Lingxi

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:26 AM UTC
• Version: 0.1.5

Overview

The skill is a broad AI orchestration and dashboard system with auto-execution, publishing, remote access, and persistent data features that are not scoped or disclosed safely enough for automatic approval.

Review carefully before installing. Only use this in a controlled environment, keep the dashboard bound to localhost or behind a trusted TLS/VPN/SSH tunnel, avoid putting tokens in URLs, avoid --break-system-packages, inspect and pin dependencies before installation, and disable or constrain memory/task retention unless users explicitly agree to storage. Do not enable social posting, GitHub pushes, bot channels, or public dashboard access until authentication, confirmation, deletion, and audit controls are clearly defined.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: README.md:121
• Finding: Dashboard Authentication Token Exposed Through Plaintext URLs<![CDATA[ ## Vulnerability Details **File Location**: `README.md:121-122`, `README.md:183`, `README.md:288-304`; `TROUBLESHOOTING.md:41-47`, `TROUBLESHOOTING.md:66` **Vulnerability Type**: Plaintext transport, URL-borne credentials, and excessive network exposure **Risk Level**: High ### Vulnerable Snippet ```markdown ### Access Addresses - **Local access:** http://localhost:8765/?token=YOUR_TOKEN - **Remote access:** http://YOUR_SERVER_IP:8765/?token=YOUR_TOKEN (requires firewall and domain configuration) ``` The troubleshooting instructions further recommend exposing the service on every network interface: ```bash netstat -tlnp | grep 8765 # Expected: 0.0.0.0:8765 rather than 127.0.0.1:8765 pkill -f "python3 server.py" cd /root/lingxi-ai-latest/dashboard/v3 && python3 server.py > /tmp/dashboard.log 2>&1 & # Open the port in the system firewall ufw allow 8765 # or: firewall-cmd --add-port=8765/tcp ``` The authentication token is also placed in an API query string: ```bash curl http://localhost:8765/api/stats?token=YOUR_TOKEN ``` ### Technical Analysis The documentation recommends authenticating to the dashboard by placing its token in a URL query parameter. Query parameters are commonly retained in browser history, copied into screenshots, recorded by web servers and reverse proxies, and exposed through diagnostic logs. Depending on browser and referrer policy, they may also be disclosed through outbound referral metadata. The recommended remote-access configuration binds the dashboard to `0.0.0.0`, opens TCP port 8765, and uses plaintext HTTP. Plaintext transport provides neither confidentiality nor integrity. A network-positioned attacker could observe the token or modify traffic. Binding to all interfaces also exceeds the minimum privileges necessary for the declared local dashboard functionality. The risk is amplified by the dashboard's documented access to memories, task records, skills, user prompts, and generated responses. ### Attack Path ...[truncated 1198 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bind the dashboard to `127.0.0.1` by default. 2. Do not expose port 8765 directly to the public Internet. 3. For remote access, place the service behind a TLS-enabled reverse proxy, authenticated VPN, or SSH tunnel. 4. Transmit credentials in an `Authorization: Bearer` header or a `Secure`, `HttpOnly`, and appropriately scoped cookie rather than a query parameter. 5. Enforce TLS certificate validation and redirect or reject all plaintext HTTP requests. 6. Restrict inbound traffic to approved source addresses through firewall or security-group rules. 7. Redact tokens from application, proxy, access, and diagnostic logs. 8. Rotate any token previously used in a URL and clear affected browser and proxy histories. 9. Add token expiration, revocation, rate limiting, failed-login throttling, and authorization checks for every API operation. 10. Add CSRF protections if browser cookies are used for authentication. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:328
• Finding: Sensitive User Prompts and Generated Outputs Persisted Without Documented Privacy Controls<![CDATA[ ## Vulnerability Details **File Location**: `README.md:141-151`, `README.md:328-359` **Vulnerability Type**: Insecure collection and storage of potentially sensitive user content **Risk Level**: Medium ### Vulnerable Snippet The documented dashboard client records user content and identity metadata: ```python from scripts.dashboard_client import record_to_dashboard record_to_dashboard( user_input="User input", user_id="User ID", channel="feishu", llm_model="qwen3.5-plus", skill_name="lingxi", status="completed", response_time_ms=123.45 ) ``` The proposed API endpoint persists prompts and generated responses in SQLite: ```python cursor.execute(""" INSERT OR REPLACE INTO tasks ( id, user_id, channel, user_input, status, task_type, created_at, updated_at, completed_at, skill_name, llm_model, response_time_ms, llm_tokens_in, llm_tokens_out, final_output ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) """, [ task_id, task_data.get("user_id", "unknown"), task_data.get("channel", "unknown"), task_data.get("user_input", "")[:500], task_data.get("status", "completed"), task_data.get("task_type", "realtime"), task_data.get("created_at", now), now, task_data.get("completed_at", now), task_data.get("skill_name", ""), task_data.get("llm_model", ""), task_data.get("response_time_ms", 0), task_data.get("llm_tokens_in", 0), task_data.get("llm_tokens_out", 0), task_data.get("final_output", "")[:1000] ]) conn.commit() conn.close() ``` ### Technical Analysis The proposed implementation stores `user_id`, `channel`, `user_input`, and `final_output`. Prompts and generated responses can contain credentials, personal information, private communications, source code, or proprietary business data. Limiting strings to 500 or 1,000 characters does not sanitize or redact sensitive information. The supplied documentation does not require user co ...[truncated 1561 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make task telemetry and conversation retention explicitly opt-in. 2. Do not store raw prompts or generated outputs unless they are essential to a user-enabled feature. 3. Apply structured redaction for passwords, API keys, tokens, personal identifiers, and other sensitive values before persistence. 4. Replace stable user identifiers with scoped pseudonymous identifiers where possible. 5. Encrypt the database at rest and protect encryption keys separately from the database. 6. Enforce least-privilege authorization for every read, write, update, and deletion operation. 7. Define short default retention periods and automatically delete expired records. 8. Provide users with clear inspection, export, and deletion controls. 9. Record access in tamper-resistant audit logs without duplicating sensitive content. 10. Document all collected fields, purposes, destinations, retention periods, and access controls. 11. Add tests confirming that sensitive fields are redacted before storage and are not emitted to ordinary logs. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:68
• Finding: Unpinned Dependencies Installed Into the System Python Environment<![CDATA[ ## Vulnerability Details **File Location**: `README.md:68-70`, `README.md:201-203`, `README.md:486-491` **Vulnerability Type**: Unsafe and non-reproducible dependency installation **Risk Level**: Medium ### Vulnerable Snippet The primary installation instructions bypass operating-system package protections: ```bash # Install dependencies pip3 install -r requirements.txt --break-system-packages ``` The troubleshooting instructions repeat this pattern for an individual package without specifying a version or hash: ```bash # Install the httpx module pip3 install httpx --break-system-packages ``` A safer virtual-environment example appears later: ```bash python3 -m venv venv source venv/bin/activate pip install -r requirements.txt ``` However, the referenced `requirements.txt` is absent from the audited artifact, so its package names, versions, hashes, and sources cannot be reviewed. ### Technical Analysis The `--break-system-packages` option overrides safeguards intended to prevent pip from modifying a distribution-managed Python environment. Packages installed this way can conflict with operating-system components and other applications that share the interpreter. Installing `httpx` without an exact version or integrity hash allows dependency resolution to change over time. The missing `requirements.txt` also prevents verification that dependencies are pinned, obtained from trusted sources, or free of confusion and typosquatting risks. Python packages and their transitive dependencies may execute code during installation or when imported. If an attacker compromises a resolved package, package index, or dependency name, the resulting code runs with the privileges of the user executing pip. ### Attack Path 1. A user follows the quick-start or troubleshooting instructions. 2. Pip resolves the unpinned package or the absent, unaudited requirements manifest from its configured package index. 3. A compromised, substituted, or unexpectedly update ...[truncated 854 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--break-system-packages` from all installation instructions. 2. Create and activate a dedicated virtual environment before installing any package. 3. Include the referenced dependency manifest in the distributed artifact. 4. Pin every direct and transitive dependency to reviewed versions. 5. Use integrity hashes, such as pip's `--require-hashes`, or a lockfile generated by a reproducible dependency-management tool. 6. Configure an approved package index and disable untrusted supplemental indexes. 7. Audit package names for typosquatting and dependency-confusion risks. 8. Run dependency vulnerability and license scanning in continuous integration. 9. Install and run the application as a dedicated, unprivileged operating-system account. 10. Document a controlled dependency-update and incident-response process. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This markdown file presents its title and content in Chinese from the outset, with no indication that other languages are supported or that the language choice is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The README presents the skill as a 'beginner shrimp-farming assistant' while the rest of the document describes a general AI orchestration, dashboard, credential handling, and multi-agent system. This kind of deceptive or materially misleading labeling can cause users and reviewers to underestimate the skill's capabilities and the trust boundary, increasing the chance of unsafe installation or credential exposure.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The title actively contradicts the documented implementation, which is a stronger signal than mere incompleteness because it misrepresents the skill's operational purpose. In security review contexts, contradictory identity information is dangerous because it can be used to disguise a higher-risk orchestration platform as a harmless niche assistant.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The README instructs developers to hard-code `Asia/Beijing` as the default timezone and use `zh-CN` locale formatting for date/time display. This is a natural-language policy concern because it imposes a specific language/locale choice rather than offering user selection or documenting a justified region-specific constraint.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 🔐 安全建议

1. **Token 保护**
   - Token 文件权限：`chmod 600 ~/.openclaw/workspace/.lingxi/dashboard_token.txt`
   - 不要在代码中硬编码 Token

2. **防火墙配置**

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The '一句话，全自动' activation model is overly broad and implies the system may autonomously interpret and execute a wide range of user intents with minimal constraint. In an orchestration skill that can route to tools, models, and publishing workflows, vague activation boundaries increase the chance of unintended actions, overreach, or misuse from ambiguous prompts.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Describing the user entry point as '任何渠道：QQ/微信/Telegram等' suggests the skill may be invoked from many communication channels without clearly specifying trust boundaries, authentication, or per-channel safeguards. That ambiguity is risky because the system also supports automatic task routing and multi-step execution, making unauthorized or context-confused activation more plausible.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The workflow explicitly includes generating a '性感自拍' and publishing to a social platform, yet the documentation does not present a clear user warning, consent model, or confirmation step for account-affecting actions. In context, this is more dangerous because the skill is an orchestrator designed for automatic multi-step execution, so content creation and publication may be chained together and executed with insufficient user review.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill claims it does not collect privacy while also advertising persistent multi-session memory, memory CRUD, and session context retention. That creates a misleading transparency statement that can cause users or operators to underestimate data retention and privacy risk, especially in a multi-agent system that may store prompts, outputs, and task metadata across sessions.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: This markdown file presents all troubleshooting instructions in Chinese, which can amount to a language/locale policy issue when no user opt-in or alternative language option is provided. The policy specifically calls for flagging content that forces a specific language without user choice.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The natural-language documentation and usage examples are entirely in Chinese, and the file does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context. Under the stated policy, forcing a specific language without opt-in can be a locale-policy issue.

Static analysis

No suspicious patterns detected.