T09 · Insecure Skill Coding Practices
Error
- Location
scripts/jd_to_role_card.py:27- Finding
Overbroad credential-file loading combined with disabled TLS verification
- Content
View full analysis
- Remediation
View remediation
Security audit
多agent协同执行
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real workflow skill, but its helper scripts can touch secrets, make network requests, and modify OpenClaw state outside the workshop scope.
Review this skill before installing. It is most appropriate for users who want a Chinese-language, local multi-agent planning workflow and understand that workshop files may contain sensitive project details. Avoid running the cleanup and openclaw-subagents-parallel helpers until their path handling, confirmation gates, and here-document interpolation are fixed. Use conservative session IDs, do not pass absolute or ../ paths as role-card paths, and only use JD search when you are comfortable sending role/industry/task terms and a Serper API key to a third-party service.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/orchestrator.py:315- Finding
Unvalidated session identifiers allow workshop-directory path traversal
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/orchestrator.py:125- Finding
Role-card path resolution permits arbitrary local-file reads
- Content
View full analysis
- Remediation
View remediation
/roles/`. 4. If shared sample cards must be supported, map symbolic identifiers to known files instead of accepting unrestricted paths. 5. Reject symlinks that resolve outside the permitted root, or validate the final resolved target after following symlinks. 6. Check that the target is a regular file and impose a reasonable maximum size before reading it. 7. Do not inject file content into an agent context unless its provenance and scope have been validated. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/openclaw-subagents-parallel.sh:35- Finding
Environment-controlled configuration path enables Python here-document injection
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/orchestrator.py:733- Finding
Cleanup command deletes unrelated global OpenClaw subagent sessions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (38)
Tainted flow: 'req' from os.environ.get (line 53, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python except ImportError: ctx = ssl._create_unverified_context() with urllib.request.urlopen(req, timeout=15, context=ctx) as resp: return json.loads(resp.read().decode())
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill also references scripts that modify local configuration, edit OpenClaw JSON settings, control subagent concurrency, and create backups, none of which are disclosed by the top-level workshop description. Configuration mutation is materially more sensitive than ordinary planning because it can alter future agent behavior beyond the current task and create persistent side effects on the local environment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill also references scripts that modify local configuration, edit OpenClaw JSON settings, control subagent concurrency, and create backups, none of which are disclosed by the top-level workshop description. Configuration mutation is materially more sensitive than ordinary planning because it can alter future agent behavior beyond the current task and create persistent side effects on the local environment.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 2. **节拍 6b — 按 SKILL 执行**：严格按各 **`SKILL.md`** 执行，并与 **`TOOLS.md`** 本机约定对齐；留痕。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # 输出到文件 python3 jd_to_role_card.py --role "数据分析师" --industry "电商" -o workshops/2026-03-26_demo/roles_data_analyst.md 依赖：仅标准库 + SERPER_API_KEY（从 ~/.openclaw/.env 读取） """ import argparse
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def load_env(): env_file = Path.home() / ".openclaw" / ".env" if not env_file.exists(): return with open(env_file) as f:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def load_env(): env_file = Path.home() / ".openclaw" / ".env" if not env_file.exists(): return with open(env_file) as f:
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
If certifi is unavailable, the script disables TLS certificate verification by creating an unverified SSL context. That permits man-in-the-middle interception of the HTTPS request and response, exposing the API key and allowing an attacker to tamper with returned search data.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The cleanup code can modify persistent infrastructure files outside the workshop scope by deleting keys from an external agent sessions.json file based only on a substring match of "subagent". In an agent skill context, that is more dangerous because a user invoking a seemingly unrelated workshop utility could unintentionally disrupt broader agent infrastructure, lose session metadata, or affect availability of other components.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The manifest describes a seven-stage multi-role workshop for clarifying, planning, and executing tasks. L40 documents a separate capability to query external job platforms through Serper API, which goes beyond the core workshop orchestration purpose and is not clearly necessary for running a discussion workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README describes using Serper API for external JD search but does not warn that user-provided role, industry, and task details may be sent to a third party. In workshop contexts, task descriptions can contain confidential strategy, hiring plans, product details, or regulated topics, so omission of this disclosure creates a real privacy and compliance risk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README frames the package as a local skill, but also documents an optional Serper-backed JD search feature that sends role, industry, and task details to an external service. This mismatch can mislead users about data flow and trust boundaries, increasing the chance that sensitive workshop context is disclosed unexpectedly.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill describes and directs use of file access, network access, and environment-backed tooling, but it does not declare any explicit tool scope or allowed-tools boundary. In an agent framework, missing permission declarations increases the chance of over-broad execution and makes it harder to audit or constrain risky actions, especially because the workflow later references external search, local file writes, and execution scripts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include broad everyday terms such as 圆桌 and 需求评审, which can cause accidental activation in unrelated conversations. Overbroad activation is risky here because this skill can initiate multi-step orchestration, file writes, script execution guidance, and potentially network/configuration-related actions, so an unintended trigger has meaningful side effects.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The subagent template explicitly requires “输出：中文 Markdown”, which forces a specific language choice. Elsewhere in the file there is no opt-in, fallback, or statement that the language should follow the user's preference, so this is a natural-language locale policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The title and the entire instruction set are written as mandatory operational guidance in Chinese, with no indication that users may choose another language or that the skill is limited to a Chinese-specific regulatory or regional context. This creates a natural-language locale constraint that appears forced rather than optional.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The file is entirely framed in Chinese and provides a Chinese-only role-card skeleton, including required title phrasing such as 「针对任务：…」. This imposes a specific language/locale in the skill content without any opt-in, alternative language option, or documented region-specific justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill guidance is written as mandatory Chinese operational instructions, including prescribed output text such as '本子 agent 结束说明' and fixed Chinese status phrases. There is no indication that users may choose another language or that the Chinese-only requirement is justified as a region-specific constraint, which creates a language/locale policy concern.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest describes a seven-stage multi-agent workshop skill focused on role-based discussion and solution planning. This helper script instead loads a local API key and performs external recruitment-search lookups, which is a separate data-acquisition capability not implied by the skill description.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says the skill is a seven-stage, task-driven multi-role workshop triggered by phrases like '多角色研讨' and '需求评审'. In contrast, this file implements outbound search against Serper to mine job-description snippets and draft role cards, extending behavior beyond the described workshop orchestration.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The request body forces gl="cn" and hl="zh-cn", and the surrounding script content is also Chinese-only. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python file is a code file, so SQP-3 applies to natural-language strings in docstrings and user-facing output. The usage text and operational messages are written in Chinese throughout, with no option for another language and no justification that the tool is intended only for a Chinese-language environment.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The orchestrator contains a cleanup command that reaches outside the workshop's own state and edits an external OpenClaw sessions.json file under a different directory tree. That violates separation of concerns and expands the tool's authority, creating a risky path for accidental or unauthorized modification of unrelated agent session state if the script is invoked in the wrong context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The cleanup command performs destructive modification of a persistent JSON state file after only printing status messages and making a backup, with no interactive confirmation or explicit acknowledgement gate. This increases the likelihood of operator error and accidental deletion of unrelated session entries, especially because the command is bundled into a workshop tool where users may not expect infrastructure-impacting side effects.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The phase file is entirely written in Chinese and includes Chinese-only trigger phrases and workflow instructions without any visible user opt-in, locale gating, or documented language constraint in the file context. In a general-purpose agent skill, this can cause the agent to override the user's preferred language, degrade comprehension, and lead to incorrect task execution or missed safety clarifications when the user does not read Chinese.
- Content
Static analysis
No suspicious patterns detected.