T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:100- Finding
Silent persistence of potentially sensitive conversation data in plaintext logs
- Content
View full analysis
- Remediation
View remediation
Security audit
Conversation Logger
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed conversation logger, but it silently stores and reloads potentially sensitive chat history with limited user control.
Install only if you intentionally want persistent project memory. Treat the log directory as sensitive, avoid discussing secrets while logging is active, restrict filesystem access, periodically review and delete old logs, and consider modifying the skill to require explicit opt-in, visible logging status, redaction, and trusted-data handling before use.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:109- Finding
Automatic loading of writable historical logs enables persistent context poisoning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (18)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Place this `SKILL.md` at:
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs silent persistent storage of conversation summaries to disk without clear notice or consent. That creates a privacy and data-governance risk because user content may be retained, later read, or exposed across sessions without the user's awareness.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The write rules mandate silent automatic per-turn logging and file creation, which normalizes undisclosed retention of conversation-derived data. This is dangerous because it can capture sensitive requests, project details, and file paths into durable storage without informed consent or retention limits.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Explicitly telling the agent not to mention log writes suppresses transparency around persistent storage of user data. That increases the chance of covert retention and prevents users from making informed decisions about whether sensitive content should be recorded.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README explicitly promotes silent automatic conversation logging but does not present any clear warning, consent step, retention policy, or guidance about sensitive data handling. Because this skill is designed to persist user interactions across sessions, the lack of privacy disclosure materially increases the risk of collecting confidential prompts, credentials, file paths, or business data without informed user awareness.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documented behavior establishes silent persistent storage of conversation content and automatic historical recall across sessions, which expands the exposure window for sensitive user data. In an agent skill context, this is more dangerous because users may disclose secrets, internal architecture, customer data, or operational details assuming the interaction is transient, while the skill silently preserves and reuses it.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Session persistence via a shared daily log allows state and data to flow across turns and even across sub-agents, increasing the chance that sensitive information is retained longer than intended or reused in unrelated contexts. In this skill's context, the risk is amplified because persistence is automatic and shared per project, which can blur boundaries between tasks, users, or agent instances.
- Content
md - **Auto-silent logging** — Agent writes structured summaries silently after each turn - **Daily context continuity** — Auto-reads yesterday's log on the first turn of each day - **Manual lookup** — On-demand retrieval of historical logs by date or keyword - **Sub-agent support** — Spawned agents can write to the same daily log ## Quick Start
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Copy
SKILL.mdto your workspace:text {workspace}/skills/conversation-logger/SKILL.md2. Create log directories
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Copy
SKILL.mdto your workspace:text {workspace}/skills/conversation-logger/SKILL.md2. Create log directories
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Copy
SKILL.mdto your workspace:text {workspace}/skills/conversation-logger/SKILL.md2. Create log directories
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Copy
SKILL.mdto your workspace:text {workspace}/skills/conversation-logger/SKILL.md2. Create log directories
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The sample log format explicitly stores the user's core question, decisions, and file/configuration details, which are common carriers for credentials, internal paths, system topology, and sensitive business context. Persisting these fields in plain text creates a high-value local record that could be exposed through workstation compromise, shared directories, backups, or accidental sync to external systems.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description says to use the skill for 'building conversational continuity between sessions' or when 'needing file-backed chat history per project folder,' which are broad conditions rather than specific trigger phrases or constraints. It does not provide exclusion conditions or narrow invocation boundaries, increasing the chance of unintended activation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The phrase 'Any OpenClaw workspace with multiple project contexts that need isolated histories' is expansive and ambiguous, making it unclear when the skill should activate versus remain inactive. Without stricter constraints, this could overlap with normal workspace usage.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The sample AGENTS.md section is written in Chinese and is presented as the update to apply, while the rest of the skill is in English. This imposes a language choice without opt-in or justification, which is a natural-language locale policy concern.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs the agent to retain and reuse user-provided conversation content across days and sessions without explicit consent boundaries. Even though the stored content is summarized, it can still contain sensitive business context, file paths, decisions, or personal data that become available to future interactions.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Propagating logging instructions to sub-agents expands the number of components that may write conversation-derived data into shared logs. This broadens the attack surface for accidental oversharing, duplicate retention, or cross-task leakage into a common project memory file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The README presents user-facing content and log field labels in Chinese alongside English, but it does not state whether the user can choose their preferred language or locale. This can be a natural-language policy issue when a skill implicitly imposes a language format for generated logs without opt-in.
- Content
Static analysis
No suspicious patterns detected.