Security audit

relation-keeper

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent relationship-reminder purpose, but it automatically installs persistent reminders and stores sensitive personal relationship data with weak scoping and safeguards.

Review this carefully before installing. It is intended to remember people, events, and reminders, but that means it may persist third-party personal data such as addresses, phone numbers, birthdays, and relationship history. Install only if you are comfortable with a recurring OpenClaw cron task being created automatically, and prefer setting RELATION_KEEPER_DATA to a private user directory with restrictive permissions. Avoid storing unnecessary sensitive fields, and verify how to remove the cron task and delete the JSON data files if you stop using it.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils.js:20
Finding: Sensitive Personal Data Stored Without Restrictive File Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/install.js:10
Finding: Unquoted Installation Path Embedded in a Persistent Shell Instruction
Content: View full analysis
&& node scripts/scan.js ``` The path is not shell-quoted or validated. If the installation path contains whitespace, shell metacharacters, command substitutions, or control operators, the resulting instruction may be parsed as multiple shell operations. The installer does not directly pass this string to `exec`; it registers the string as an OpenClaw message or system event instructing the Agent to execute the command. Exploitation therefore depends on how OpenClaw interprets and executes scheduled instructions. If the Agent follows the instruction through a shell, an u ...[truncated 1956 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 声明描述的是一个较完整的社交关系管理技能，包含三大能力：人物画像、未来事件与提醒、过去经历归档。给出的代码块只对应其中第一部分，而且实现范围也较基础：本地JSON存储人物信息，支持get/list/upsert，字段包括性别、生日、出生年/日期、地址、电话、备注及事实条目。代码中没有任何日程、纪念日、提醒级别、通知、定时任务、事件归档或查询回溯逻辑。虽然facts字段可勉强记录一些经历，但这只是通用键值存储，不足以支撑声明中的约会/吃饭/游玩归档功能。因此描述明显比代码实际能力更宽，属于功能性不匹配。
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is explicitly designed to store highly sensitive personal data such as home addresses, phone numbers, birthdays, and relationship history, and it also auto-configures reminder infrastructure via cron. Without a prominent warning and consent model, users may unknowingly enable persistent storage and automated processing of third-party personal data, creating substantial privacy, compliance, and trust risks.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
**不创建一次性提醒**，使用**一个每 15 分钟运行的 Cron** 调用 `scan.js` 扫描，如有需要提醒的内容则输出。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.
md
**不创建一次性提醒**，使用**一个每 15 分钟运行的 Cron** 调用 `scan.js` 扫描，如有需要提醒的内容则输出。

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly promotes collecting and storing highly sensitive personal data such as phone numbers, home addresses, birthdays, and relationship history, but provides no privacy, consent, retention, or access-control guidance. In the context of a relationship-tracking skill, this increases the risk of misuse, overcollection, and unauthorized disclosure of personal information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The installation instructions state that running npm install will automatically configure a recurring scan every 15 minutes, but this behavior is easy to miss and is not presented as a clear security/operational warning. Automatic creation of scheduled tasks can surprise users, cause unintended background execution, and amplify the impact of any later script misuse or notification exfiltration.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill references environment variables and installation-time command execution but does not declare any explicit tool scope, permissions, or allowed-tools. That creates a transparency and least-privilege problem: users and the host agent cannot easily tell that the skill depends on environment access and setup-side execution, which can enable unintended access paths or unsafe deployment assumptions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill description and examples are written entirely in Chinese and the schema constrains values with Chinese-specific examples such as gender labels and social phrases, while the configuration defaults to Asia/Shanghai. The file does not state that the skill is China-specific or offer an opt-in language/locale choice, which can violate language or locale policy expectations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger conditions are broad enough to match ordinary conversation, causing the skill to activate and persist social data without sufficiently explicit user intent. In a skill designed to store sensitive personal information and appointments, over-triggering materially increases privacy risk by capturing names, addresses, phone numbers, and relationship details when the user may only be chatting or asking a general question.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest explicitly states that the skill stores highly sensitive personal data, including birthdays, home addresses, phone numbers, and relationship history, but provides no privacy notice, retention policy, consent guidance, or handling safeguards. In a relationship-management context, this creates meaningful risk of over-collection, unexpected persistence, and exposure of third-party personal data if the platform, logs, or downstream integrations are accessed or misused.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The postinstall script automatically provisions an external cron job via openclaw and may immediately wake a session to emit a command-like reminder message. Triggering external scheduled behavior during installation exceeds normal local setup expectations and can cause unintended message injection or persistent automation without explicit runtime consent. In the context of a relationship-management skill that handles sensitive personal data, surprise background scheduling is more risky because it can surface reminders into chats or channels the user did not intend.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code file contains natural-language comments and console messages in Chinese, including installation behavior descriptions and runtime notices. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation because users are not offered any language selection or documented justification for the constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script persists highly sensitive personal data such as address, phone number, birth date, and relationship notes to local storage with no notice, consent flow, minimization, or protection visible in this file. In the context of a 'relation-keeper' skill whose purpose is to accumulate intimate social profiles over time, silent persistence materially increases privacy risk if the host machine, backups, or shared account are accessed by others.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file-level natural-language description is entirely in Chinese, which imposes a specific language/locale on operators or maintainers without indicating any user choice or opt-in. The policy explicitly disallows language-forcing unless the constraint is documented and justified as region-specific, which is not stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The getTz function defaults to 'Asia/Shanghai' when no environment variable is set, imposing a specific locale-related setting without offering user choice in this file. This can violate language/locale policy expectations unless the region-specific default is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 66% confidence
Finding: The README is entirely written in Chinese and all usage examples, labels, and command arguments are presented only in Chinese, with no indication that other languages are supported or that Chinese is a region-specific requirement. This can be a natural-language policy concern when a skill effectively imposes a language without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 64% confidence
Finding: The display name and description are primarily in Chinese, with no indication that users can choose their preferred language or locale. This may conflict with language-choice policy if the skill is presented to a broader audience without explicit opt-in or clear locale scoping.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The package description is written entirely in Chinese and presents the skill in a single language without indicating that the user can choose another language or that the skill is intended only for a Chinese-speaking context. Under the policy for natural-language issues, this is a locale/language constraint that is not documented as optional or justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code emits user-facing help/error text only in Chinese (用法, 姓名, 选项). That imposes a specific language on users without opt-in or justification, which matches the language/locale policy concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The comments describe simple initialization, but the script also constructs a message instructing execution of node scripts/scan.js and injects it into either the current chat or an external channel, optionally with immediate wake-up. This mismatch reduces transparency and can mislead users or reviewers about side effects, increasing the risk of unauthorized or unexpected actions at install time. Because the skill manages intimate contact and event data, covert or poorly disclosed messaging behavior is especially sensitive.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script's usage and error messages are presented only in Chinese, with no option to select another language or locale. This is a natural-language policy concern because it forces a specific language on all users without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This code writes JSON data to disk using fs.writeFileSync, which affects user data on the local filesystem. Although the function names and comments describe the behavior for developers, there is no user-facing confirmation, warning, or visible disclosure in this file about persistence to disk.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/install.js:35