Progress Reporter

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:19 AM UTC
• Version: 1.0.0

Overview

This progress-reporting skill is not malicious, but it asks users to create a persistent scheduled reporter under a root path and stores task details/log snippets without retention or privacy controls.

Review carefully before installing. Only enable the cron job if you want ongoing reports, run it as a least-privileged user rather than root, confirm who can read the tasks and memory directories, and plan how to delete old reports and remove the crontab entry when reporting is no longer needed. Avoid using it on tasks whose descriptions or logs may contain secrets unless you add redaction and retention controls.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Warning

• Location: SKILL.md:40
• Finding: Persistent Scheduled Execution with Unnecessary Root Scope## Vulnerability Details **File Location**: `SKILL.md:40-43` **Vulnerability Type**: Persistent cron task with excessive privileges **Risk Level**: Medium ```bash Edit crontab: # Report every 10 minutes */10 * * * * bash /root/.openclaw/workspace/skills/progress-reporter/report.sh ``` ### Technical Analysis The Skill instructs the user to configure a cron entry that executes `report.sh` every ten minutes. This is a cross-session persistence mechanism because the command continues running after the Skill invocation and across user sessions until the cron entry is explicitly removed. Periodic execution is consistent with the declared progress-reporting functionality. However, the command references a script beneath `/root`, implying deployment and potentially execution in a root-owned environment. The script itself only needs to read task files and write progress reports under the workspace, so root privileges exceed its minimum functional requirements. The instructions do not specify that the scheduler should run as a restricted user, require explicit informed consent before persistence is enabled, protect the scheduled script from modification, or provide an uninstall procedure. Although the project does not automatically modify the crontab, following the documented configuration creates a persistent execution path. If this entry is placed in root's crontab, any subsequent malicious replacement or modification of `report.sh` would execute with root privileges every ten minutes. No network payload retrieval, credential collection, automatic service installation, or direct malicious behavior was identified in the reviewed script. ### Attack Path 1. An administrator follows `SKILL.md` and adds the documented entry to root's crontab. 2. The cron daemon invokes `/root/.openclaw/workspace/skills/progress-reporter/report.sh` every ten minutes with root privileges. 3. An attacker who later compromises the Skill update channel or ...[truncated 1098 chars]
• Remediation: ## Remediation Suggestions 1. Run the reporter under a dedicated, unprivileged service account with access limited to the required task and report directories. 2. Replace hardcoded `/root` paths with configurable, user-owned paths. 3. Require explicit user consent before creating any recurring schedule and clearly disclose its frequency, accessed data, execution identity, and lifetime. 4. Provide installation and removal commands, including the exact procedure for deleting the cron entry. 5. Prefer an application-managed scheduler that operates only while a task is active and stops automatically when reporting is no longer required. 6. Ensure the scheduled script and its parent directories are not writable by untrusted users. Verify ownership and restrictive permissions during setup. 7. Use an absolute interpreter path and a minimal controlled environment for scheduled execution. 8. Consider integrity verification or signed updates so that a modified Skill script cannot silently inherit the scheduler's privileges. 9. Add tests that verify scheduler configuration, least-privilege execution, safe behavior when directories are absent, and removal of persistent configuration.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The README says the skill will 'automatically identify usage scenarios based on the skill's specific function' but does not provide concrete trigger phrases, scope limits, or exclusion conditions. For a markdown file, this creates an ambiguous activation model that could cause unintended invocation.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The entire skill description and reporting examples are specified in Chinese, including the implied output format, but there is no indication that language selection is optional or that the skill is intentionally restricted to a Chinese-language environment. This can violate language or locale policy when users have not opted into that locale.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents an automated cron job that writes progress reports, task contents, and logs into local files on a recurring schedule, but it does not warn about the persistence, sensitivity, or retention of that data. This is dangerous because task details may include confidential prompts, work artifacts, or operational context that become silently stored over time and exposed to other local users, backup systems, or later compromise.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script persistently writes task descriptions, recent log lines, and status data into report files under the workspace and memory directories without any consent, retention control, or sensitivity filtering. If task data or logs contain secrets, personal data, or proprietary content, this creates an unnecessary at-rest exposure surface and may leak information to other processes, users, or later workflows that read those directories.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: The metadata strongly biases the skill toward Chinese-language behavior through its description and author context, but there is no indication that the user explicitly opted into that language mode. This can create confusing or unexpected behavior, reduce transparency, and potentially affect user understanding of what the skill is doing, though the security impact here is limited in this file alone.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrases are generic and include common terms like 'progress report' and '任务汇报' without any scoping, permission check, or explicit activation constraint. This can cause unintended invocation in normal conversation, making the skill easier to activate accidentally or through prompt steering, especially because it appears to automate periodic reporting behavior.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: This markdown file is entirely written in Chinese, including the title and section content, with no indication that the skill supports other languages or that Chinese is a required locale. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a compliance issue.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The visible skill description is presented in Chinese, and the rest of the README continues in Chinese without indicating that users may choose another language. This can be a language/locale policy issue when a skill implicitly enforces one language without opt-in or justification.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: Natural-language strings throughout the script force report output, notifications, and logs to be in Chinese. This creates a locale policy concern because the skill does not provide any user opt-in, configuration, or documented justification for restricting output to a specific language.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The file’s docstring and comments are written only in Chinese, including instructions to supplement test cases, with no indication that language choice is optional or region-specific. This can violate a language/locale policy when a skill or repository is expected to remain language-neutral unless a locale constraint is documented.

Static analysis

No suspicious patterns detected.