openclaw audit trail

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:43 AM UTC
• Version: 1.0.0

Overview

This audit-log skill is purpose-aligned, but it needs review because it encourages durable logging and exporting of detailed prompts, context, and reasoning while relying on unpinned external installs.

Install only from a pinned, reviewed version or commit in a contained environment. Treat audit data and exports as confidential: avoid logging secrets, personal data, regulated data, or raw internal reasoning unless strictly required, and use redaction, access controls, secure storage, and retention limits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:45
• Finding: Unpinned External Package and Source Installation## Vulnerability Details **File Location**: `skill.md:45-65`; duplicated in `readme.md:51-63` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code `skill.md:45-65`: ```bash npm install -g openclaw-audit-trail npm install openclaw-audit-trail clawhub install openclaw-audit-trail git clone https://github.com/ZhenRobotics/openclaw-audit-trail.git cd openclaw-audit-trail npm install npm link ``` The same installation pattern appears in `readme.md:51-63`. ### Technical Analysis The documented commands install mutable third-party content without pinning an exact package version, source commit, integrity hash, or cryptographic signature. The supplied project contains only documentation and does not include the package implementation, dependency manifest, lockfile, or source code needed to verify what these commands will execute. An npm installation may execute package lifecycle scripts. Global installation with `npm install -g` exposes package executables broadly within the user's environment, while `npm link` links the checked-out package into the active Node.js environment. The Git installation procedure checks out the repository's moving default branch instead of a reviewed commit. Consequently, the content executed by a user can differ from the content available when this Skill was audited. A compromised registry account, repository, release process, or transitive dependency could introduce malicious code after review. ### Attack Path 1. An attacker compromises the npm or ClawHub publisher account, the Git repository, the release pipeline, or a transitive dependency. 2. The attacker publishes malicious content under the expected package name or adds it to the repository's mutable default branch. 3. A user follows one of the documented unpinned installation procedures. 4. The package manager retrieves the attacker-controlled version rather than a p ...[truncated 1214 chars]
• Remediation: ## Remediation Suggestions 1. Pin npm and ClawHub installations to an exact reviewed version rather than resolving the latest release. 2. Pin source installations to a full reviewed Git commit hash or signed release tag. 3. Publish and verify cryptographic checksums or signatures for release artifacts. 4. Include the implementation, package manifest, dependency lockfile, and tests in the auditable Skill artifact. 5. Use a reproducible lockfile-based installation such as `npm ci` for source builds. 6. Initially inspect dependencies with lifecycle scripts disabled, such as through `npm install --ignore-scripts`, and enable scripts only after review. 7. Avoid global installation and `npm link` where possible. Prefer a dedicated, least-privileged environment or container. 8. Audit direct and transitive dependencies, enforce provenance verification, and monitor publisher ownership and release changes. 9. Document the exact verified artifact version, commit, checksum, and expected executable behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly encourages recording prompts, context, parameters, reasoning steps, and outputs, but it does not pair that guidance with warnings about secrets, personal data, regulated data, or model-sensitive internal content. In an audit-trail product, this omission is dangerous because users may log raw production inputs and later retain or export sensitive material to less protected files and reports.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The documentation promotes capturing full prompts, context, parameters, and reasoning for audit purposes, which can directly store user-provided secrets, personal data, business-sensitive inputs, or unsafe internal model traces. In a logging/auditing context, broad collection guidance without minimization controls materially raises the chance of persistent sensitive-data exposure.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The examples and schema encourage storing chain-of-thought-style reasoning and rich contextual details, which can leak sensitive internal deliberation, user data, or proprietary logic if logs are accessed or exported. Because the skill is specifically about durable, integrity-protected audit storage, any overcollection becomes harder to remediate once written and replicated.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The export examples show JSON, HTML, and CSV generation, including reasoning data, without any warning that exported reports may contain highly sensitive audit contents and can be copied, emailed, or published. This increases the likelihood of accidental disclosure because export functionality often moves data from controlled storage into broadly accessible artifacts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly encourages recording prompts, reasoning, outputs, and contextual data, but does not prominently warn that these fields can contain secrets, personal data, regulated information, or internal business data that will be persisted locally. In an audit-trail tool, omission of data-minimization and sensitivity warnings is dangerous because users may log raw model inputs and chain-of-thought-like content by default, creating durable sensitive records that are later exposed through backup, sharing, or compromise.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill normalizes comprehensive natural-language logging of inputs, reasoning, outputs, and context, which creates a direct data leakage path if users store secrets, personal data, or regulated content in those fields. Because the logged material is human-readable and semantically rich, accidental disclosure can expose far more than structured metadata alone, including decision rationale and embedded sensitive details.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The export examples promote writing audit data, including reasoning, into portable JSON/HTML/CSV files without warning that those files may contain sensitive prompts, decisions, and user context. Portable exports materially increase disclosure risk because they are easy to email, upload, commit to repositories, or place on shared systems where access controls may be weaker than the original storage location.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The export workflow explicitly encourages generating portable reports and even including reasoning, which compounds the leakage risk from the underlying logs. Once exported to common formats like HTML, CSV, and Markdown, the data becomes easier to browse, redistribute, index, and accidentally expose through shared drives, attachments, or source control.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The programmatic examples record detailed prompt content, recipient email addresses, urgency context, reasoning steps, model details, and alternative decisions, all of which may be sensitive in real deployments. These examples function as implementation guidance, so they encourage developers to persist rich private data and internal reasoning traces into audit logs where they may later be disclosed or mishandled.

Static analysis

No suspicious patterns detected.