Back to skill

Security audit

个人智能健康管理

Security checks for vulnerabilities and agentic risk

Overview

This health-management skill has a coherent purpose, but it handles sensitive health and messaging data with broad auto-activation, packaged credentials, unsafe shell execution, and persistent cron reminders.

Review carefully before installing. Only use this in an isolated account after removing packaged Feishu credentials and real identifiers, disabling automatic cron setup unless explicitly wanted, narrowing triggers, replacing shell=True command construction, and deciding whether health data may be stored locally or sent to Feishu/Tencent Docs.

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T06 · System Persistence

Error
Location
scripts/auto_bind_user.py:49
Finding

Automatic Installation of Persistent Cron Jobs

Content
View full analysis
> {log_file} 2>&1" # Check current cron configuration try: current_cron = subprocess.check_output( "crontab -l 2>/dev/null", shell=True ).decode("utf-8") except: current_cron = "" if "daily_health_reminder" in current_cron: print("Scheduled task already exists; skipping") else: new_cron = current_cron.strip() + "\n" + cron_line subprocess.run(f"echo '{new_cron}' | crontab -", shell=True) print("Scheduled task added for 09:00 every day") ``` `scripts/activate_health_skill.sh:68-75`: ```bash CRON_LINE="0 9 * * 1-0 $SCRIPT_PATH >> $LOG_FILE 2>&1" if crontab -l 2>/dev/null | grep -q "daily_health_reminder"; then echo "Scheduled task already exists; skipping" else (crontab -l 2>/dev/null; echo "$CRON_LINE") | crontab - echo "Scheduled task added" fi ``` `scripts/auto_bind_user.py:49-82`: ```python setup_cron = args.setup_cron if not setup_cron: try: cron_list = os.popen("crontab -l 2>/dev/null").read() except: cron_list = "" if "daily_health_reminder" not in cron_list: setup_cron = True if setup_cron: script_path = os.path.join(SCRIPT_DIR, "daily_health_reminder.py") if not os.path.exists(script_path): script_path = os.path.join(SCRIPT_DIR, "daily_health_reminder.sh") if os.path.exists(script_path): log_dir = os.path.join(SKILL_DIR, "logs") os.makedirs(log_dir, exist_ok=True) log_file = os.path.join(log_dir, "health_reminder.log") cron_line = f"0 9 * * * {script_path} >> {log_file} 2>&1" try: current_cron = subprocess.check_output( ...[truncated 2149 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/daily_health_reminder.py:26
Finding

Hard-Coded Feishu Application Credentials

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/create_online_doc.py:21
Finding

Shell Command Injection in Tencent Document Helpers

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:5
Finding

Unpinned Python and Skill Dependencies

Content
View full analysis
=0.10.0 python-docx>=0.8.11 pytesseract>=0.3.10 Pillow>=10.0.0 openpyxl>=3.1.0 pandas>=2.0.0 ``` `DEPENDENCIES.md:11-18`: ```bash openclaw skills install autoglm-browser-agent openclaw skills install autoglm-image-recognition openclaw skills install feishu-doc openclaw skills install feishu-im-read pip install -r requirements.txt -i https://pypi.tuna.tsinghua.edu.cn/simple ``` `DEPENDENCIES.md:24-31` repeats the Skill installations without versions: ```bash openclaw skills install autoglm-browser-agent openclaw skills install autoglm-image-recognition openclaw skills install feishu-doc openclaw skills install feishu-im-read pip install -r requirements.txt ``` ### Technical Analysis The Python dependencies use lower bounds rather than exact versions, and the separately installed Skills have no version or immutable digest. A new installation can therefore resolve to releases that were never reviewed with this project. No evidence establishes that the named packages or documented mirrors are currently malicious. The risk arises from uncontrolled future resolution, compromised upstream releases, account takeover, or incompatible updates. No hashes or lockfile are provided to verify artifact integrity. ### Attack Path 1. A user follows the installation documentation. 2. The package manager resolves the latest release satisfying each lower-bound constraint, while the Skill manager resolves an unspecified current release. 3. An upstream project, publishing account, registry, or mirror supplies a compromised or unexpectedly changed artifact. 4. Installation or import executes the unreviewed component with the privileges of the Skill environment. 5. The compromised dependency can access the same lo ...[truncated 529 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/indicator_extractor.py:123
Finding

Plaintext Distribution and Storage of User Identifiers and Health Data

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (124)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The requested Feishu permissions include sending messages as the user and reading/writing documents, which materially exceed the apparent needs of a health-management assistant. In a health context, these permissions are especially sensitive because they could expose private medical information, enable unauthorized propagation of content, or access unrelated workspace data.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger list includes broad, common phrases that users may mention in ordinary conversation, causing the skill to activate unexpectedly. Because activation leads to processing health content, binding user identity, and potentially scheduling recurring reminders, unintended invocation can result in privacy-impacting actions without clear consent.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly states that any health-related natural language can trigger automatic activation, making the invocation boundary effectively undefined. This is dangerous because casual mention of symptoms, reports, or wellness topics could initiate data collection and automated actions involving sensitive health information.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The description says any health issue mention will auto-activate the skill without exclusions, which is especially risky given the medical context and automated follow-up behavior. This broad matching can cause accidental enrollment, unnecessary processing of private health data, and unsolicited reminders or records being created.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The shell-enabled subprocess call broadens command execution semantics beyond what is needed and can be influenced by environment details such as PATH or shell configuration. While the command string is static, this still represents unsafe tool invocation practice and is more concerning because it is part of persistence-related setup.

Content

Scanner excerpt · scripts/activate_health_skill.py (reported line 74)May include surrounding context.

python
# 检查当前 cron
try:
    current_cron = subprocess.check_output("crontab -l 2>/dev/null", shell=True).decode("utf-8")
except:
    current_cron = ""

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
93% confidence
Finding

This tool invocation passes dynamically assembled cron content through a shell pipeline, combining shell parsing with persistent system modification. If any embedded value contains shell-breaking characters or malformed content, the result can be command injection, corrupted crontab state, or installation of unintended scheduled commands.

Content

Scanner excerpt · scripts/activate_health_skill.py (reported line 83)May include surrounding context.

python
else:
    # 添加 cron
    new_cron = current_cron.strip() + "\n" + cron_line
    subprocess.run(f"echo '{new_cron}' | crontab -", shell=True)
    print("✅ 已添加定时任务:每天 9:00 自动推送")

print()

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
88% confidence
Finding

The script executes another file through os.system, which invokes a shell unnecessarily. Even though script_path is locally derived, shell execution increases exposure to path-handling edge cases and makes behavior dependent on the shell environment; if the path or environment is manipulated, unintended commands may run.

Content

Scanner excerpt · scripts/activate_health_skill.py (reported line 99)May include surrounding context.

python
if test_choice == "y":
    if feishu_user_id:
        print("发送测试消息...")
        os.system(f'"{script_path}"')
    else:
        print("⚠️ 未配置用户 ID,无法发送测试消息")
else:

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/auto_bind_user.py (reported line 54)May include surrounding context.

python
if not setup_cron:
        # 检查 cron 是否已存在
        try:
            cron_list = os.popen("crontab -l 2>/dev/null").read()
        except:
            cron_list = ""

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/auto_bind_user.py (reported line 91)May include surrounding context.

python
if not setup_cron:
        # 检查 cron 是否已存在
        try:
            cron_list = os.popen("crontab -l 2>/dev/null").read()
        except:
            cron_list = ""

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/auto_bind_user.py (reported line 76)May include surrounding context.

python
# 添加 cron
            try:
                current_cron = subprocess.check_output("crontab -l 2>/dev/null", shell=True).decode("utf-8")
            except:
                current_cron = ""

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The command passes new_cron through a shell pipeline, so existing crontab content effectively becomes a shell parameter. If that content includes quotes or shell syntax, an attacker who can influence the crontab can abuse this script to execute arbitrary commands under the current user while rewriting cron. Because the skill also installs persistence automatically, exploitation can both execute code and establish recurring execution.

Content

Scanner excerpt · scripts/auto_bind_user.py (reported line 82)May include surrounding context.

python
if "daily_health_reminder" not in current_cron:
                new_cron = current_cron.strip() + "\n" + cron_line
                subprocess.run(f"echo '{new_cron}' | crontab -", shell=True)
                print("✅ 定时任务已配置:每天 9:00 自动推送")
            else:
                print("✅ 定时任务已存在")

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

This is a concrete tool-parameter abuse path: attacker-controlled parameters are embedded into a shell command that invokes mcporter, so crafted input can alter the command line before the intended tool call occurs. In the skill context, users may naturally supply rich text health notes, making it realistic for malicious payloads to be smuggled through content fields and trigger arbitrary command execution or unintended tool actions.

Content

Scanner excerpt · scripts/create_online_doc.py (reported line 24)May include surrounding context.

python
def run_mcporter(service, tool, args):
    """执行mcporter命令"""
    cmd = f'mcporter call {service} {tool} --args \'{json.dumps(args)}\''
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    return result.stdout, result.stderr

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Hardcoded application credentials are used for external API authentication without any user disclosure or secure handling. This creates both a secret-exposure risk and an unauthorized-use risk, since recipients of the skill can reuse the credentials to impersonate the application and access Feishu APIs within the granted scope.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/daily_health_reminder.sh (reported line 41)May include surrounding context.

sh
fi

# 2. 获取飞书 token
TOKEN_RESPONSE=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
    -H "Content-Type: application/json" \
    -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/daily_health_reminder.sh (reported line 92)May include surrounding context.

sh
# 4. 发送消息
echo "发送运动提醒给用户: $FEISHU_USER_ID"

SEND_RESPONSE=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
    -H "Authorization: Bearer $ACCESS_TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"receive_id\":\"$FEISHU_USER_ID\",\"msg_type\":\"text\",\"content\":$MESSAGE}")

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

This is a direct tool-parameter abuse pattern: the code forwards user-controlled values into a shell command that calls an external tool with powerful document-editing capability. In this skill context, the risk is amplified because health-related input and a document ID are accepted from the command line, so a crafted value could trigger unintended shell behavior or tamper with external records.

Content

Scanner excerpt · scripts/update_record.py (reported line 24)May include surrounding context.

python
def run_mcporter(service, tool, args):
    """执行mcporter命令"""
    cmd = f'mcporter call {service} {tool} --args \'{json.dumps(args)}\''
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    return result.stdout, result.stderr

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documented dependencies include Feishu document access and message-reading capabilities that are not clearly necessary for a health-management skill based on the stated triggers. Excess integration breadth increases the attack surface and could enable access to user communications or documents unrelated to health tracking if the skill later invokes those capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly performs proactive IM messaging on a schedule and updates a session/state file, but the description does not indicate any prior user consent, opt-in, disclosure, or easy opt-out. In an agent context, autonomous outbound messaging and persistent state updates can surprise users, create privacy concerns, and normalize background actions the user did not knowingly authorize.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 23)May include surrounding context.

text
**Linux:**
```bash
sudo apt-get install tesseract-ocr poppler-utils

三、使用方法

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation section lists short, generic phrases such as "健康数据", "运动计划", and especially "打卡", which are common everyday expressions and do not clearly distinguish when the skill should activate versus when the user is speaking generally. The file also lacks exclusion conditions or negative examples, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README promotes online sync, cloud document creation, and sharing of health-tracking data through Tencent Docs without clearly warning that personal health information may be transmitted to and stored by a third-party service. Health data is especially sensitive, so users may unknowingly expose medical indicators, exercise logs, and related personal information to external storage, sharing links, or broader access settings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README instructs users to export a Tencent Docs token but does not describe it as a sensitive credential, nor warn against committing it to shell history, screenshots, shared terminals, or documentation. Because this skill manages health-related records and cloud document creation, token exposure could let an attacker access or manipulate linked Tencent Docs resources.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill describes capabilities that imply access to environment data, local files, shell execution, and scheduled task setup, but it does not declare any explicit tool scope or permissions boundary. In a health-focused skill that handles sensitive medical data and can auto-configure cron jobs, this ambiguity increases the risk of over-privileged execution, unauthorized file access, and unsafe command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill indicates it will automatically obtain the user's ID from message context and configure scheduled reminders, but it does not present a clear prior warning or consent step. In a health-management workflow, silent identifier collection and recurring automation can violate user expectations and create privacy and compliance risks.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.