Security audit

JQOpenClawNode skill

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed remote node administration skill, but it needs Review because its self-update workflow can replace the node from caller-supplied HTTP/HTTPS downloads with only MD5 checking.

Install only for a trusted administrator who intentionally needs broad remote node control. Keep gateway allowCommands narrow, avoid enabling node.selfUpdate unless updates are restricted to signed releases from trusted sources, and require explicit confirmation before using screenshots, clipboard reads, input control, process termination, file deletion, command execution, or node updates.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: references/command-spec.md:693
Finding: Caller-Controlled Remote Update Allows Arbitrary Payload Execution
Content: View full analysis
Vulnerability Details

File Location: references/command-spec.md, lines 693-699
Related Locations: SKILL.md, lines 65-66, 87, and 106-107
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

Vulnerable Code Snippet

markdown
## 11. node.selfUpdate 用途：执行节点自更新。流程为参数校验 -> 当前程序 MD5 比对 -> HTTP 下载 -> 下载包 MD5 比对 -> 写入临时文件 -> 生成并启动更新 bat -> `node.invoke` 回包后延迟退出当前节点。 `params`： - `downloadUrl`：字符串，必填。新版本程序完整下载地址（仅支持 `http/https`）。 - `md5`：字符串，必填。32 位十六进制 MD5；若与当前程序一致，返回无需更新。

Related instructions in SKILL.md include:

markdown
- `node.selfUpdate`：30000-300000（下载+校验+脚本启动；成功后节点会退出重启） - 调用 `node.selfUpdate` 时，`md5` 为必填（32 位十六进制）；缺失或格式错误按 `INVALID_PARAMS` 处理。

markdown
- `command not allowlisted`： - 说明这是 Gateway 策略拦截。 - 提示管理员在 Gateway 配置添加 `gateway.nodes.allowCommands`（如 `file.read`、`file.write`、`process.exec`、`process.manage`、`system.run`、`process.which`、`system.notify`、`system.clipboard`、`system.input`、`node.selfUpdate`）。

Technical Analysis

The node.selfUpdate capability accepts a caller-provided downloadUrl over either HTTP or HTTPS and a caller-provided MD5 value. It then downloads the referenced file, compares it with the supplied digest, writes it to a temporary file, generates and starts an update BAT file, and exits the current node so that the replacement can take effect.

The integrity check does not establish payload authenticity because the same caller controls both the executable URL and its expected MD5. An attacker can calculate the MD5 of an arbitrary malicious executable and provide both values in one request. MD5 is also cryptographically obsolete and unsuitable for security-sensitive release verification.

The specification does not require:

A trusted update-origin allowlist.

HTTPS-only transport.

Certificate or public-key pinning.

A digitally signed release manifest.

Verification against an embedded trusted publisher key.

A trusted mapping bet ...[truncated 2187 chars]
Remediation: View remediation
Remediation Suggestions

Eliminate arbitrary update sources

Do not accept unrestricted caller-provided update URLs.

Resolve approved versions through a server-controlled release manifest.

Enforce a strict allowlist of official update hosts and expected URL paths.

Require secure transport

Remove support for plaintext HTTP.

Require HTTPS with strict certificate validation.

Consider public-key or certificate pinning for the official update service.

Implement cryptographic authenticity verification

Sign release manifests and update packages using an offline-protected release key.

Embed only the trusted verification public key in the node or hardened updater.

Reject any package without a valid signature, regardless of its digest.

Ensure the signed data covers the version, platform, architecture, package hash, size, and release channel.

Replace MD5

Use SHA-256 or stronger for package-integrity checking.

Treat hashes as integrity metadata only; do not use a caller-supplied hash as proof of publisher authenticity.

Strengthen authorization

Restrict node.selfUpdate to a dedicated administrative role.

Require explicit user confirmation for each update.

Apply gateway policy that binds the command to approved update versions and sources.

Do not recommend broadly allowlisting node.selfUpdate until the update trust model is corrected.

Harden update execution

Use a minimal, dedicated updater rather than dynamically generated command scripts where feasible.

Store temporary packages in a protected directory with restrictive permissions.

Prevent symbolic-link and file-replacement attacks.

Verify the package immediately before installation and again before execution.

Add downgrade prevention, atomic replacement, rollback, and recovery checks.

Improve monitoring

Log the authenticated requester, approved version, sourc ...[truncated 168 chars]

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (28)

Self-Modification

High

Category: Rogue Agent
Confidence: 96% confidence
Finding: The skill explicitly advertises node.selfUpdate, which enables remote self-modification of the node binary/software. Even though framed as an administrative feature, exposing agent self-update through a general-purpose skill materially increases the risk of remote code deployment, persistence, and takeover if misused, socially engineered, or insufficiently access-controlled.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: jqopenclaw-node-invoker description: 统一通过 Gateway 的 node.invoke 调用 JQOpenClawNode 能力（file.read、file.write、process.exec、process.manage、system.run、process.which、system.info、system.screenshot、system.notify、system.clipboard、system.input、node.selfUpdate）。当用户需要远程文件读写、文件移动/删除、目录创建/删除、进程管理（列表/搜索/终止）、远程进程执行、命令可执行性探测、系统信息采集、截图采集、系统弹窗、系统剪贴板读写、输入控制（鼠标/键盘）、节点自更新、节点命令可用性排查或修复 node.invoke 参数错误时使用。 --- # JQOpenClaw Node Invoker

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
4. 按 [references/command-spec.md](references/command-spec.md) 构造 `node.invoke` 请求。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.
md
4. 按 [references/command-spec.md](references/command-spec.md) 构造 `node.invoke` 请求。

Self-Modification

High

Category: Rogue Agent
Confidence: 94% confidence
Finding: Including node.selfUpdate in the node identification rules normalizes self-update as part of expected node capability handling. That makes dangerous self-modification functionality easier to discover and operationalize, reducing friction for misuse and increasing the blast radius if an attacker can influence skill use.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
md
- 等于 `JQOpenClawNode`。 - 以 `JQOpenClawNode` 开头（如 `JQOpenClawNode(Qt/C++)`）。 - 弱匹配（仅在 `modelIdentifier` 为空时使用）： - `commands` 同时包含：`file.read`、`file.write`、`process.exec`、`process.manage`、`system.run`、`process.which`、`system.info`、`system.screenshot`、`system.notify`、`system.clipboard`、`system.input`、`node.selfUpdate`。 - 且 `displayName` 或 `nodeId` 包含 `JQOpenClaw`。 - 拒绝匹配： - `modelIdentifier` 明确存在但不匹配 `JQOpenClawNode*`，即使命令集合相似也不按本技能处理。

Self-Modification

High

Category: Rogue Agent
Confidence: 96% confidence
Finding: The command mapping explicitly exposes node.selfUpdate as a first-class operation alongside routine actions. This packages remote self-modification as ordinary functionality, which is dangerous because it can replace or restart the node with attacker-controlled code if upstream controls fail or are bypassed.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
- 系统弹窗：`system.notify` - 系统剪贴板：`system.clipboard` - 输入控制：`system.input` - 节点自更新：`node.selfUpdate` ## 调用规则

Self-Modification

High

Category: Rogue Agent
Confidence: 98% confidence
Finding: The skill provides operational guidance for invoking node.selfUpdate, including timeout expectations and restart behavior, which directly facilitates use of self-modifying functionality. This is dangerous because it lowers the barrier to executing remote updates that can install new code, alter behavior, or cause service interruption.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
- `system.notify`：5000-15000（仅参数校验与弹窗投递，弹窗异步展示） - `system.clipboard`：5000-15000（读写系统剪贴板文本） - `system.input`：5000-15000（仅参数校验与入队，动作异步执行） - `node.selfUpdate`：30000-300000（下载+校验+脚本启动；成功后节点会退出重启） - 调用 `node.selfUpdate` 时，`md5` 为必填（32 位十六进制）；缺失或格式错误按 `INVALID_PARAMS` 处理。 - `node.invoke.timeoutMs` 可省略；若传入，必须为非负整数（毫秒），否则按 `INVALID_PARAMS` 处理。其中 `0` 视为立即超时。 - `node.invoke.timeoutMs` 会参与请求预算裁剪；当前节点会将 `system.run.params.timeoutMs`、`process.exec.params.timeoutMs`（`detached=false`）与 `file.read(operation=rg)` 的内部超时裁剪到该预算内（取更小值）。

Self-Modification

High

Category: Rogue Agent
Confidence: 99% confidence
Finding: The skill specifies only MD5 as the required integrity check for node.selfUpdate. MD5 is cryptographically weak and unsuitable as the sole trust mechanism for software updates, creating a path for malicious or substituted update packages to be accepted under some threat models.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
md
- `system.clipboard`：5000-15000（读写系统剪贴板文本） - `system.input`：5000-15000（仅参数校验与入队，动作异步执行） - `node.selfUpdate`：30000-300000（下载+校验+脚本启动；成功后节点会退出重启） - 调用 `node.selfUpdate` 时，`md5` 为必填（32 位十六进制）；缺失或格式错误按 `INVALID_PARAMS` 处理。 - `node.invoke.timeoutMs` 可省略；若传入，必须为非负整数（毫秒），否则按 `INVALID_PARAMS` 处理。其中 `0` 视为立即超时。 - `node.invoke.timeoutMs` 会参与请求预算裁剪；当前节点会将 `system.run.params.timeoutMs`、`process.exec.params.timeoutMs`（`detached=false`）与 `file.read(operation=rg)` 的内部超时裁剪到该预算内（取更小值）。 - 即便省略 `node.invoke.timeoutMs`，网关/调用端仍有等待超时（当前 OpenClaw 常见默认约 `30000ms`，CLI `openclaw nodes invoke` 默认 `15000ms`）。

Self-Modification

High

Category: Rogue Agent
Confidence: 95% confidence
Finding: The guidance instructs operators to allowlist node.selfUpdate in the gateway when blocked. This actively encourages expansion of the remote attack surface by enabling self-modifying functionality at the policy layer, making compromise more damaging if access controls or authorization are later abused.
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
md
- `command not allowlisted`： - 说明这是 Gateway 策略拦截。 - 提示管理员在 Gateway 配置添加 `gateway.nodes.allowCommands`（如 `file.read`、`file.write`、`process.exec`、`process.manage`、`system.run`、`process.which`、`system.notify`、`system.clipboard`、`system.input`、`node.selfUpdate`）。 - `command not declared by node` / `node did not declare commands`： - 先看 `node.describe.commands`。 - 要求节点端先声明命令再调用。

Self-Modification

High

Category: Rogue Agent
Confidence: 95% confidence
Finding: The error-handling section treats node.selfUpdate as a normal retriable command class, which operationalizes remote self-modification and encourages repeated attempts. In context, that increases the chance of unsafe update execution and normalizes a highly privileged action within a general-purpose skill.
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
md
## 错误处理规范 - `INVALID_PARAMS`：参数缺失、类型不匹配或超出范围（含 `file.read` / `file.write` / `process.exec` / `process.manage` / `system.run` / `process.which` / `system.notify` / `system.clipboard` / `system.input` / `node.selfUpdate` 的参数校验失败，例如 `node.selfUpdate` 缺失必填 `md5`）。指出具体字段问题并给出可直接重试的参数。 - `TIMEOUT`：可能为网关等待超时，或显式传入 `timeoutMs=0` 触发立即超时。建议增大 `timeoutMs` 或缩小任务范围。 - `FILE_READ_FAILED` / `FILE_WRITE_FAILED`：用于非参数类失败。输出失败原因并给路径、权限、目录存在性、回收站可用性等排查建议。 - `PROCESS_MANAGE_FAILED`：用于非参数类失败（目标进程不存在、权限不足、非 Windows 平台、命中关键进程保护、终止或等待过程失败）。输出节点返回错误并给 PID、权限、平台和进程存活状态排查建议。

Self-Modification

High

Category: Rogue Agent
Confidence: 97% confidence
Finding: The same section explicitly references node.selfUpdate failure handling, reinforcing that remote self-modification is supported and expected. That is high risk because self-update can be leveraged for persistence, stealthy behavior change, or complete agent compromise if abused.
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
md
- `SYSTEM_INPUT_FAILED`：`system.input` 投递或平台能力失败。建议检查平台是否为 Windows、线程池状态与节点日志。 - `SYSTEM_NOTIFY_FAILED`：`system.notify` 投递失败。建议检查应用实例状态与 UI 线程分发日志。 - `SYSTEM_CLIPBOARD_FAILED`：`system.clipboard` 执行失败。建议检查节点应用实例、图形环境与剪贴板访问能力。 - `NODE_SELF_UPDATE_FAILED`：`node.selfUpdate` 执行失败（下载失败、HTTP 状态异常、落盘失败、脚本启动失败等）。建议检查下载地址可达性、磁盘空间与杀毒拦截。 - `NODE_SELF_UPDATE_MD5_MISMATCH`：`node.selfUpdate` 下载成功但 MD5 校验不匹配。建议核对必填 `md5` 与发布包内容。 - `COMMAND_NOT_SUPPORTED`：改用已声明命令或升级节点版本。

Self-Modification

High

Category: Rogue Agent
Confidence: 97% confidence
Finding: The same section explicitly references node.selfUpdate failure handling, reinforcing that remote self-modification is supported and expected. That is high risk because self-update can be leveraged for persistence, stealthy behavior change, or complete agent compromise if abused.
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
md
- `SYSTEM_INPUT_FAILED`：`system.input` 投递或平台能力失败。建议检查平台是否为 Windows、线程池状态与节点日志。 - `SYSTEM_NOTIFY_FAILED`：`system.notify` 投递失败。建议检查应用实例状态与 UI 线程分发日志。 - `SYSTEM_CLIPBOARD_FAILED`：`system.clipboard` 执行失败。建议检查节点应用实例、图形环境与剪贴板访问能力。 - `NODE_SELF_UPDATE_FAILED`：`node.selfUpdate` 执行失败（下载失败、HTTP 状态异常、落盘失败、脚本启动失败等）。建议检查下载地址可达性、磁盘空间与杀毒拦截。 - `NODE_SELF_UPDATE_MD5_MISMATCH`：`node.selfUpdate` 下载成功但 MD5 校验不匹配。建议核对必填 `md5` 与发布包内容。 - `COMMAND_NOT_SUPPORTED`：改用已声明命令或升级节点版本。

Self-Modification

High

Category: Rogue Agent
Confidence: 97% confidence
Finding: By documenting MD5 mismatch behavior for node.selfUpdate, the skill further enables and legitimizes the remote self-update path. In the context of a skill that also exposes file, process, execution, and input-control abilities, adding self-modification makes the overall capability set substantially more dangerous because compromise can become persistent and self-reinforcing.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
md
- `SYSTEM_NOTIFY_FAILED`：`system.notify` 投递失败。建议检查应用实例状态与 UI 线程分发日志。 - `SYSTEM_CLIPBOARD_FAILED`：`system.clipboard` 执行失败。建议检查节点应用实例、图形环境与剪贴板访问能力。 - `NODE_SELF_UPDATE_FAILED`：`node.selfUpdate` 执行失败（下载失败、HTTP 状态异常、落盘失败、脚本启动失败等）。建议检查下载地址可达性、磁盘空间与杀毒拦截。 - `NODE_SELF_UPDATE_MD5_MISMATCH`：`node.selfUpdate` 下载成功但 MD5 校验不匹配。建议核对必填 `md5` 与发布包内容。 - `COMMAND_NOT_SUPPORTED`：改用已声明命令或升级节点版本。 ## 输出规范

Self-Modification

High

Category: Rogue Agent
Confidence: 97% confidence
Finding: By documenting MD5 mismatch behavior for node.selfUpdate, the skill further enables and legitimizes the remote self-update path. In the context of a skill that also exposes file, process, execution, and input-control abilities, adding self-modification makes the overall capability set substantially more dangerous because compromise can become persistent and self-reinforcing.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
md
- `SYSTEM_NOTIFY_FAILED`：`system.notify` 投递失败。建议检查应用实例状态与 UI 线程分发日志。 - `SYSTEM_CLIPBOARD_FAILED`：`system.clipboard` 执行失败。建议检查节点应用实例、图形环境与剪贴板访问能力。 - `NODE_SELF_UPDATE_FAILED`：`node.selfUpdate` 执行失败（下载失败、HTTP 状态异常、落盘失败、脚本启动失败等）。建议检查下载地址可达性、磁盘空间与杀毒拦截。 - `NODE_SELF_UPDATE_MD5_MISMATCH`：`node.selfUpdate` 下载成功但 MD5 校验不匹配。建议核对必填 `md5` 与发布包内容。 - `COMMAND_NOT_SUPPORTED`：改用已声明命令或升级节点版本。 ## 输出规范

Self-Modification

High

Category: Rogue Agent
Confidence: 98% confidence
Finding: This finding identifies a built-in self-update command that modifies the node binary and causes the current process to exit for replacement. In the context of a remote node-invoker skill, self-modification is highly dangerous because it provides a privileged path to replace running code and potentially establish persistence or deploy malicious updates.
Content: Scanner excerpt · references/command-spec.md (reported line 693)May include surrounding context.
}

text
## 11. node.selfUpdate 用途：执行节点自更新。流程为参数校验 -> 当前程序 MD5 比对 -> HTTP 下载 -> 下载包 MD5 比对 -> 写入临时文件 -> 生成并启动更新 bat -> `node.invoke` 回包后延迟退出当前节点。

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The self-update feature downloads a new executable over HTTP/HTTPS, writes a temp file, launches an update script, and replaces the running node, yet the documentation lacks strong safety constraints. This is a direct remote code modification path; MD5 integrity alone is not sufficient against active attackers, and allowing plain HTTP enables tampering in transit.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/command-spec.md (reported line 703)May include surrounding context.
md
返回重点（`payload`）： - 无需更新： - `operation=selfUpdate` - `updated=false` - `reason=md5_unchanged` - `currentMd5`

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/command-spec.md (reported line 709)May include surrounding context.
md
返回重点（`payload`）： - 无需更新： - `operation=selfUpdate` - `updated=false` - `reason=md5_unchanged` - `currentMd5`

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/command-spec.md (reported line 724)May include surrounding context.
md
返回重点（`payload`）： - 无需更新： - `operation=selfUpdate` - `updated=false` - `reason=md5_unchanged` - `currentMd5`

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/command-spec.md (reported line 770)May include surrounding context.
md
返回重点（`payload`）： - 无需更新： - `operation=selfUpdate` - `updated=false` - `reason=md5_unchanged` - `currentMd5`

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/command-spec.md (reported line 772)May include surrounding context.
md
返回重点（`payload`）： - 无需更新： - `operation=selfUpdate` - `updated=false` - `reason=md5_unchanged` - `currentMd5`

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/command-spec.md (reported line 775)May include surrounding context.
md
返回重点（`payload`）： - 无需更新： - `operation=selfUpdate` - `updated=false` - `reason=md5_unchanged` - `currentMd5`

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/command-spec.md (reported line 715)May include surrounding context.
md
- `downloadedMd5` - `expectedMd5` - `willExit=true` - `status=exiting_for_self_update` 注意： - 下载临时文件使用 UUID 文件名，不带 `.exe` 后缀。

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/command-spec.md (reported line 769)May include surrounding context.
md
- `system.notify` 请求投递失败（如应用实例不可用、UI 线程分发失败）。 - `SYSTEM_CLIPBOARD_FAILED` - `system.clipboard` 执行失败（如应用实例不可用、图形环境缺失、剪贴板访问失败）。 - `NODE_SELF_UPDATE_FAILED` - `node.selfUpdate` 执行失败（下载失败、HTTP 状态异常、临时文件写入失败、更新脚本启动失败等）。 - `NODE_SELF_UPDATE_MD5_MISMATCH` - `node.selfUpdate` 下载成功但 MD5 校验不匹配。

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/command-spec.md (reported line 771)May include surrounding context.
md
- `system.notify` 请求投递失败（如应用实例不可用、UI 线程分发失败）。 - `SYSTEM_CLIPBOARD_FAILED` - `system.clipboard` 执行失败（如应用实例不可用、图形环境缺失、剪贴板访问失败）。 - `NODE_SELF_UPDATE_FAILED` - `node.selfUpdate` 执行失败（下载失败、HTTP 状态异常、临时文件写入失败、更新脚本启动失败等）。 - `NODE_SELF_UPDATE_MD5_MISMATCH` - `node.selfUpdate` 下载成功但 MD5 校验不匹配。

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly documents full-screen capture and returning uploaded URLs, but provides no requirement for user consent, data minimization, or warning that screenshots may contain sensitive information such as credentials, documents, chats, or PII. In a remote node-control skill, screenshot capture is an inherently privacy-sensitive surveillance capability, and the uploaded-URL behavior increases exfiltration risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code Snippet

Technical Analysis

Remediation Suggestions

SkillSpector

Self-Modification

Ae1

Ae1

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Missing User Warnings

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Missing User Warnings

Static analysis