T06 · System Persistence
Error
- Location
scripts/add_task.js:406- Finding
Automatic Installation of Persistent Cron Jobs Without Explicit User Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
personal-worklist-via-feishu
Security checks for vulnerabilities and agentic risk
Overview
This worklist skill is mostly coherent, but it needs review because it can create persistent reminders automatically and has unsafe command and credential configuration handling.
Review before installing. Only use this skill if you are comfortable giving it Feishu Bitable read/write authority, access to Feishu app credentials, permission-management ability, and persistent OpenClaw reminders. The automatic cron setup and unsafe open_id/config handling should be fixed before normal use.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup_reminders.js:160- Finding
Shell Command Injection Through the Open ID Parameter
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/set_config.js:43- Finding
Executable JavaScript Injection and Plaintext Secret Storage in Configuration Updates
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup_reminders.js:47- Finding
Plaintext HTTP Holiday Service Controls Scheduled Reminder Decisions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (98)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A self-modifying capability that edits its own SKILL.md or metadata is dangerous because it can silently alter future behavior, triggers, and policy constraints, potentially bypassing review or expanding permissions over time. In agent environments, self-referential file modification is a strong persistence and tampering risk even if framed as benign maintenance.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 创建台账：node scripts/init_table.js --open-id USER_OPEN_ID --lang zh|en，--open-id 必填
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 创建台账：node scripts/init_table.js --open-id USER_OPEN_ID --lang zh|en，--open-id 必填
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 创建台账：node scripts/init_table.js --open-id USER_OPEN_ID --lang zh|en，--open-id 必填
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 创建台账：node scripts/init_table.js --open-id USER_OPEN_ID --lang zh|en，--open-id 必填
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 创建台账：node scripts/init_table.js --open-id USER_OPEN_ID --lang zh|en，--open-id 必填
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 创建台账：node scripts/init_table.js --open-id USER_OPEN_ID --lang zh|en，--open-id 必填
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 创建台账：node scripts/init_table.js --open-id USER_OPEN_ID --lang zh|en，--open-id 必填
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 录入任务：node scripts/add_task.js --task "名称" --priority "①" --deadline "2026-04-25" --lang zh|en，首次成功自动触发 cron