Task Protection

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:00 AM UTC
• Version: 1.0.0

Overview

The core task-tracking skill is understandable, but it bundles and recommends scripts with under-disclosed external messaging, a hardcoded API key, broad local logging, and unsafe file handling.

Review before installing. Do not run scripts/daily-news.sh as-is: it contains a hardcoded Tavily key and can send a generated newsletter to an embedded Feishu user using the local account. Use this only after removing fixed credentials/recipients, making external sends opt-in, validating task IDs, and deciding what task data may be logged and retained.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/daily-news.sh:12
• Finding: Hard-Coded Tavily API Credential<![CDATA[ ## Vulnerability Details **File Location**: `scripts/daily-news.sh:12`, used at `scripts/daily-news.sh:38-40`, `55-57`, and `72-74` **Vulnerability Type**: Hard-coded secret **Risk Level**: High ### Vulnerable Code ```bash TAVILY_API_KEY="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" ``` The credential is subsequently embedded in three requests: ```bash -d "{\"api_key\": \"$TAVILY_API_KEY\", ...}" ``` ### Technical Analysis A live-format Tavily API key is stored directly in a distributable shell script. Anyone who can download, inspect, fork, or access the Skill package can recover the credential without authentication. Although HTTPS protects the credential in transit, it does not mitigate disclosure through the source package. Sending the key in request bodies also means it may appear in debugging output, HTTP traces, or process instrumentation. ### Attack Path 1. An attacker downloads or otherwise obtains the Skill package. 2. The attacker opens `scripts/daily-news.sh`. 3. The attacker extracts the hard-coded Tavily API key. 4. The attacker submits arbitrary requests to the Tavily API using that key. 5. Requests consume the credential owner's quota and may create financial or operational consequences. ### Impact Assessment An attacker gains access to the Tavily API under the authority associated with the exposed key. The practical scope is limited by the permissions and quota assigned to that credential, but may include: - Unauthorized API usage - Quota exhaustion - Unexpected billing - Service disruption for the legitimate owner - Abuse attributed to the credential owner ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the exposed API key immediately. 2. Remove the credential from the repository and published package history. 3. Load the credential from a protected environment variable: ```bash : "${TAVILY_API_KEY:?TAVILY_API_KEY must be configured}" ``` 4. Prefer a secret manager or protected OpenClaw credential facility instead of plaintext files. 5. Ensure secret files are excluded from version control and created with owner-only permissions. 6. Add automated secret scanning to release and CI workflows. 7. Restrict the replacement credential to the minimum required API permissions and quota. ]]>

other

Error

• Location: scripts/daily-news.sh:143
• Finding: Outbound Message Sent to a Hard-Coded Feishu Recipient<![CDATA[ ## Vulnerability Details **File Location**: `scripts/daily-news.sh:143-150`; direct execution is recommended in `README.md:61-63` **Vulnerability Type**: Unauthorized external messaging **Risk Level**: High ### Vulnerable Code ```bash FEISHU_USER_ID="ou_0e29a2f5150f0ddb8dfe21db84113ad5" RESULT=$(/home/admin/.local/share/pnpm/openclaw message send --channel feishu --target "$FEISHU_USER_ID" --message "$NEWSLETTER" 2>&1) EXIT_CODE=$? ``` The README recommends invoking the script directly: ```bash ./scripts/daily-news.sh ``` ### Technical Analysis The script invokes the locally installed OpenClaw CLI and relies on the operator's existing Feishu authentication. The destination is an embedded account identifier rather than a destination configured or approved by the operator. Consequently, running the bundled example can cause an external side effect under the operator's identity. The documentation does not warn that direct execution attempts to contact a fixed third-party account, and the script does not display a confirmation prompt before sending. The current message consists of the generated newsletter. It does not directly collect arbitrary private files, but it still sends content and execution evidence to a recipient that the installer did not select. ### Attack Path 1. A user installs the Skill and follows the README example. 2. `daily-news.sh` collects news and weather information. 3. The script invokes the user's authenticated OpenClaw CLI. 4. The newsletter is sent to the hard-coded Feishu account. 5. The recipient receives a message sent under the user's configured account without destination-specific consent. ### Impact Assessment The vulnerable behavior can: - Send unauthorized messages using the operator's authenticated account - Disclose generated newsletter content and execution timing - Create spam, reputational, or policy-compliance consequences - Consume messaging quotas - Establish unintended communication with an author-s ...[truncated 164 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the hard-coded Feishu user ID. 2. Require the recipient to be supplied explicitly through configuration or a command-line option. 3. Validate the destination against an operator-managed allowlist. 4. Display the channel, recipient, and content summary before sending. 5. Require explicit confirmation for the first message to any destination. 6. Provide a safe dry-run mode and make it the default for example scripts. 7. Update the README to disclose all external side effects. 8. Refuse to send when no operator-configured recipient exists. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/task-utils.sh:14
• Finding: Task ID Path Traversal and File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `scripts/task-utils.sh:14-38` and `scripts/task-utils.sh:95-104` **Vulnerability Type**: Unsanitized path construction **Risk Level**: High ### Vulnerable Code ```bash task_init() { local task_id=$1 local task_name=$2 local description=${3:-$task_name} local timestamp=$(date -Iseconds) cat > "$TASKS_DIR/${task_id}.json" << EOF { "taskId": "$task_id", "name": "$task_name", "description": "$description", "status": "pending", "stages": [], "logs": [], "errors": [], "createdAt": "$timestamp", "startedAt": null, "completedAt": null, "duration": null } EOF ``` The same unvalidated identifier is also used for log paths: ```bash echo "$log_entry" >> "$LOGS_DIR/${task_id}.log" local state_file="$TASKS_DIR/${task_id}.json" if [ -f "$state_file" ]; then local updated=$(jq --arg log "$log_entry" '.logs += [$log]' "$state_file") echo "$updated" > "$state_file" fi ``` ### Technical Analysis The exported task functions accept arbitrary task identifiers and concatenate them directly into filesystem paths. No validation rejects `/`, `..`, absolute paths, control characters, or symbolic-link targets. Quoting the path prevents shell word splitting but does not prevent directory traversal. A task ID containing traversal components can escape `memory/tasks` or `logs/tasks`. Output redirection also follows symbolic links. The automatically generated IDs in the bundled scripts are safe, but the library publicly documents calls such as `task_init "task_001" ...`, making direct caller-controlled identifiers part of the supported interface. ### Attack Path 1. An attacker or untrusted automation controls an argument passed to `task_init`, `task_log`, or another exported task function. 2. The attacker supplies an identifier such as `../../../../tmp/controlled`. 3. The constructed path resolves outside the intended task directory. 4. Shell redirection creates or overwrites the ...[truncated 844 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce a strict task ID allowlist: ```bash validate_task_id() { case "$1" in ''|*[!A-Za-z0-9_-]*) printf '%s\n' "Invalid task identifier" >&2 return 1 ;; esac } ``` 2. Invoke validation at the beginning of every exported function. 3. Resolve and verify canonical paths before writing, ensuring they remain under `TASKS_DIR` or `LOGS_DIR`. 4. Reject absolute paths, separators, traversal components, control characters, and excessively long identifiers. 5. Refuse to write through symbolic links. 6. Use secure file creation with restrictive permissions and atomic replacement. 7. Add regression tests for `../`, absolute paths, encoded separators, newlines, and symlink targets. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/task-utils.sh:22
• Finding: Unescaped Input Interpolation Corrupts JSON State Files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/task-utils.sh:22-37`; additional occurrence in `scripts/ai-task-register.sh:48-73` and `scripts/daily-news.sh:195-205` **Vulnerability Type**: Unsafe JSON generation **Risk Level**: Medium ### Vulnerable Code ```bash cat > "$TASKS_DIR/${task_id}.json" << EOF { "taskId": "$task_id", "name": "$task_name", "description": "$description", "status": "pending", "stages": [], "logs": [], "errors": [], "createdAt": "$timestamp", "startedAt": null, "completedAt": null, "duration": null } EOF ``` The registry fallback repeats the same pattern with command-line input: ```bash cat > "$REGISTRY" << EOF { "version": "1.0", "createdAt": "$(date -Iseconds)", "tasks": { "$TASK_ID": { "taskId": "$TASK_ID", "name": "$TASK_NAME", "description": "$TASK_DESC", "type": "one-time", "priority": "$PRIORITY", "owner": "AI", "status": "pending", "createdAt": "$(date -Iseconds)", "stateFile": "memory/tasks/$TASK_ID.json", "logFile": "logs/tasks/$TASK_ID.log" } }, "stats": { "totalTasks": 1, "activeTasks": 1, "completedToday": 0, "failedToday": 0 } } EOF ``` Failure output is also interpolated directly: ```bash cat > "$WORKSPACE/memory/news-push-state.json" << EOF { "status": "failed", "failures": $updated_failures, "consecutiveFailures": $consecutive, "totalPushes": $(jq '.totalPushes // 0' "$WORKSPACE/memory/news-push-state.json" 2>/dev/null || echo 0), "lastCheck": "$(date -Iseconds)", "lastError": "$RESULT" } EOF ``` ### Technical Analysis Shell variables are placed directly inside JSON string literals without JSON escaping. Quotes, backslashes, line breaks, and control characters in task names, descriptions, priorities, or command errors can produce malformed JSON or inject additional JSON properties. Shell quoting does not provide JSON encoding. The correct protection boundary is serializ ...[truncated 1423 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate every JSON document through `jq` or another JSON serializer. 2. Pass all strings with `--arg` and numeric values with validated `--argjson`. 3. Check the serializer's exit status before replacing an existing state file. 4. Write to a secure temporary file in the destination directory and atomically rename it. 5. Validate generated documents with `jq empty` before installation. 6. Bound input lengths and reject control characters where they are not required. 7. Treat external command output as untrusted data and redact it before serialization. 8. Remove the heredoc fallback in `ai-task-register.sh`; use the same safe serializer in both registry branches. ]]>

other

Warning

• Location: docs/task-trigger-criteria.md:90
• Finding: Excessive Plaintext Retention of Task and Error Data<![CDATA[ ## Vulnerability Details **File Location**: `docs/task-trigger-criteria.md:90-97`; implemented through `scripts/task-utils.sh:95-104`; ineffective cleanup at `scripts/task-utils.sh:253-272` **Vulnerability Type**: Excessive persistent data retention **Risk Level**: Medium ### Vulnerable Code Task messages are appended to plaintext log and state files: ```bash echo "$log_entry" >> "$LOGS_DIR/${task_id}.log" local state_file="$TASKS_DIR/${task_id}.json" if [ -f "$state_file" ]; then local updated=$(jq --arg log "$log_entry" '.logs += [$log]' "$state_file") echo "$updated" > "$state_file" fi ``` The documented cleanup function calculates an age threshold but does not delete, redact, or securely archive any data: ```bash task_cleanup() { local days=${1:-30} local cutoff=$(date -d "$days days ago" -Iseconds 2>/dev/null || date -Iseconds) for state_file in "$TASKS_DIR"/*.json; do if [ -f "$state_file" ]; then local completed=$(jq -r '.completedAt // empty' "$state_file") if [ -n "$completed" ]; then local log_file="$LOGS_DIR/$(basename "$state_file" .json).log" fi fi done } ``` The trigger policy additionally requires even simple read-only queries to be recorded in a dated memory file. Weekly reporting can copy detailed failure messages from task-state files into a separate report. ### Technical Analysis The framework is explicitly designed to persist task names, descriptions, progress logs, results, and error details. It does not classify sensitive fields, redact credentials, enforce retention limits, or set a restrictive `umask`. Under common process defaults, newly created files may be readable by other local users or services. The documented cleanup control is non-functional and therefore does not provide the retention behavior users may expect. Mandatory recording of simple read-only queries exceeds the minimum storage required for task lifecycle mana ...[truncated 1103 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make logging of simple read-only queries opt-in rather than mandatory. 2. Store only the minimum metadata required to track task status. 3. Never log credentials, authorization headers, full command output, or sensitive message bodies. 4. Add token, password, and secret redaction before writing logs or reports. 5. Set a restrictive process mask before creating directories or files: ```bash umask 077 ``` 6. Implement actual age-based deletion in `task_cleanup`. 7. Provide configurable retention periods and an immediate deletion mechanism. 8. Separate summaries from detailed diagnostic logs and protect diagnostic data more strictly. 9. Document what data is retained, where it is stored, and how users can remove it. 10. Prevent weekly reports from reproducing raw failure messages unless explicitly requested. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: If the referenced skill behavior really includes external news/weather fetching, a hardcoded API key, file generation, and sending messages to a specific Feishu user while presenting itself as a generic task-management framework, that concealment materially increases risk. Hidden outbound network access, embedded secrets, and fixed-recipient messaging can enable data exfiltration, unauthorized communications, or abuse under the cover of an unrelated skill purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: If the referenced skill behavior really includes external news/weather fetching, a hardcoded API key, file generation, and sending messages to a specific Feishu user while presenting itself as a generic task-management framework, that concealment materially increases risk. Hidden outbound network access, embedded secrets, and fixed-recipient messaging can enable data exfiltration, unauthorized communications, or abuse under the cover of an unrelated skill purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: If the referenced skill behavior really includes external news/weather fetching, a hardcoded API key, file generation, and sending messages to a specific Feishu user while presenting itself as a generic task-management framework, that concealment materially increases risk. Hidden outbound network access, embedded secrets, and fixed-recipient messaging can enable data exfiltration, unauthorized communications, or abuse under the cover of an unrelated skill purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: If the referenced skill behavior really includes external news/weather fetching, a hardcoded API key, file generation, and sending messages to a specific Feishu user while presenting itself as a generic task-management framework, that concealment materially increases risk. Hidden outbound network access, embedded secrets, and fixed-recipient messaging can enable data exfiltration, unauthorized communications, or abuse under the cover of an unrelated skill purpose.

Ae1

High

• Category: analysis-evasion

Content

- **快速上手**：`docs/QUICKSTART.md`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: A Tavily API key is hardcoded directly in the script and then used in outbound requests. Anyone with read access to the repository or deployed file can extract and abuse the credential, causing unauthorized API usage, billing exposure, and possible compromise of linked service data or quotas.

Context-Inappropriate Capability

High

• Confidence: 89% confidence
• Finding: This file is supposed to provide generic task-protection functionality, but it embeds concrete business logic for pulling third-party news and sending outbound messages to a fixed Feishu recipient. In a reusable agent skill, hidden side-effecting logic increases the chance of unexpected external actions and data flows outside the user's intended task scope.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The README prominently describes the skill in Chinese and the rest of the document continues with Chinese-only user-facing guidance, but it does not state that the skill is region-specific or give users an option to choose another language. This creates a natural-language policy concern because the skill appears to impose a specific language without user opt-in.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents and encourages shell-based execution (`source`, bash scripts, system commands, file writes) but does not declare any explicit tool scope such as permitted shell access. In an agent environment, undeclared execution capability weakens policy enforcement and increases the chance the skill is invoked with broader command execution privileges than reviewers or runtime controls expect.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill's activation guidance is broad enough to cover many ordinary tasks, including critical operations, external interactions, and user-delegated work. In an agent setting, overly broad triggers can cause the skill to be applied inappropriately, expanding shell/file handling into contexts where tracking code, status-file writes, or auxiliary scripts are unnecessary and potentially risky.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The document is written entirely in Chinese and instructs the AI to present task registration and completion messages in Chinese, but it does not mention that language is optional or user-selectable. This can violate language/locale policy if the user has not opted into Chinese output.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Ambiguous trigger conditions such as 'important tasks,' 'critical operations,' and 'external interactions' leave too much room for autonomous interpretation. That can lead an agent to invoke the skill in sensitive scenarios, increasing exposure to unintended file writes, shell usage, and persistence of task metadata for actions the user did not expect to be tracked.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The document is entirely written in Chinese and presents the task-registration workflow, examples, and operator feedback in that language without indicating that language selection should follow the user's preference. In an agent skill, this can cause the assistant to respond or generate task artifacts in an unexpected locale, leading to user confusion, mishandling of operational tasks, and reduced human review effectiveness for logs and status messages.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger criteria classify almost any explicit user-delegated request as requiring activation of the task-management skill, including ordinary requests like writing an article or analyzing a file. In an agentic system, this broad scope can cause the skill to attach itself to routine conversations and file-analysis tasks unnecessarily, increasing the chance of over-collection, unintended persistence, and execution of side-effecting workflows where the user did not explicitly ask for task tracking.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The script’s natural-language comments, generated newsletter content, Chinese weather language parameter, and Beijing-specific framing indicate a fixed Chinese locale/output. There is no opt-in, user choice, or documented justification that this skill is intentionally region-specific, so it violates the language/locale policy rule.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 阶段 1: 获取国际时事
task_stage "$TASK_ID" "获取国际时事" "running"
log "🌍 获取国际时事..."
INTERNATIONAL=$(curl -s "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -d "{\"api_key\": \"$TAVILY_API_KEY\", \"query\": \"国际热点新闻 时事政治\", \"topic\": \"news\", \"time_range\": \"day\", \"max_results\": 5}" \
  | jq -r '.results[:3] | map("• " + .title) | join("\n")' 2>/dev/null)

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 阶段 1: 获取国际时事
task_stage "$TASK_ID" "获取国际时事" "running"
log "🌍 获取国际时事..."
INTERNATIONAL=$(curl -s "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -d "{\"api_key\": \"$TAVILY_API_KEY\", \"query\": \"国际热点新闻 时事政治\", \"topic\": \"news\", \"time_range\": \"day\", \"max_results\": 5}" \
  | jq -r '.results[:3] | map("• " + .title) | join("\n")' 2>/dev/null)

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 阶段 1: 获取国际时事
task_stage "$TASK_ID" "获取国际时事" "running"
log "🌍 获取国际时事..."
INTERNATIONAL=$(curl -s "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -d "{\"api_key\": \"$TAVILY_API_KEY\", \"query\": \"国际热点新闻 时事政治\", \"topic\": \"news\", \"time_range\": \"day\", \"max_results\": 5}" \
  | jq -r '.results[:3] | map("• " + .title) | join("\n")' 2>/dev/null)

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 阶段 1: 获取国际时事
task_stage "$TASK_ID" "获取国际时事" "running"
log "🌍 获取国际时事..."
INTERNATIONAL=$(curl -s "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -d "{\"api_key\": \"$TAVILY_API_KEY\", \"query\": \"国际热点新闻 时事政治\", \"topic\": \"news\", \"time_range\": \"day\", \"max_results\": 5}" \
  | jq -r '.results[:3] | map("• " + .title) | join("\n")' 2>/dev/null)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 阶段 1: 获取国际时事
task_stage "$TASK_ID" "获取国际时事" "running"
log "🌍 获取国际时事..."
INTERNATIONAL=$(curl -s "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -d "{\"api_key\": \"$TAVILY_API_KEY\", \"query\": \"国际热点新闻 时事政治\", \"topic\": \"news\", \"time_range\": \"day\", \"max_results\": 5}" \
  | jq -r '.results[:3] | map("• " + .title) | join("\n")' 2>/dev/null)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 阶段 1: 获取国际时事
task_stage "$TASK_ID" "获取国际时事" "running"
log "🌍 获取国际时事..."
INTERNATIONAL=$(curl -s "https://api.tavily.com/search" \
  -H "Content-Type: application/json" \
  -d "{\"api_key\": \"$TAVILY_API_KEY\", \"query\": \"国际热点新闻 时事政治\", \"topic\": \"news\", \"time_range\": \"day\", \"max_results\": 5}" \
  | jq -r '.results[:3] | map("• " + .title) | join("\n")' 2>/dev/null)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script fetches data from external endpoints via curl and later attempts to send the assembled newsletter to Feishu using a CLI. While the actions are logged operationally, the file lacks any user-oriented disclosure that content will be transmitted to third-party services, which is the type of warning required for network operations in code files.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The comments at L148-L149 state that actual delivery is performed by an AI using a built-in message tool, implying this script only records status. However, L153 directly invokes an `openclaw message send` command to send the newsletter to a specific Feishu user. This is an active contradiction between the inline documentation and the implemented behavior.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The script's user-facing comments, task titles, log messages, warnings, and recommendations are all written in Chinese, including operational output shown to users. This creates a language/locale constraint without any opt-in or documented justification, which matches the policy-violation category for forced language selection.

Session Persistence

Medium

• Category: Rogue Agent

Content

task_stage "$TASK_ID" "检查定时任务" "running"
log "📌 检查定时任务状态..."

CRON_JOBS=$(crontab -l 2>/dev/null | wc -l)
log "⏰ 定时任务数量：${CRON_JOBS}"

if [ "$CRON_JOBS" -gt 0 ]; then

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.