Security audit

飞书协同任务读取

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it reads a specific local USER.md task list and formats it for Feishu, with no evidence of network transfer, writes, persistence, or hidden behavior.

Install only if you are comfortable letting this skill show the contents of ~/.openclaw/workspace/USER.md in Feishu. Consider narrowing or removing the generic 帮助 and ? triggers if accidental task-list disclosure would matter in your chat environment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The documented trigger phrases include very common expressions such as “帮助”, “?” and broad requests like “有什么技能”, which can easily overlap with normal conversation. In a chat-integrated skill, this raises the chance of unintended invocation, causing the assistant to reveal task inventory or execute this skill when the user meant something else.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger list includes very broad everyday help terms such as "帮助" and "?", which can cause the skill to activate in many unrelated conversations. Because this skill reads and returns the contents of a local USER.md task inventory, over-triggering can unintentionally expose internal task names, workflow details, and available capabilities to users who did not explicitly request this specific skill.

Natural-Language Policy Violations

Low

Confidence: 87% confidence
Finding: The README presents the skill name, usage instructions, and trigger phrases entirely in Chinese, and the trigger examples are Chinese-only without any indication that other languages are supported. This can constitute a language/locale policy issue when no user opt-in or documented locale restriction is provided.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The script reads a user-specific file from the home directory (`~/.openclaw/workspace/USER.md`) and exposes its contents through command output without any explicit user-facing notice or consent check. In this skill's context, that file likely contains the user's task list and trigger phrases, so the issue is primarily privacy/transparency-related rather than code-execution related, but it still constitutes unintended access to personal local data.

Natural-Language Policy Violations

Low

Confidence: 76% confidence
Finding: The user-facing message '直接发送任务关键词即可触发' and the surrounding help/output are entirely in Chinese, implying a fixed interaction language. There is no indication that users can choose another language or that the locale restriction is documented as intentional.

Static analysis

No suspicious patterns detected.