Security audit

Task Protection

Security checks for vulnerabilities and agentic risk

Overview

The core task-tracking skill is understandable, but it bundles and recommends scripts with under-disclosed external messaging, a hardcoded API key, broad local logging, and unsafe file handling.

Review before installing. Do not run scripts/daily-news.sh as-is: it contains a hardcoded Tavily key and can send a generated newsletter to an embedded Feishu user using the local account. Use this only after removing fixed credentials/recipients, making external sends opt-in, validating task IDs, and deciding what task data may be logged and retained.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/daily-news.sh:12
Finding: Hard-Coded Tavily API Credential
Content: View full analysis
Remediation: View remediation

other

Error

Location: scripts/daily-news.sh:143
Finding: Outbound Message Sent to a Hard-Coded Feishu Recipient
Content: View full analysis
&1) EXIT_CODE=$? ``` The README recommends invoking the script directly: ```bash ./scripts/daily-news.sh ``` ### Technical Analysis The script invokes the locally installed OpenClaw CLI and relies on the operator's existing Feishu authentication. The destination is an embedded account identifier rather than a destination configured or approved by the operator. Consequently, running the bundled example can cause an external side effect under the operator's identity. The documentation does not warn that direct execution attempts to contact a fixed third-party account, and the script does not display a confirmation prompt before sending. The current message consists of the generated newsletter. It does not directly collect arbitrary private files, but it still sends content and execution evidence to a recipient that the installer did not select. ### Attack Path 1. A user installs the Skill and follows the README example. 2. `daily-news.sh` collects news and weather information. 3. The script invokes the user's authenticated OpenClaw CLI. 4. The newsletter is sent to the hard-coded Feishu account. 5. The recipient receives a message sent under the user's configured account without destination-specific consent. ### Impact Assessment The vulnerable behavior can: - Send unauthorized messages using the operator's authenticated account - Disclose generated newsletter content and execution timing - Create spam, reputational, or policy-compliance consequences - Consume messaging quotas - Establish unintended communication with an author-s ...[truncated 164 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/task-utils.sh:14
Finding: Task ID Path Traversal and File Overwrite
Content: View full analysis
"$TASKS_DIR/${task_id}.json" << EOF { "taskId": "$task_id", "name": "$task_name", "description": "$description", "status": "pending", "stages": [], "logs": [], "errors": [], "createdAt": "$timestamp", "startedAt": null, "completedAt": null, "duration": null } EOF ``` The same unvalidated identifier is also used for log paths: ```bash echo "$log_entry" >> "$LOGS_DIR/${task_id}.log" local state_file="$TASKS_DIR/${task_id}.json" if [ -f "$state_file" ]; then local updated=$(jq --arg log "$log_entry" '.logs += [$log]' "$state_file") echo "$updated" > "$state_file" fi ``` ### Technical Analysis The exported task functions accept arbitrary task identifiers and concatenate them directly into filesystem paths. No validation rejects `/`, `..`, absolute paths, control characters, or symbolic-link targets. Quoting the path prevents shell word splitting but does not prevent directory traversal. A task ID containing traversal components can escape `memory/tasks` or `logs/tasks`. Output redirection also follows symbolic links. The automatically generated IDs in the bundled scripts are safe, but the library publicly documents calls such as `task_init "task_001" ...`, making direct caller-controlled identifiers part of the supported interface. ### Attack Path 1. An attacker or untrusted automation controls an argument passed to `task_init`, `task_log`, or another exported task function. 2. The attacker supplies an identifier such as `../../../../tmp/controlled`. 3. The constructed path resolves outside the intended task directory. 4. Shell redirection creates or overwrites the ...[truncated 844 chars]
Remediation: View remediation
&2 return 1 ;; esac } ``` 2. Invoke validation at the beginning of every exported function. 3. Resolve and verify canonical paths before writing, ensuring they remain under `TASKS_DIR` or `LOGS_DIR`. 4. Reject absolute paths, separators, traversal components, control characters, and excessively long identifiers. 5. Refuse to write through symbolic links. 6. Use secure file creation with restrictive permissions and atomic replacement. 7. Add regression tests for `../`, absolute paths, encoded separators, newlines, and symlink targets. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/task-utils.sh:22
Finding: Unescaped Input Interpolation Corrupts JSON State Files
Content: View full analysis
"$TASKS_DIR/${task_id}.json" << EOF { "taskId": "$task_id", "name": "$task_name", "description": "$description", "status": "pending", "stages": [], "logs": [], "errors": [], "createdAt": "$timestamp", "startedAt": null, "completedAt": null, "duration": null } EOF ``` The registry fallback repeats the same pattern with command-line input: ```bash cat > "$REGISTRY" << EOF { "version": "1.0", "createdAt": "$(date -Iseconds)", "tasks": { "$TASK_ID": { "taskId": "$TASK_ID", "name": "$TASK_NAME", "description": "$TASK_DESC", "type": "one-time", "priority": "$PRIORITY", "owner": "AI", "status": "pending", "createdAt": "$(date -Iseconds)", "stateFile": "memory/tasks/$TASK_ID.json", "logFile": "logs/tasks/$TASK_ID.log" } }, "stats": { "totalTasks": 1, "activeTasks": 1, "completedToday": 0, "failedToday": 0 } } EOF ``` Failure output is also interpolated directly: ```bash cat > "$WORKSPACE/memory/news-push-state.json" << EOF { "status": "failed", "failures": $updated_failures, "consecutiveFailures": $consecutive, "totalPushes": $(jq '.totalPushes // 0' "$WORKSPACE/memory/news-push-state.json" 2>/dev/null || echo 0), "lastCheck": "$(date -Iseconds)", "lastError": "$RESULT" } EOF ``` ### Technical Analysis Shell variables are placed directly inside JSON string literals without JSON escaping. Quotes, backslashes, line breaks, and control characters in task names, descriptions, priorities, or command errors can produce malformed JSON or inject additional JSON properties. Shell quoting does not provide JSON encoding. The correct protection boundary is serializ ...[truncated 1423 chars]
Remediation: View remediation

other

Warning

Location: docs/task-trigger-criteria.md:90
Finding: Excessive Plaintext Retention of Task and Error Data
Content: View full analysis
> "$LOGS_DIR/${task_id}.log" local state_file="$TASKS_DIR/${task_id}.json" if [ -f "$state_file" ]; then local updated=$(jq --arg log "$log_entry" '.logs += [$log]' "$state_file") echo "$updated" > "$state_file" fi ``` The documented cleanup function calculates an age threshold but does not delete, redact, or securely archive any data: ```bash task_cleanup() { local days=${1:-30} local cutoff=$(date -d "$days days ago" -Iseconds 2>/dev/null || date -Iseconds) for state_file in "$TASKS_DIR"/*.json; do if [ -f "$state_file" ]; then local completed=$(jq -r '.completedAt // empty' "$state_file") if [ -n "$completed" ]; then local log_file="$LOGS_DIR/$(basename "$state_file" .json).log" fi fi done } ``` The trigger policy additionally requires even simple read-only queries to be recorded in a dated memory file. Weekly reporting can copy detailed failure messages from task-state files into a separate report. ### Technical Analysis The framework is explicitly designed to persist task names, descriptions, progress logs, results, and error details. It does not classify sensitive fields, redact credentials, enforce retention limits, or set a restrictive `umask`. Under common process defaults, newly created files may be readable by other local users or services. The documented cleanup control is non-functional and therefore does not provide the retention behavior users may expect. Mandatory recording of simple read-only queries exceeds the minimum storage required for task lifecycle mana ...[truncated 1103 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (37)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the referenced skill behavior really includes external news/weather fetching, a hardcoded API key, file generation, and sending messages to a specific Feishu user while presenting itself as a generic task-management framework, that concealment materially increases risk. Hidden outbound network access, embedded secrets, and fixed-recipient messaging can enable data exfiltration, unauthorized communications, or abuse under the cover of an unrelated skill purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the referenced skill behavior really includes external news/weather fetching, a hardcoded API key, file generation, and sending messages to a specific Feishu user while presenting itself as a generic task-management framework, that concealment materially increases risk. Hidden outbound network access, embedded secrets, and fixed-recipient messaging can enable data exfiltration, unauthorized communications, or abuse under the cover of an unrelated skill purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: If the referenced skill behavior really includes external news/weather fetching, a hardcoded API key, file generation, and sending messages to a specific Feishu user while presenting itself as a generic task-management framework, that concealment materially increases risk. Hidden outbound network access, embedded secrets, and fixed-recipient messaging can enable data exfiltration, unauthorized communications, or abuse under the cover of an unrelated skill purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: If the referenced skill behavior really includes external news/weather fetching, a hardcoded API key, file generation, and sending messages to a specific Feishu user while presenting itself as a generic task-management framework, that concealment materially increases risk. Hidden outbound network access, embedded secrets, and fixed-recipient messaging can enable data exfiltration, unauthorized communications, or abuse under the cover of an unrelated skill purpose.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 391)May include surrounding context.
md
- **快速上手**：`docs/QUICKSTART.md`

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A Tavily API key is hardcoded directly in the script and then used in outbound requests. Anyone with read access to the repository or deployed file can extract and abuse the credential, causing unauthorized API usage, billing exposure, and possible compromise of linked service data or quotas.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This file is supposed to provide generic task-protection functionality, but it embeds concrete business logic for pulling third-party news and sending outbound messages to a fixed Feishu recipient. In a reusable agent skill, hidden side-effecting logic increases the chance of unexpected external actions and data flows outside the user's intended task scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README prominently describes the skill in Chinese and the rest of the document continues with Chinese-only user-facing guidance, but it does not state that the skill is region-specific or give users an option to choose another language. This creates a natural-language policy concern because the skill appears to impose a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documents and encourages shell-based execution (source, bash scripts, system commands, file writes) but does not declare any explicit tool scope such as permitted shell access. In an agent environment, undeclared execution capability weakens policy enforcement and increases the chance the skill is invoked with broader command execution privileges than reviewers or runtime controls expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill's activation guidance is broad enough to cover many ordinary tasks, including critical operations, external interactions, and user-delegated work. In an agent setting, overly broad triggers can cause the skill to be applied inappropriately, expanding shell/file handling into contexts where tracking code, status-file writes, or auxiliary scripts are unnecessary and potentially risky.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document is written entirely in Chinese and instructs the AI to present task registration and completion messages in Chinese, but it does not mention that language is optional or user-selectable. This can violate language/locale policy if the user has not opted into Chinese output.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Ambiguous trigger conditions such as 'important tasks,' 'critical operations,' and 'external interactions' leave too much room for autonomous interpretation. That can lead an agent to invoke the skill in sensitive scenarios, increasing exposure to unintended file writes, shell usage, and persistence of task metadata for actions the user did not expect to be tracked.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document is entirely written in Chinese and presents the task-registration workflow, examples, and operator feedback in that language without indicating that language selection should follow the user's preference. In an agent skill, this can cause the assistant to respond or generate task artifacts in an unexpected locale, leading to user confusion, mishandling of operational tasks, and reduced human review effectiveness for logs and status messages.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger criteria classify almost any explicit user-delegated request as requiring activation of the task-management skill, including ordinary requests like writing an article or analyzing a file. In an agentic system, this broad scope can cause the skill to attach itself to routine conversations and file-analysis tasks unnecessarily, increasing the chance of over-collection, unintended persistence, and execution of side-effecting workflows where the user did not explicitly ask for task tracking.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script’s natural-language comments, generated newsletter content, Chinese weather language parameter, and Beijing-specific framing indicate a fixed Chinese locale/output. There is no opt-in, user choice, or documented justification that this skill is intentionally region-specific, so it violates the language/locale policy rule.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/daily-news.sh (reported line 38)May include surrounding context.
sh
# 阶段 1: 获取国际时事 task_stage "$TASK_ID" "获取国际时事" "running" log "🌍 获取国际时事..." INTERNATIONAL=$(curl -s "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -d "{\"api_key\": \"$TAVILY_API_KEY\", \"query\": \"国际热点新闻时事政治\", \"topic\": \"news\", \"time_range\": \"day\", \"max_results\": 5}" \ | jq -r '.results[:3] | map("• " + .title) | join("\n")' 2>/dev/null)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/daily-news.sh (reported line 55)May include surrounding context.
sh
# 阶段 1: 获取国际时事 task_stage "$TASK_ID" "获取国际时事" "running" log "🌍 获取国际时事..." INTERNATIONAL=$(curl -s "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -d "{\"api_key\": \"$TAVILY_API_KEY\", \"query\": \"国际热点新闻时事政治\", \"topic\": \"news\", \"time_range\": \"day\", \"max_results\": 5}" \ | jq -r '.results[:3] | map("• " + .title) | join("\n")' 2>/dev/null)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/daily-news.sh (reported line 72)May include surrounding context.
sh
# 阶段 1: 获取国际时事 task_stage "$TASK_ID" "获取国际时事" "running" log "🌍 获取国际时事..." INTERNATIONAL=$(curl -s "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -d "{\"api_key\": \"$TAVILY_API_KEY\", \"query\": \"国际热点新闻时事政治\", \"topic\": \"news\", \"time_range\": \"day\", \"max_results\": 5}" \ | jq -r '.results[:3] | map("• " + .title) | join("\n")' 2>/dev/null)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/daily-news.sh (reported line 38)May include surrounding context.
sh
# 阶段 1: 获取国际时事 task_stage "$TASK_ID" "获取国际时事" "running" log "🌍 获取国际时事..." INTERNATIONAL=$(curl -s "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -d "{\"api_key\": \"$TAVILY_API_KEY\", \"query\": \"国际热点新闻时事政治\", \"topic\": \"news\", \"time_range\": \"day\", \"max_results\": 5}" \ | jq -r '.results[:3] | map("• " + .title) | join("\n")' 2>/dev/null)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/daily-news.sh (reported line 55)May include surrounding context.
sh
# 阶段 1: 获取国际时事 task_stage "$TASK_ID" "获取国际时事" "running" log "🌍 获取国际时事..." INTERNATIONAL=$(curl -s "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -d "{\"api_key\": \"$TAVILY_API_KEY\", \"query\": \"国际热点新闻时事政治\", \"topic\": \"news\", \"time_range\": \"day\", \"max_results\": 5}" \ | jq -r '.results[:3] | map("• " + .title) | join("\n")' 2>/dev/null)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/daily-news.sh (reported line 72)May include surrounding context.
sh
# 阶段 1: 获取国际时事 task_stage "$TASK_ID" "获取国际时事" "running" log "🌍 获取国际时事..." INTERNATIONAL=$(curl -s "https://api.tavily.com/search" \ -H "Content-Type: application/json" \ -d "{\"api_key\": \"$TAVILY_API_KEY\", \"query\": \"国际热点新闻时事政治\", \"topic\": \"news\", \"time_range\": \"day\", \"max_results\": 5}" \ | jq -r '.results[:3] | map("• " + .title) | join("\n")' 2>/dev/null)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script fetches data from external endpoints via curl and later attempts to send the assembled newsletter to Feishu using a CLI. While the actions are logged operationally, the file lacks any user-oriented disclosure that content will be transmitted to third-party services, which is the type of warning required for network operations in code files.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The comments at L148-L149 state that actual delivery is performed by an AI using a built-in message tool, implying this script only records status. However, L153 directly invokes an openclaw message send command to send the newsletter to a specific Feishu user. This is an active contradiction between the inline documentation and the implemented behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's user-facing comments, task titles, log messages, warnings, and recommendations are all written in Chinese, including operational output shown to users. This creates a language/locale constraint without any opt-in or documented justification, which matches the policy-violation category for forced language selection.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/system-health-check.sh (reported line 120)May include surrounding context.
sh
task_stage "$TASK_ID" "检查定时任务" "running" log "📌 检查定时任务状态..." CRON_JOBS=$(crontab -l 2>/dev/null | wc -l) log "⏰ 定时任务数量：${CRON_JOBS}" if [ "$CRON_JOBS" -gt 0 ]; then