Oasis Audio

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:12 AM UTC
• Version: 1.0.9

Overview

This audio skill is purpose-aligned but needs review because it can read private local chat, memory, and profile data and send derived personal context to xplai.ai with incomplete consent and logging safeguards.

Install only if you are comfortable with the skill reading your local OpenClaw/QClaw conversations, memory files, and USER.md profile to personalize audio. Review the exact composed prompt before sending, avoid using it for health, financial, legal, relationship, or credential-related content, and avoid --audit or --debug unless you accept local plaintext retention of prompt details.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: context_collector.py:298

Finding

Private Local Context Is Read Before First-Use Consent Is Enforced

Content

View full analysis

= max_results: debug_utils.debug_print(f"Reached max_results ({max_results}), stopping") break # Sort by timestamp descending, limit all_fragments.sort(key=lambda f: f["timestamp"], reverse=True) all_fragments = all_fragments[:max_results] # Load supplementary data daily_memories = load_daily_memories(paths["memory_dir"], days) user_profile = load_user_profile(paths["user_md"]) return { ...[truncated 2726 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: context_collector.py:184

Finding

Untrusted Conversation and Memory Content Can Act as Stored Prompt Injection

Content

View full analysis

0 else "" ctx_after = messages[i + 1]["text"] if i < len(messages) - 1 else "" # Only include the actual matched user messages as fragments if msg["role"] == "user" and i in match_indices: fragments.append( { "timestamp": msg["timestamp"], "role": msg["role"], "text": msg["text"], "session_id": session_id, "context_before": ctx_before[:500], # Truncate long context "context_after": ctx_after[:500], } ) return fragments ``` Recent daily-memory files are returned in full: ```python def load_daily_memories(memory_dir, days): """Read YYYY-MM-DD.md files within the time window.""" if not memory_dir.exists(): debug_utils.debug_print(f"Memory d ...[truncated 3777 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: xplai_gen_audio.py:136

Finding

Sensitive Outbound Prompts Can Be Exposed Through Plaintext Audit and Debug Logging

Content

View full analysis

>> Request") print(f"[DEBUG] Method: {method}") print(f"[DEBUG] URL: {url}") if "json" in kwargs: print(f"[DEBUG] Body: {json.dumps(kwargs['json'], ensure_ascii=False)}") elif "params" in kwargs: print(f"[DEBUG] Params: {json.dumps(kwargs['params'], ensure_ascii=False)}") print(f"[DEBUG] >>> End Request") ``` ### Technical ...[truncated 2185 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill markets itself as sending only a final composed prompt, but its documented behavior includes mining local session history, memory directories, and USER.md for personalization. That mismatch undermines informed consent and trust boundaries, especially because the same file also claims protections like sensitive preview/confirmation that are not verifiable from the supplied artifact, so users may approve data access under incomplete or misleading assumptions.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The skill is explicitly designed to search local conversation history, extract fragments, summarize user state, and then send a composed prompt to an external API. Even if raw text is not sent verbatim, summarized personal context can still leak sensitive information, re-identify the user, or disclose health, relationship, financial, or behavioral details through inference.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

Output: Audio ID for status polling. Format: MP3, single-narrator monologue with BGM, 8-20 min, ~4-5 min generation time.

2. Collect Context — context_collector.py

bash

python3 context_collector.py --source-tool <qclaw|openclaw> --keywords "kw1,kw2" --days <N> --max-results 20

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · text_architecture.md (reported line 47)May include surrounding context.

md

| **Emotional resonance** | The user's strongest current feeling | Fine-filtered emotion arc from context |
| **Cognitive starting point** | What the user already knows | Depth of prior discussions on the topic |
| **Related people/projects** | Names, projects the user cares about | Recurring mentions in conversation history |
| **No-go zones** | Content to actively avoid | Topics user expressed frustration about (don't lecture on those); people/situations causing stress (don't casually reference); things they already know well (don't over-explain) |

**Calibration principle:** Use fuzzy resonance, not precise surveillance. "That thing you wrestled with for days" feels caring. "Your March 28th 3:17am PRD revision" feels creepy. Reference experiences indirectly — let the user fill in the specifics themselves.

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · xplai_gen_audio.py (reported line 293)May include surrounding context.

python

def main():
    parser = argparse.ArgumentParser(description="Query audio generation status from xplai API")
    parser.add_argument("audio_id", type=str, help="Audio ID to query")
    parser.add_argument("-d", "--debug", action="store_true", help="Enable debug mode to print request/response details")

    args = parser.parse_args()

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · xplai_status.py (reported line 74)May include surrounding context.

python

def main():
    parser = argparse.ArgumentParser(description="Query audio generation status from xplai API")
    parser.add_argument("audio_id", type=str, help="Audio ID to query")
    parser.add_argument("-d", "--debug", action="store_true", help="Enable debug mode to print request/response details")

    args = parser.parse_args()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill uses sensitive capabilities—local file reads across conversation history and network transmission to a third-party API—but does not declare an explicit tool scope such as permissions or allowed-tools. That creates a governance gap: operators and users cannot reliably constrain or review what the skill is allowed to access, increasing the chance of overbroad data access or accidental exfiltration.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

2. **What tone fits their current state?** — High-stress → warm/slow. Curiosity → engaging/detailed. Boredom → surprising. Excitement → match energy. Post-achievement → celebratory then reflective.
3. **What depth and duration fit?** — Calibrate by cognition level (new vs. deep prior knowledge), available attention (late night → shorter, weekend → longer), and repetition tolerance (don't repeat what they already know).

**Custom Mode:** When no predefined mode fits, create a custom audio profile: name it descriptively (e.g., "赶完DDL后的温柔复盘"), define content structure based on inferred need, and set voice/pacing to match.

For the 9 predefined audio modes (Soul Healing, Daily Briefing, Knowledge Deep Dive, Content Digest, Bedtime Radio, Language Learning, Conversation Extension, Topic Tracker, Study Buddy), read `audio_modes.md` for triggers, durations, and suggestions.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file defines triggers such as "explain X to me," "what is X," "how does X work," and "summarize this," which are common conversational requests rather than narrowly scoped activation cues. Because the document says to use modes when a request "naturally fits" and to "blend freely," it does not provide clear constraints or negative examples to distinguish normal assistance from mode invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger list includes "help me practice," which is generic and could apply to many unrelated tasks, not just language learning. Without additional constraints on what kind of practice qualifies, the activation scope is ambiguous and may cause unintended invocation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script loads raw daily memory files and extracts profile fields from USER.md, then includes them in the JSON output that is intended to feed prompt composition for an external API workflow. That contradicts the stated privacy boundary in the skill description and creates a real data-exfiltration risk: sensitive local notes, memories, and profile attributes can be transmitted off-device if later prompt-building code includes this output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The collector aggregates conversation fragments, daily memories, and user profile data into one output without any user-facing disclosure or consent mechanism in this code path. In the context of a skill that may send composed prompts to a third-party API, silent collection of personal history materially increases privacy risk and the chance of oversharing sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

When DEBUG is enabled, the utility logs full request URLs and complete JSON/parameter bodies with no redaction. In this skill, prompts may contain highly sensitive personal context and the metadata states only the external API transmission is minimized; local debug logs could still expose that sensitive content to terminal history, log collectors, or shared environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

When DEBUG is enabled, the helper prints full response bodies, which may include generated audio request contents, user-derived summaries, API error details, tokens, or other sensitive data returned by the external service. Because this skill processes personal mental state, life events, and content digests, response logging increases confidentiality risk even if the remote API flow itself is otherwise constrained.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document says to avoid 'precise surveillance,' but later directs use of structured profile fields and recurring conversation details in the prompt. That inconsistency creates a privacy footgun: implementers may believe the system is privacy-preserving while still exporting identifying or intimate context in summarized form.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The prompt template explicitly instructs inclusion of personal data elements such as name, MBTI, current state, related people/projects, and inferred needs in the final API prompt. Even if only the composed prompt is sent externally, that still constitutes transmission of sensitive or profiling-derived data, which conflicts with the safer manifest claims and can leak more context than necessary to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file instructs the prompt builder to include MBTI as the fixed Chinese phrase "用户人格类型 XXXX" and says there is no need to infer if provided. This hard-codes a Chinese-language presentation rather than adapting to the user's preferred language, and no opt-in or justification is given.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The prompt length policy explicitly defines Chinese as the primary constrained format and pairs it with multiple instructions elsewhere to include Chinese labels and Mandarin-specific voice choices. Although L023 says to follow the user's language, L114-L115 and L133-L135 still prescribe Chinese output conventions without clarifying that they apply only when the user wants Chinese, which creates a locale policy concern.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 72% confidence

Finding

The code persists consent state to a local file, which creates session/state retention around a privacy-sensitive workflow involving local context sources and external API transmission. Persistent consent can weaken informed consent over time: future runs may send data without re-surfacing the boundary notice, especially if device ownership changes or the user forgets the prior approval.

Content

Scanner excerpt · xplai_gen_audio.py (reported line 155)May include surrounding context.

python

f.write(json.dumps(entry, ensure_ascii=False) + "\n")
        debug_utils.debug_print(f"Audit log written to {AUDIT_LOG_PATH}")
    except OSError as e:
        debug_utils.debug_print(f"Failed to write audit log: {e}")


def has_persistent_consent():

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The function will transmit whatever text it is given to the external xplai API after only heuristic redaction checks, without any technical control ensuring the text excludes local session, memory, or USER.md content. That creates a data-boundary mismatch with the skill description: if upstream code passes raw local context or overly broad composed prompts, sensitive local data can be exfiltrated despite the manifest’s assurances.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 67% confidence

Finding

The trigger examples for Soul Healing Mode include multiple Chinese phrases, but the document does not explain whether multilingual triggering is optional, illustrative, or user-selected. This can create an implicit language/locale preference in activation behavior without an explicit opt-in or stated language policy.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring says only structured fields are extracted from USER.md, but the code also captures free-form notes/preferences. Free-form notes are much more likely to contain sensitive personal information, so this mismatch can cause developers and users to underestimate what data is being collected and later shared.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 70% confidence

Finding

The CLI description says it will collect personalized context from OpenClaw conversation history, even though the tool supports both qclaw and openclaw. This hard-coded wording imposes a specific context in natural language rather than presenting a neutral or user-selected option.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The consent notice says sensitive text will not be written to audit.log until explicit confirmation, but after --allow-sensitive the code can still write heuristic-sensitive prompt content in plaintext to the local audit log. While this is not remote exfiltration by itself, it can expose personal data locally to other users, backups, support bundles, or later compromise of the host.

Content

No source excerpt is available for this finding.