Security audit

Reward & Punishment System - Skill 奖惩技能

Security checks for vulnerabilities and agentic risk

Overview

This skill is local and openly about feedback scoring, but it automatically records praise and criticism into long-term memory without clear consent, deletion, or retention controls.

Review before installing. Use this only if you are comfortable with the agent classifying feedback, changing a persistent score, and saving reasons or exact user statements across sessions. Prefer requiring explicit confirmation before any write, avoid storing verbatim quotes, and periodically inspect or delete ~/.openclaw/workspace/memory/reward_punishment.json and any MEMORY.md entries.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The README says the skill 'activates on keyword detection' but does not define clear boundaries, exclusions, or confirmation requirements. In a skill that writes permanent cross-session records, vague triggering increases the chance of accidental activation, misclassification of normal conversation as praise/criticism, and unauthorized persistence of user content.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill explicitly promotes storing user feedback and quoted statements in permanent memory across sessions without an explicit privacy notice, retention policy, or consent mechanism. This creates a meaningful privacy and trust risk because users may not realize their comments are being retained indefinitely and reused later.

Vague Triggers

High

Confidence: 96% confidence
Finding: The skill says it should automatically trigger on detected praise/criticism, but later says recording should occur only when the user explicitly asks to record. This ambiguity can cause unsolicited persistence of user sentiment into local memory, creating privacy and consent problems and increasing the chance of accidental activation during normal conversation.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger lists include vague, common conversational words like '棒', '不行', and '不错', which are likely to appear in ordinary dialogue without any intent to update a score or create a record. In a skill that writes to persistent storage, overly broad lexical triggers can cause repeated false activations, unwanted profiling, and retention of sensitive emotional context.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill describes recording feedback into MEMORY.md and a local JSON file but does not clearly warn users, at the point of collection, that their phrases may be stored persistently. This creates a transparency and privacy issue because users may speak naturally without realizing their emotional feedback is being logged for long-term retention.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The README frames persistent retention and later exposure of a user's feedback history as a feature, which normalizes long-term profiling of user interactions. Even without direct code execution, this increases the risk of privacy invasion, sensitive inference over time, and inappropriate reuse of prior statements in future sessions.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The example instructs storing verbatim praise text in permanent memory, creating a durable record of user statements that may contain personal or contextual information beyond what is needed for scoring. Verbatim storage magnifies privacy risk, increases sensitivity of the memory file, and makes later misuse or unintended disclosure more harmful.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The criticism example stores verbatim negative user statements in permanent memory tied to a persistent score history, which is especially sensitive because it can create lasting reputational or behavioral profiles. This context makes the pattern more dangerous: the skill is designed to preserve negative interactions indefinitely, enabling profiling and cross-session bias.

Static analysis

No suspicious patterns detected.