fullask

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:28 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its logistics-analysis purpose, but it should be reviewed because it reads operational data from local Excel files and opens a business portal over plain HTTP.

Install only if you expect the skill to access the named logistics portal and the local files 2.xlsx and 揽收及时率异常明细.xlsx. Prefer an HTTPS portal URL, keep the spreadsheets in a controlled location, and confirm that the files contain only data needed for this analysis before use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:10

Finding

Operational Portal Accessed over Unencrypted HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10 and 22
Vulnerability Type: Cleartext communication with an operational logistics portal
Risk Level: Medium

Vulnerable Code

bash

openclaw browser open http://jingwe.jdl.com/#/indexCenter/shipperOverview

The same command appears at both identified locations.

Technical Analysis

The skill explicitly directs the browser to access an operational logistics portal using plain HTTP rather than HTTPS. HTTP does not provide transport-layer confidentiality, integrity, or server authentication.

If the initial connection remains on HTTP, a network-positioned attacker may inspect or modify the response before the agent captures it with openclaw browser snapshot. Even if the server normally redirects clients to HTTPS, the initial unauthenticated HTTP request may remain susceptible to redirect manipulation unless HTTPS is enforced through a mechanism such as HSTS. The repository does not establish whether such protections exist.

Attack Path

1. A user invokes the skill to inspect carrier logistics data.
2. The skill opens the portal through the configured http:// URL.
3. An attacker with a suitable network position intercepts the cleartext request or response.
4. The attacker observes operational traffic or substitutes altered portal content, metrics, or navigation instructions.
5. The skill captures the exposed or manipulated page through a browser snapshot.
6. The agent treats the captured information as authoritative and may produce incorrect rankings, anomaly analysis, or operational recommendations.

Impact Assessment

Successful exploitation does not directly grant local system privileges. Its scope is the browser session and the operational data transmitted or displayed through the insecure connection.

Potential consequences include:

• Disclosure of carrier names, logistics metrics, rankings, and anomaly information.
• Manipulation of page content used by the agen ...[truncated 398 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every operational portal URL with its verified HTTPS equivalent:

   bash

   openclaw browser open https://jingwe.jdl.com/#/indexCenter/shipperOverview
   

2. Confirm that the endpoint presents a valid certificate issued for the expected hostname.

3. Configure the browser workflow to reject certificate errors, HTTP downgrades, and redirects from HTTPS to HTTP.

4. Enable HSTS on the portal, preferably with an appropriate includeSubDomains policy after compatibility testing.

5. Avoid transmitting authentication tokens, cookies, carrier data, or other sensitive information over cleartext connections.

6. Validate critical metrics against a trusted data source before generating operational recommendations, particularly when captured page content could influence business decisions.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

L03 使用“当用户查询物流指数总分时”作为技能描述，但未限定具体触发短语、上下文范围或排除情形。该表述较宽泛，容易与一般性的物流数据查询请求重叠，增加误触发风险。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to read local Excel files ('2.xlsx' and '揽收及时率异常明细.xlsx') without clearly informing the user in the skill interface or requiring explicit runtime consent. This creates a risk of unintended access to local data sources and possible disclosure of sensitive operational or business information, especially if file contents are broader than the user expects.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.