Security audit

报表官-分析

Security checks for vulnerabilities and agentic risk

Overview

This report-analysis skill is purpose-aligned, but it sends sensitive business files and an OpenClaw token to an undefined backend without enough user-control or destination detail.

Install only if you trust the backend environment that resolves `/api/analyze` and `/api/visualize`. Before using it with confidential reports, confirm where files are sent, how the OpenClaw token is scoped, whether request bodies are logged, and whether users get an explicit confirmation before upload.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:68
Finding: Undefined Backend May Receive Sensitive Business Files and an OpenClaw Token
Content: View full analysis
", "source_tool": "excel" } ], "question": "Why did profit in the North China region decrease by 15% this quarter?", "business_context": "(optional)", "target_tool": "excel" } If the user requests a chart, POST the returned `viz_specs` to `/api/visualize`. ``` ### Technical Analysis The skill documentation directs the agent to transmit complete user-provided business reports, natural-language business context, and an OpenClaw token to `/api/analyze`. It only identifies the service through a relative path and does not define or pin a trusted HTTPS origin. Consequently, the effective recipient depends on host or runtime configuration that is not present in the reviewed project. The documentation also does not specify: - TLS and certificate-validation requirements. - Redirect restrictions. - The required scope or lifetime of the OpenClaw token. - A user-consent checkpoint before transmitting files. - Data minimization or redaction requirements. - Enforceable server-side retention and deletion controls. - Whether the token must be excluded from application logs and request traces. Embedding a file in base64 does not protect its confidentiality. Base64 is a reversible encoding and provides no encryption or recipient authentication. Fur ...[truncated 2235 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The description says users should ask business questions "用中文", which imposes a language requirement. The file does not offer an opt-in language choice or clearly document why Chinese-only input is required as a justified locale constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description says files are uploaded and analyzed but does not clearly warn users that the contents are transmitted to backend APIs, despite later documenting a POST request carrying base64-encoded file data. For a CFO/report-analysis skill handling financial and HR data, this omission undermines informed consent and can expose sensitive enterprise information to external processing without a sufficiently prominent disclosure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The natural-language triggers are broad enough that ordinary conversation like '分析一下' or '为什么...' after a file upload could invoke the skill without the user clearly intending to send business data for backend analysis. In this skill, invocation causes uploaded spreadsheet contents to be base64-embedded and transmitted to /api/analyze, so accidental triggering can lead to unintended processing and disclosure of sensitive business data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.