Security audit

mingxi-analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Chinese-language analysis framework, but its judgment tracker creates persistent local records and automatically imports data from a shared /tmp path without clear user control or permission hardening.

Install only if you want a Chinese-language analysis workflow that keeps local judgment history. Before using the tracker, review or remove any /tmp/judgment_tracker data, avoid recording secrets or sensitive business details, and consider tightening permissions on ~/.openclaw and the SQLite database.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: scripts/judgment_tracker.py:69
Finding: Automatic Import of Attacker-Controlled Temporary Files into Persistent Judgment State
Content: View full analysis
0: return # 已有数据，不重复迁移 migrated = 0 for fname in sorted(os.listdir(tracker_dir)): if not fname.endswith(".ndjson"): continue fpath = os.path.join(tracker_dir, fname) with open(fpath, "r") as f: for line in f: line = line.strip() if not line: continue try: rec = json.loads(line) except json.JSONDecodeError: continue assertion = rec.get("judgment", "") domain = rec.get("topic", "") confidence = rec.get("confidence", "T3") fail_condition = rec.get("fail_condition", "") created_raw = rec.get("created_at", "") created_at = _parse_time(created_raw) check_date_str = rec.get("check_date", "") next_check_at = _parse_time(check_date_str) if check_date_str else (datetime.now(TZ) + timedelta(days=7)) reviewed = rec.get("reviewed", False) status = "supervision" if rec.get("review_result") == "stable" else ("archived" if reviewed else "active") conn.execute(""" INSERT INTO judgment_tracker (assertion, domain, confidence, fail_condition, created_at, next_check_at, status, verifications_passed) ...[truncated 2865 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/judgment_tracker.py:42
Finding: Sensitive Judgment Data Persisted in Plaintext Without Explicit Permission Hardening
Content: View full analysis
[check_date]") print(" confidence: T1/T2/T3/T4") print(" check_date: YYYY-MM-DD (默认7天后)") sys.exit(1) domain = argv[0] assertion = argv[1] confidence = argv[2].upper() fail_condition = argv[3] now = datetime.now(TZ) if confidence not in ("T1", "T2", "T3", "T4"): print(f"❌ 无效信度: { ...[truncated 2394 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The stated purpose is analytical assistance, but the detected behavior includes persistent SQLite storage, migration from /tmp, historical record import, lifecycle/status tracking, and dashboard/report generation. This mismatch is dangerous because users and reviewers may authorize an analysis skill without realizing it performs local data retention and stateful tracking, increasing privacy, integrity, and surprise-execution risks.
Content: No source excerpt is available for this finding.

Ssd 1

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The routing policy explicitly says broad task classes should 'skip' or 'bypass' analysis and safety-related disciplines, including for document generation, file operations, and script execution. That creates a policy-level safeguard evasion mechanism: an attacker only needs to phrase a request so it lands in A/B/C to suppress downstream checks that might otherwise catch unsafe, deceptive, or harmful actions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill advertises executable script entry points and appears to rely on file read/write behavior, but it declares no explicit tool scope or permissions boundary. That creates an authorization ambiguity where the agent may access local files or write state without the user or platform having a clear, reviewable consent model.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill name, description, and operating instructions are entirely in Chinese, with no indication that the user may choose another language or that the skill is intentionally limited to a Chinese-language context. Under the language/locale policy, a fixed language without opt-in or justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list contains broad terms like 'analysis', 'diagnosis', 'evaluation', and similar everyday words that can match many benign user requests. Over-broad invocation increases the chance the skill activates unexpectedly, which is more concerning here because the skill also appears to have file and persistence capabilities beyond simple text analysis.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: All user-facing instructions, labels, and examples in this file are written solely in Chinese, and there is no indication that the user may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The design centralizes trust in a single initial classification and states that later protective mechanisms must not independently trigger once TCR decides. This creates a brittle fail-open architecture where one misclassification silently disables multiple layers of defense, increasing the chance that malicious or risky requests proceed unchecked.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file defines when the routing framework should classify requests into A-E types, but several categories use broad natural-language descriptions such as '分析某现象/问题' and '历史事件、政策解读、推演预测、跨领域思考' without clear exclusion criteria. The lack of negative examples or sharper boundaries makes it unclear when a request should activate one class versus another, increasing the risk of unintended or inconsistent routing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill content, headings, usage guidance, and output example are written only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This creates a natural-language policy issue because it implicitly enforces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file is natural-language instructional content and appears to require Chinese proficiency to use. Under the language/locale policy rule, forcing a specific language without user opt-in or justification is a policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire skill file is written in Chinese and does not provide any indication that another language may be used or that the locale is optional. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template is entirely written as a mandatory Chinese-only review format and does not indicate any user language preference handling or opt-in. In an agent skill, this can cause the system to override or ignore a user's requested language, degrading usability, accessibility, and potentially causing misunderstandings in sensitive analytical outputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script's docstring, help text, mode descriptions, and examples are entirely in Chinese, which effectively fixes the interaction language for users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not present here.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code creates a persistent SQLite database under the user’s home directory and automatically migrates prior records from /tmp into long-lived storage. For an analysis-oriented skill, retaining user judgments, topics, confidence levels, and review history expands data collection beyond transient processing and can expose sensitive analytical content or user work product if the local environment is shared, backed up, or later accessed by other components.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The snapshot and dashboard functions add ongoing telemetry-like collection of operational history, including counts by domain, review outcomes, overdue status, and trend snapshots over time. Even though this is local, it creates secondary profiling data about user analysis activity that is not obviously required by the stated skill purpose and increases privacy and misuse risk if accessed by unauthorized local users or bundled into diagnostics/backups.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire skill is written only in Chinese and does not offer any language or locale choice, opt-in, or justification for a region-specific audience. Under the stated policy, natural-language content that effectively forces a specific language without user opt-in is a locale-policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file presents all instructions and labels in Chinese, and there is no indication that users can choose another language or that the skill is intended only for a Chinese-speaking context. This may violate a language/locale policy when skills are expected to avoid forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file presents all operational instructions in Chinese and does not indicate that users may choose another language or locale. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable issue unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.