Security audit

Task Tracker Pro

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local task tracker that persists task progress to files, with no evidence of hidden code, network access, credential use, or destructive behavior.

Install this if you want automatic local task tracking across sessions. Be aware that task names, steps, logs, and progress are stored under ~/.openclaw/workspace/tasks/ and may be read on future sessions to resume work; avoid putting sensitive details there unless you are comfortable keeping them locally.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

High

Confidence: 95% confidence
Finding: The skill advertises activation on very common phrases like '帮我做XX', '规划一下步骤', and progress-related questions, which can cause the skill to activate in many ordinary conversations where persistent task tracking was not explicitly requested. Because this skill writes state to disk and influences future sessions, over-broad triggering increases the chance of unintended persistence, context bleed, and surprise execution behavior.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The condition '新对话/会话启动时自动检查未完成任务' causes the skill to auto-run on session start without a strong user signal in the current conversation. This is risky because it can pull prior local state into a fresh interaction unexpectedly, exposing historical task data or causing the agent to continue work the user did not ask to resume.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill's core design says all state is persisted to files and not trusted to conversation memory, but it does not require a clear user-facing warning before creating and maintaining local task records. This can lead users to unknowingly store potentially sensitive plans, logs, and agent activity on disk beyond the current conversation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to automatically list and read prior task files at the start of a new conversation without a privacy warning or consent check. This creates a cross-session data access path that may reveal old user objectives, logs, or sensitive work context in situations where the user expected a fresh session.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: The user-facing README content describing the skill's purpose and usage is written in Chinese, and there is no indication that users may choose another language or that the locale restriction is intentional. Under the language/locale policy rule, this can be a natural-language policy violation because it implicitly forces a specific language for understanding and use.

Static analysis

No suspicious patterns detected.