ClawHub
Back to skill

Security audit

安全事件日志调查助手

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it sends potentially sensitive security logs to a configurable external LLM API without implemented redaction despite claiming automatic redaction.

Review before installing in sensitive environments. Use this only with logs you are allowed to send to the configured LLM provider, redact secrets manually first, verify the SILICONFLOW_BASE_URL destination, and do not rely on the documented automatic redaction claim unless the implementation is changed and tested.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
src/llm_client.py:84
Finding

Unredacted Security Logs Are Transmitted to a Configurable External API

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
src/llm_client.py:84
Finding

Attacker-Controlled Log Entries Can Manipulate LLM Security Reports

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

bash
cd /root/.openclaw/skills/security-log-analyzer
pip install -r requirements.txt
cp .env.example .env
# 编辑.env 文件，填写 API Key

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Referencing a third-party API endpoint is not inherently malicious, but in this skill's context it confirms that security log data will leave the local environment and be sent to an external service. Because the skill is specifically for analyzing security incident logs, the transmitted data is likely to be sensitive, making external transmission materially risky without strong disclosure, minimization, and privacy controls.

Content

Scanner excerpt · DESIGN.md (reported line 43)May include surrounding context.

md
## API 配置

**SiliconFlow 配置**：
- Base URL: https://api.siliconflow.cn/v1
- Model: Qwen/Qwen3-8B
- API Key: 从.env 文件读取

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The design states that user-provided security logs are sent to an external LLM for analysis, but it does not clearly disclose to users that potentially sensitive log contents will be transmitted to a third-party provider. Security logs often contain IPs, usernames, hostnames, internal paths, tokens, or incident details, so omission of an explicit third-party data transfer warning creates a real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation describes analyzing security logs with an LLM and includes configuration for a third-party API endpoint, but it does not clearly warn users that uploaded log contents may be transmitted off-host to an external service. Security logs often contain sensitive data such as internal IPs, usernames, hostnames, tokens, and incident details, so undisclosed external transmission creates a real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill is configured to use an external API service, which means log data may leave the local environment for remote processing. In the context of security incident logs, this is more sensitive than generic text because the content may expose infrastructure details, credentials in logs, or active incident information to a third party.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

bash
SILICONFLOW_API_KEY=sk-your-api-key-here
SILICONFLOW_BASE_URL=https://api.siliconflow.cn/v1
SILICONFLOW_MODEL=Qwen/Qwen3-8B
API_RATE_LIMIT=2

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The natural-language strings throughout the file, including the module description and all user-facing prompts, are exclusively in Chinese. This imposes a specific language on users without any opt-in, fallback, or explanation that the tool is intended only for a Chinese-language environment, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The file describes itself as a security event log analyzer and assistant, but the implementation requires a SILICONFLOW_API_KEY and sends log content to an LLM client for analysis. Without any manifest declaring networked third-party analysis, exfiltrating potentially sensitive logs to an external service is not obviously required by the stated purpose of log analysis.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/llm_client.py (reported line 20)May include surrounding context.

python
def __init__(self):
        self.api_key = os.getenv("SILICONFLOW_API_KEY")
        self.base_url = os.getenv("SILICONFLOW_BASE_URL", "https://api.siliconflow.cn/v1")
        self.model = os.getenv("SILICONFLOW_MODEL", "Qwen/Qwen3-8B")
        self.rate_limit = int(os.getenv("API_RATE_LIMIT", "2"))

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code sends raw log content to an external LLM provider for analysis via analyze_log() without any built-in consent flow, warning, redaction, or data-classification check. Security logs often contain credentials, tokens, IPs, internal hostnames, or personal data, so transmitting them off-system can create confidentiality, compliance, and data-handling risks even if the API endpoint itself is legitimate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file’s natural-language instructions are entirely in Chinese and direct the model to respond using Chinese headings and field labels, which effectively imposes a specific language choice. Under the policy, a forced language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Natural-language policy violations apply to all file types. The file forces a specific language for all instructions and examples, and there is no indication that the skill is region-specific or that users can opt into another language/locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest presents the skill name, display name, examples, and description entirely in Chinese, with no indication that users can choose another language or that the skill is intended only for a Chinese-speaking environment. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency is specified with a lower bound only, which allows future major or minor releases to be installed without review. This can introduce supply-chain risk, unexpected breaking changes, or newly introduced vulnerable versions into the skill environment.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
openai>=1.0.0
python-dotenv>=1.0.0
tiktoken>=0.5.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
99% confidence
Finding

python-dotenv is unpinned, so the environment may resolve to different versions over time, including versions with known security issues or unsafe behavior changes. Because there is already advisory information associated with this package, leaving it unpinned increases the chance of pulling an affected release.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
openai>=1.0.0
python-dotenv>=1.0.0
tiktoken>=0.5.0

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

The manifest includes python-dotenv without pinning a version, while known advisories exist for that package. Because the resolved installed version is unconstrained above 1.0.0, it is not possible to verify from this file alone that deployment will avoid affected releases, creating a plausible supply-chain and file-handling risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The package is not pinned to an exact version, so builds are not reproducible and may silently consume newly published releases. This creates avoidable supply-chain exposure and can make security review and incident response harder.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
openai>=1.0.0
python-dotenv>=1.0.0
tiktoken>=0.5.0

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module docstring names the skill entirely in Chinese, which indicates a language-specific presentation without any visible option for user language choice. The file does not document that the skill is region-specific or otherwise justify the locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Docstrings, error messages, and console output are written in Chinese, including the test prompt and operational messages. This can violate language/locale policy when a specific language is imposed without user opt-in or documented justification.

Content

No source excerpt is available for this finding.