Openclaw

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:45 AM UTC
• Version: 0.2.1

Overview

The skill openly creates a local persistent user profile to tailor replies, with privacy considerations but no hidden network access, code execution, or unrelated destructive behavior found.

Install only if you want a cross-session local profile that influences how replies are phrased. Review ~/.claude/user-portrait/profile.md periodically, use pause or reset if you do not want ongoing personalization, and avoid using it on shared machines or in contexts where inferred language, expertise, or communication preferences should not carry between projects.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

- **show**: read the portrait and present it faithfully in the user's language; tell them the file path and that they may edit it by hand.
- **correct**: apply their correction exactly as stated; update the "Last updated" date; show the affected section afterwards.
- **pause**: `touch ~/.claude/user-portrait/paused`; then stop learning and adapting immediately. Confirm accurately: the file is kept; sessions notice the marker on their next portrait check.
- **resume**: `rm -f ~/.claude/user-portrait/paused`.
- **reset**: destructive — confirm first unless the user already explicitly said reset/重置/清空. Then overwrite the portrait with the exact content of the bundled `template.md`.

## Safety & privacy boundary

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill's core goal is to infer how the user understands language and apply that profile to every reply, even when the portrait is built passively. This is a real security/privacy concern because it normalizes non-consensual persistent profiling and behavioral adaptation, which can expose or misuse personal traits across sessions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

This skill creates and maintains a persistent local profile under ~/.claude/user-portrait/, explicitly sharing it across sessions and even across tools. Persistent storage of user traits is a true risk because sensitive inferences can accumulate over time, be reused outside the original context, and become visible to other components or sessions without fresh consent.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

Files (all local):

- Portrait: `~/.claude/user-portrait/profile.md` (create the directory and seed from the bundled `template.md` on first use)
- Pause marker: `~/.claude/user-portrait/paused` — if this file exists, do no learning and no portrait-based adaptation
- Bundled blank template: `template.md` (next to this SKILL.md)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to always reply in the user's inferred primary language, which changes output behavior based on persistent profiling without requiring explicit consent or offering an easy per-response override. While framed as usability, it creates a privacy and autonomy issue because the system silently personalizes communication across sessions using stored user characteristics.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The template explicitly states that a user portrait is automatically maintained and shared globally across all projects and sessions, but it does not include any consent, scoping, retention, or privacy warning. In a skill context, persistent cross-project memory can expose sensitive preferences or behavioral data in unrelated contexts and increase the chance of unintended disclosure or profiling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 62% confidence

Finding

Natural-language policy violations include forcing a specific language or locale without user opt-in. This template is bilingual and introduces Chinese content by default, but it does not explicitly state that language presentation follows user preference or can be changed, which may conflict with a language-choice policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.