usage by matching skill names and IDs in transcript lines. Even if intended for health metrics, this creates an unnecessary cross-boundary data collection behavior because transcripts may contain sensitive prompts, outputs, or identifiers unrelated to skill maintenance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script reads recent lines from all discovered session transcript files without any notice, consent flow, or narrowing to only telemetry fields. Because transcripts can contain sensitive conversation data, this silent processing creates a privacy risk and may leak or repurpose data beyond what a user expects from a skill audit tool.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file explains that the daily heartbeat writes summaries and enumerates several output files under
.learnings/, but it does not explicitly warn users that running the skill will create or overwrite files in their workspace. Because markdown files should disclose behaviors that affect user data or system state, this is a missing warning for filesystem changes.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README describes functionality that scans agent session records for usage signals and writes multiple report artifacts into the target workspace, but it does not clearly warn about these side effects in the quick-start or requirements sections. This can lead users to run the tool against sensitive workspaces without realizing conversational logs may be traversed and metadata-derived reports persisted, creating privacy, compliance, or data handling concerns.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The script expands its inventory beyond the provided workspace by enumerating globally installed system skills from a hard-coded user-specific path. This exceeds the apparent scope of a workspace health check and can expose metadata about other installed skills, creating unnecessary visibility into environment-wide configuration.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code creates a directory and writes a persistent report file to .learnings/skill-health-report.json, which modifies the user's workspace state. The script does not provide advance notice beyond the final JSON console output, and there is no inline comment or prompt warning that a file will be created or overwritten.
- Content