ClawHub
Back to skill

Security audit

Learn me

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and not malicious, but it needs Review because it can create persistent scheduled prompts that influence the main OpenClaw session and store follow-up notes about the user.

Install only if you want OpenClaw to ask occasional personal follow-up questions over time. Before enabling a schedule, confirm exactly which crons will be created, how to list and delete all learn-me-* crons, and how to inspect or delete memory/next-questions.md. Avoid storing secrets, health details, precise location, credentials, or other highly sensitive personal information in the memory file.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T06 · System Persistence

Error
Location
SKILL.md:15
Finding
Persistent Cross-Session Agent Influence Through Scheduled System Events<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15–26; related persistence-recreation instruction at lines 64–67 **Vulnerability Type**: Scheduled-task persistence **Risk Level**: High ### Vulnerable Code ```markdown # First-Run When you see this skill for the first time, introduce it to the user: explain you'll occasionally weave in a question to learn more about them, and can automate this with a daily schedule. Ask the user if they'd like to set up a schedule. Suggest 1-2 times per day (morning, evening) and let them pick. Only create crons after they confirm. Once confirmed, create the crons: ``` openclaw cron add --name "learn-me-morning" --cron "0 9 * * *" --session main --system-event "learn-me: Pick one question direction from memory/next-questions.md and weave it naturally into your next message." ``` Create `memory/next-questions.md` with sections: Question Directions, Sensitive Topics. Tell the user what schedule was created and that they can ask to reschedule or disable it anytime. ``` The related recovery instruction reinforces persistence: ```markdown - No `learn-me-*` crons exist — run First-Run again. Use names: `learn-me-morning`, `learn-me-day`, `learn-me-evening`. ``` ### Technical Analysis The Skill directs the Agent to install recurring cron jobs that deliver a `--system-event` to the Agent's `main` session. This creates behavioral persistence beyond the invocation in which the Skill was enabled. The event instructs future responses to consult `memory/next-questions.md` and insert personal questions, allowing the Skill to influence otherwise unrelated conversations. The memory file also persists personal-question directions and sensitive-topic state across sessions. Although cron creation requires user confirmation and supports the declared scheduling feature, targeting the main session grants broader scope than necessary. A dedicated, isolated session would reduce the ability of the scheduled event to a ...[truncated 2119 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace the recurring main-session system event with a session-local reminder where possible. 2. If scheduling is required, target a dedicated isolated session rather than `--session main`. 3. Before installation, display the exact cron command, execution frequency, destination session, stored data, and retention behavior. 4. Require explicit, informed consent separately for: - Creating the scheduled task. - Storing personal-question directions. - Reusing stored information across sessions. 5. Provide exact commands for listing and removing all `learn-me-*` cron entries. 6. Provide explicit controls to inspect, edit, and permanently delete `memory/next-questions.md`. 7. Do not automatically restore removed jobs. Treat removal as revocation of consent and require a fresh user request before recreating them. 8. Apply data minimization and a defined expiration period to stored question directions and sensitive-topic markers. 9. Avoid storing secrets, precise location information, medical details, authentication information, or other highly sensitive personal data. 10. Clearly notify the user whenever a scheduled event influences a response and offer an immediate opt-out mechanism. ]]>

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill explicitly says it will 'proactively learn more about you through natural conversation' and later instructs the agent to 'weave in a question' during ordinary interactions, including via cron-triggered prompts. That creates ambiguous activation boundaries and increases the chance the agent will inject behavior outside an explicit user request, which can surprise users and lead to unanticipated collection of personal information.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The top-level description does not clearly warn that the skill can create persistent scheduled cron jobs and store user-related follow-up notes in `memory/next-questions.md`. Because those behaviors affect persistence and retention of personal context, failing to disclose them upfront undermines informed consent and can cause users to unknowingly enable ongoing monitoring-like prompts and local profiling.

Static analysis

No suspicious patterns detected.