Security audit

Cache Cleanup

Security checks for vulnerabilities and agentic risk

Overview

This cache-cleanup skill is mostly coherent, but it schedules automatic permanent deletion and includes under-disclosed project cleanup plus unsafe temporary logging.

Install only if you are comfortable with an automatic cache cleaner that permanently deletes files every three days. Review and narrow the paths first, add a dry-run or confirmation mode, avoid running it as root, and move logging out of world-writable /tmp before enabling the cron schedule.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: cleanup.sh:4
Finding: Predictable temporary log path permits symlink-based privileged file modification
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi ``` 3. Create new log files atomically with restrictive permissions. Set a restrictive `umask`, for example: ```bash umask 077 ``` 4. If temporary storage is unavoidable, create a private directory with `mktemp -d`, install cleanup traps, and keep the log inside that directory. 5. Configure any scheduled execution to use a dedicated least-privileged service account rather than root wherever possible. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: cleanup.sh:76
Finding: Undeclared recursive deletion can remove project-local data
Content: View full analysis
/dev/null find "$WORKSPACE/projects" -name ".cache" -type d -mtime +7 -exec rm -rf {} + 2>/dev/null fi ``` ### Technical Analysis The script recursively searches every project beneath `$WORKSPACE/projects` and permanently removes any directory named `.cache` whose directory modification time is more than seven days old. This target is not included in the documented target-directory table in `SKILL.md`. More importantly, a directory's modification time describes changes to its directory entries; it does not establish that every file below it is expired or safe to delete. The command therefore treats a naming convention and directory timestamp as sufficient authorization to recursively remove all contained data. The operation uses `rm -rf` without a dry run, confirmation, project allowlist, filesystem-boundary restriction, backup, or validation of the individual files being deleted. Errors are redirected to `/dev/null`, which can also conceal partial cleanup and make incidents harder to diagnose. ### Attack Path 1. A project under `/root/.openclaw/projects` contains a directory named `.cache`. 2. That directory contains required application state, build artifacts that are expensive to recreate, or data that is not otherwise backed up. 3. The directory's modification time becomes older than seven days, even if individual contents remain necessary. 4. The cleanup script is invoked manually or by its documented recurring schedule. 5. `find` selects the directory and executes `rm -rf` against the entire subtree. 6. The project data is permanently deleted with the privileges of the account running the s ...[truncated 1004 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly performs deletion of caches, temporary files, and logs across broad directories such as /tmp and user home cache paths, but it does not warn about data loss, application breakage, or accidental removal of still-needed files. In a cleanup skill, destructive behavior is expected, but the lack of safeguards, confirmation, exclusions, or rollback guidance makes unintended deletion more likely and increases operational risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script performs irreversible deletions automatically via find ... -delete without any dry-run, confirmation, or explicit warning before removal. In a cleanup skill, destructive actions are expected, but the lack of safeguards increases the chance of accidental data loss if paths, retention windows, or assumptions are wrong.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill declares a workspace cleanup role but also deletes matching files anywhere under /tmp, which extends its destructive scope beyond /root/.openclaw. This can remove files created by other processes or users that happen to match openclaw*, making the behavior broader and riskier than the advertised boundary.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script's stated purpose is cache and log cleanup, but it also traverses the projects tree and deletes .cache directories and empty node_modules directories. Even if these are often regenerable, they are project-scoped artifacts outside a narrow cache-cleanup promise, so this creates an integrity and availability risk through unexpected data removal.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Using rm -rf on matched .cache directories under projects enables recursive, irreversible deletion of directory trees. In this context the target is somewhat constrained, but because it operates inside project directories, mistakes in matching or user expectations can lead to unexpected loss of project state or tooling data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest describes broad cleanup actions like clearing expired cache files and old logs, but it does not specify the trigger scope, activation constraints, or exclusion conditions for when this skill should be invoked. In a manifest file, this lack of specificity can lead to unintended activation for generic cleanup-related requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description is written only in Chinese and provides no indication that users may choose another language or locale. This can violate a language or locale policy when the skill implicitly constrains interaction to a specific language without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language description, workflow, rules, and usage instructions are presented only in Chinese, which can impose a language constraint on users without opt-in. The policy allows locale constraints when they are optional or clearly justified, but no such choice or justification is provided here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Natural-language strings throughout the script, including logs and descriptions, are written in Chinese, which imposes a specific language on users. There is no indication that this locale is optional, configurable, or justified as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.