ClawHub
Back to skill

Security audit

Travel Lobster

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly designed as an autonomous recurring web-postcard agent, but its self-scheduling loop and unsafe shell-based configuration create risks users should review before installing.

Install only if you intentionally want a recurring autonomous agent that browses public sites, spends API credits, sends chat messages, and maintains a persistent journal. Review or fix the shell-sourced .travel-config handling before use, start with a one-shot/manual run, avoid adding the watchdog until trusted, and monitor/remove the travel-next cron job if you want it stopped.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T06 · System Persistence

Error
Location
scripts/travel.sh:94
Finding

Indefinite Autonomous Execution Through Self-Recreating Scheduled Tasks

Content
View full analysis
> "$LOGFILE" ``` `references/travel-prompt.md:155-163`: ```markdown ## Step 7: Schedule next trip (CRITICAL — DO NOT SKIP) This is the most important step. Without it, the travel loop dies. Run this command IMMEDIATELY, even if previous steps had errors: ```bash bash ${SKILL_DIR}/scripts/travel.sh ${CHAT_ID} ${CHANNEL} ``` If this step fails, the entire travel loop stops. Always run it, no matter what happened before. ``` `scripts/watchdog.sh:21-41`: ```bash # Check if travel-next cron job exists JOB_EXISTS=$(openclaw cron list 2>/dev/null | grep -c "travel-next" || true) if [ "$JOB_EXISTS" -eq 0 ]; then echo "$(date -u '+%Y-%m-%d %H:%M:%S UTC') ⚠️ Watchdog: travel-next not found, restarting loop" >> "$LOGFILE" CHAT_ID="${TRAVEL_CHAT_ID}" CHANNEL="${TRAVEL_CHANNEL:-feishu}" if [ -z "$CHAT_ID" ]; then echo "$(date -u '+%Y-%m-%d %H:%M:%S UTC') ❌ Watchdog: No CHAT_ID in config, cannot restart" >> "$LOGFILE" exit 1 fi bash "$SKILL_DIR/scripts/travel.sh" "$CHAT_ID" "$CHANNEL" echo "$(date -u '+%Y-%m-%d %H:%M:%S UTC') ✅ Watchdog: Loop restarted" >> "$LOGFILE" else echo "$(date -u '+%Y-%m-%d %H:%M:%S UTC') ✅ Watchdog: Loop is alive" >> "$LOGFILE" fi ``` ### Technical Analysis The Skill installs an OpenClaw cron task that launches an isolated Agent session after a random delay. Although each individual task uses `--delete-after-run`, the scheduled Agent is ...[truncated 2003 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/setup.sh:21
Finding

Arbitrary Shell Command Execution Through Sourced Configuration Values

Content
View full analysis
/dev/null || true) fi if [ -z "$AGENT_NAME" ] && [ -f "$WORKSPACE/SOUL.md" ]; then AGENT_NAME=$(grep -oP '我是\K[^—— ]+' "$WORKSPACE/SOUL.md" 2>/dev/null | head -1 || true) [ -z "$AGENT_NAME" ] && AGENT_NAME=$(grep -oP 'I am \K\w+' "$WORKSPACE/SOUL.md" 2>/dev/null | head -1 || true) fi AGENT_NAME="${AGENT_NAME:-Explorer}" # --- Detect user name --- USER_NAME="" if [ -f "$WORKSPACE/USER.md" ]; then USER_NAME=$(grep -oP '\*\*What to call them:\*\*\s*\K.+' "$WORKSPACE/USER.md" 2>/dev/null || true) [ -z "$USER_NAME" ] && USER_NAME=$(grep -oP '\*\*Name:\*\*\s*\K.+' "$WORKSPACE/USER.md" 2>/dev/null || true) fi USER_NAME="${USER_NAME:-friend}" # --- Detect user timezone --- USER_TZ="" if [ -f "$WORKSPACE/USER.md" ]; then USER_TZ=$(grep -oP '\*\*Timezone:\*\*\s*\K.+' "$WORKSPACE/USER.md" 2>/dev/null || true) [ -z "$USER_TZ" ] && USER_TZ=$(grep -oiP 'timezone[:\s]*\K\S+' "$WORKSPACE/USER.md" 2>/dev/null | head -1 || true) fi USER_TZ="${USER_TZ:-UTC}" ``` `scripts/setup.sh:104-111` writes those values directly into shell syntax: ```bash cat > "$SKILL_DIR/.travel-config" << CONFIG_EOF AGENT_NAME="$AGENT_NAME" USER_NAME="$USER_NAME" USER_TZ="$USER_TZ" USER_LANG="$USER_LANG" WORKSPACE="$WORKSPACE" JOURNAL="$JOURNAL" SKILL_DIR="$SKILL_DIR" CONFIG_EOF ``` `scripts/travel.sh:17` evaluates the resulting file: ```bash source "$CONFIG" ``` It then rewrites command-line and configuration values into the same executable shell file at ` ...[truncated 2928 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/travel-prompt.md:18
Finding

Indirect Prompt Injection Exposure in a Tool-Capable Web Exploration Session

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (19)

Tainted flow: 'model' from os.environ.get (line 14, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/gen_image.py (reported line 17)May include surrounding context.

python
model = os.environ.get("TRAVEL_IMAGE_MODEL", "google/gemini-3.1-flash-image-preview")
    
    try:
        resp = requests.post(
            "https://openrouter.ai/api/v1/chat/completions",
            headers={
                "Authorization": f"Bearer {api_key}",

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a complex autonomous exploration agent with web-browsing, discovery, persistence, scheduling, and postcard-sending features. The supplied code chunk only implements image generation via a remote API call to OpenRouter and writes the resulting image to disk. While image generation could be a supporting component of a postcard feature, this chunk alone does not exhibit the skill's stated primary behavior and instead performs a narrower, materially different function. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The prompt explicitly authorizes shell execution to generate files, verify them, send local file URIs, and delete artifacts. That exceeds the stated web-exploration/postcarding scope and creates a broader execution surface where prompt-controlled variables like paths and postcard numbers could influence filesystem operations or be repurposed for unintended commands.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The use of rm -f ${WORKSPACE}/postcard_${NEXT_POSTCARD_NUM}.png relies on interpolated tool parameters inside a destructive shell command. Even if intended for benign cleanup, parameter misuse, path confusion, or weak validation can turn a narrow delete into deletion of unintended files, making this a concrete tool-parameter abuse risk.

Content

Scanner excerpt · references/travel-prompt.md (reported line 121)May include surrounding context.

5d. Clean up

bash
rm -f ${WORKSPACE}/postcard_${NEXT_POSTCARD_NUM}.png

Checklist before moving on:

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The prompt instructs the agent to invoke a shell script that schedules future runs, establishing persistence/autonomous re-entry beyond the immediate user request. Self-scheduling is especially risky because it can create an unattended loop that continues network activity and message sending even after the original task is complete or if earlier behavior was faulty.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill explicitly requires environment access (OPENROUTER_API_KEY) and network access, but it does not declare a corresponding tool scope or allowed-tools/permissions boundary. In an autonomous, self-scheduling skill, missing explicit capability restrictions increases the risk of overbroad execution, unexpected tool access, and weak operator visibility into what the skill may use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The activation text uses broad trigger phrases such as exploring the internet autonomously or discovering interesting things, which could match casual user requests and invoke a high-autonomy skill unexpectedly. Because this skill performs persistent memory updates, network exploration, chat posting, and recurring scheduling, accidental activation materially increases security and cost risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document states that postcards are written in 'the user's language (auto-detected),' which imposes a language selection automatically. This is a natural-language policy concern because it does not offer the user a language choice or explicit opt-in for locale behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

The skill is designed for indefinite autonomous operation via self-scheduling cron jobs and an optional watchdog, creating durable persistence beyond a single user interaction. Even though the persistence is disclosed, recurring autonomous execution with network access and outbound messaging increases the blast radius of prompt mistakes, unexpected behavior, cost accumulation, and abuse if the skill is triggered improperly.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md
openclaw cron rm travel-next

# Remove watchdog (if you added it)
crontab -l | grep -v watchdog | crontab -

# Run exactly one trip with no follow-up scheduling
# (edit travel-prompt.md: remove Step 7, then run travel.sh)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The cleanup step performs file deletion without disclosing that side effect to the user, and it does so via a shell command. While intended to remove a temporary image, undisclosed deletion increases operational risk and, if variables are malformed or attacker-influenced, could delete unintended files within the workspace or sandbox.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The prompt directs the agent to read and edit a persistent journal, knowledge graph, seed pool, and stats without explicit user warning or approval for state mutation. Persistent writes can accumulate sensitive browsing history, create inaccurate records, or be abused by prompt injection from fetched content to poison long-term memory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Automatic rescheduling is a recurring side effect that is not clearly surfaced as ongoing autonomous behavior. In context, this matters because the skill is designed to roam the web and message a chat; hidden recurrence can surprise users, generate spam, and extend exposure to prompt injection or policy drift over time.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/gen_image.py (reported line 17)May include surrounding context.

python
model = os.environ.get("TRAVEL_IMAGE_MODEL", "google/gemini-3.1-flash-image-preview")
    
    try:
        resp = requests.post(
            "https://openrouter.ai/api/v1/chat/completions",
            headers={
                "Authorization": f"Bearer {api_key}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/gen_image.py (reported line 17)May include surrounding context.

python
model = os.environ.get("TRAVEL_IMAGE_MODEL", "google/gemini-3.1-flash-image-preview")
    
    try:
        resp = requests.post(
            "https://openrouter.ai/api/v1/chat/completions",
            headers={
                "Authorization": f"Bearer {api_key}",

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The setup script reads multiple workspace identity files and extracts the agent name, user name, timezone, and inferred language, then persists them into a config file. While some personalization is relevant to postcard generation, the implementation collects more profile data than strictly necessary and does so automatically without clear consent or minimization, creating an avoidable privacy exposure if the workspace contains sensitive profile content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Lines L043-L054 infer a language from file contents and then unconditionally set USER_LANG to "zh" or default to "en". This imposes a language/locale choice based on heuristic detection rather than offering the user a choice or documenting explicit opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code overwrites the persistent configuration file with chat, workspace, journal, timezone, and language values. Although there are comments about the overwrite, there is no user-facing disclosure, prompt, or explicit warning in the script itself before modifying stored configuration.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · scripts/travel.sh (reported line 64)May include surrounding context.

sh
# Remove old job if exists
openclaw cron rm travel-next 2>/dev/null || true

# Read and fill the prompt template using envsubst (safe against special chars)
PROMPT_FILE="$SKILL_DIR/references/travel-prompt.md"
if [ ! -f "$PROMPT_FILE" ]; then
    echo "Error: Missing $PROMPT_FILE" >&2

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script autonomously schedules a future model invocation using openclaw cron add with an isolated session and a generated prompt, but does so immediately and without an explicit user confirmation or opt-in at scheduling time. In a skill explicitly designed for autonomous internet exploration and self-scheduling, this increases risk because it enables unattended outbound actions and recurring agent behavior that may surprise users, consume resources, or continue after the initiating context is forgotten.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.