Windows剪贴板管理器

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:29 AM UTC
• Version: 1.0.0

Overview

This is a straightforward clipboard utility skill whose sensitive clipboard access is disclosed and aligned with its purpose, though users should handle monitoring and history carefully.

Install only if you are comfortable granting clipboard access. Avoid enabling monitoring or saving history while copying passwords, tokens, private messages, or confidential business data, and prefer a virtual environment or pinned dependency versions for installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4 and 44
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Complete Code Snippet:

yaml

metadata: {"openclaw": {"requires": {"python": ["pyperclip", "Pillow"]}, "install": []}}

bash

pip install pyperclip Pillow

Technical Analysis

The skill declares and instructs users to install pyperclip and Pillow without pinning reviewed versions or verifying package hashes. Consequently, the command resolves whichever package versions the configured Python Package Index supplies at installation time.

This creates supply-chain exposure because the installed code can change after the skill has been reviewed. A compromised package release, compromised package-maintainer account, malicious package-index configuration, or future vulnerable release could introduce attacker-controlled code. The audit did not identify evidence that the named packages are currently malicious; the issue is the absence of dependency integrity and version controls.

Attack Path

1. An attacker compromises an upstream dependency release, its publisher account, or a package index used by the victim.
2. A user follows the documented pip install pyperclip Pillow instruction.
3. pip resolves and downloads the attacker-controlled or otherwise unsafe release because no exact versions or hashes are specified.
4. Malicious installation hooks or imported package code execute under the account running the installation or skill.
5. The payload can access resources available to that account, potentially including clipboard contents and user-accessible files.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user or service account performing the installation or running the skill. The affected scope may include clipboard data, user-accessible files, environment variables, and any applications ...[truncated 213 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to an explicitly reviewed version, for example through a version-controlled requirements file.
2. Generate and verify cryptographic hashes for all packages and transitive dependencies, and install with pip --require-hashes.
3. Use a lock file produced by a dependency-management tool so transitive versions are reproducible.
4. Install only from a trusted, explicitly configured package index and disable unintended additional indexes.
5. Automate vulnerability and provenance scanning for pinned dependencies, and update them through a reviewed process.
6. Perform installation in an isolated virtual environment under a non-administrative account.
7. Keep the frontmatter dependency declaration synchronized with the locked dependency manifest.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill includes clipboard history and monitoring capabilities but does not warn users that clipboard contents may be continuously observed and retained. Clipboard data often contains passwords, tokens, private messages, or personal data, so undisclosed monitoring/retention materially increases privacy and credential exposure risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation phrases are very broad (e.g., generic terms for clipboard and copy/paste), which can cause the skill to trigger in unintended contexts. For a clipboard tool, accidental invocation is more dangerous than usual because it can read, overwrite, monitor, or retain sensitive clipboard contents without the user clearly intending to use this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill performs clipboard writes, clears the clipboard, and transforms clipboard contents without warning that these actions overwrite the user's current clipboard state. This can cause unintended loss of copied data and, in operational workflows, may lead to accidental pasting of altered or incorrect content into other applications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill description, headings, commands, and examples are presented entirely in Chinese, with no indication that users may choose another language. This can violate a language/locale policy when a skill imposes a specific language without documenting opt-in or offering alternatives.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.