ClawHub
Back to skill

Security audit

Diataxis Writing

Security checks for vulnerabilities and agentic risk

Overview

This documentation skill is mostly coherent, but it includes under-controlled local file writing and external publishing paths that users should review before installing.

Install only if you are comfortable with a documentation skill that can guide agents toward local file writes and external publishing. Prefer chat-only output unless you explicitly need Feishu, GitHub, Notion, or Google Docs; review destination, repository visibility, and content sensitivity before any export; avoid the unpinned npx examples; and do not use the bundled local output helper with untrusted filenames until path containment and overwrite protection are fixed.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T08 · Insecure Dependencies

Error
Location
SKILL.md:191
Finding

Unpinned Third-Party Packages May Be Downloaded and Executed Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:191-196; related configuration examples in references/output-platforms.md:35-45, references/output-platforms.md:110-120, references/output-platforms.md:156-163, and references/output-platforms.md:185-192
Vulnerability Type: Unpinned runtime dependency execution
Risk Level: High

Vulnerable Code

bash
- **Feishu (MCP)** → Use mcporter to call Feishu MCP server
  ```bash
  node /path/to/mcporter/dist/cli.js call feishu doc.create '{"title":"...", "content":"..."}'
  # Note: mcporter path varies by installation, common paths:
  # - ~/.npm/_npx/*/node_modules/mcporter/dist/cli.js
  # - Or use: npx mcporter call feishu doc.create ...
  ```

A related MCP configuration example downloads packages without a pinned version:

json
{
  "mcpServers": {
    "feishu": {
      "command": "npx",
      "args": ["-y", "mcp-server-feishu"],
      "env": {
        "FEISHU_APP_ID": "your_app_id",
        "FEISHU_APP_SECRET": "your_app_secret"
      }
    }
  }
}

Equivalent unpinned npx -y patterns are documented for the GitHub, Notion, and Google MCP servers.

Technical Analysis

The documented workflow allows npx to retrieve and execute the currently published version of a package at runtime. Neither an exact package version nor an integrity hash is specified. The -y option also suppresses the normal installation confirmation.

Consequently, the code executed by the Agent is not fully represented by the audited project. Its behavior can change after review if a package is compromised, transferred to a malicious maintainer, replaced, or unexpectedly updated. npm package installation and runtime code execute with the privileges and environment of the invoking Agent process.

Attack Path

  1. A user selects an MCP-backed output platform.
  2. The Agent follows the documented configuration or invocation using npx or ...[truncated 938 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every npm dependency to an exact reviewed version, such as package-name@1.2.3.
  2. Install dependencies during a controlled build step rather than retrieving them dynamically during skill execution.
  3. Commit and enforce a lockfile with npm integrity hashes.
  4. Use a trusted registry, package allowlist, and dependency provenance or signature verification.
  5. Remove npx -y from operational instructions so package installation cannot occur silently.
  6. Run MCP servers in a sandbox with minimal filesystem, environment, credential, and network access.
  7. Periodically scan pinned packages and require security review before upgrading them.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/output-handler.py:214
Finding

Path Traversal Allows Writes Outside the Intended Documentation Directory

Content
View full analysis

Vulnerability Details

File Location: scripts/output-handler.py:214-226
Vulnerability Type: Path traversal and arbitrary writable Markdown file overwrite
Risk Level: High

Vulnerable Code

python
def _output_local(self, content: str, filename: str) -> bool:
    """输出到本地文件"""
    try:
        # 确保目录存在
        base_dir = Path('/root/.openclaw/workspace/docs')
        base_dir.mkdir(parents=True, exist_ok=True)
        
        # 生成文件名
        if not filename.endswith('.md'):
            filename += '.md'
        
        file_path = base_dir / filename
        
        # 写入文件
        with open(file_path, 'w', encoding='utf-8') as f:
            f.write(content)

The externally supplied path reaches this method through the command-line interface:

python
success = handler.execute_output(
    args.output, 
    args.content, 
    args.title,
    args.path
)

Technical Analysis

The filename value originates from the CLI-controlled --path or --title argument and is joined with base_dir without canonicalization or containment validation.

Python's pathlib does not automatically confine joined paths to the first path component. An absolute path discards the preceding base directory, while traversal components such as ../ can resolve outside it. The only restriction is that .md is appended when the value does not already end with that extension.

The destination is opened with mode w, which creates a new file or truncates and replaces an existing file. Therefore, an attacker who can influence the output filename and content can overwrite any writable target whose final filename can end in .md.

Attack Path

  1. An attacker causes the local output method to be selected.
  2. The attacker supplies a filename such as ../../skills/target/SKILL.md or an absolute writable path ending in .md.
  3. _output_local combines the untrusted value w ...[truncated 764 chars]
Remediation
View remediation

Remediation Suggestions

  1. Treat the supplied value as a filename only and reject directory separators.
  2. Reject absolute paths and any path containing .. components.
  3. Resolve both the base and destination paths and verify containment before writing:
    python
    base_dir = Path('/root/.openclaw/workspace/docs').resolve()
safe_name = Path(filename).name
if safe_name != filename or not safe_name.endswith('.md'):
    raise ValueError("Invalid Markdown filename")

file_path = (base_dir / safe_name).resolve()
if file_path.parent != base_dir:
    raise ValueError("Output path escapes the documentation directory")
  4. If subdirectories are required, use Path.is_relative_to(base_dir) on the resolved destination and enforce an explicit subdirectory allowlist.
  5. Avoid unconditional truncation. Require explicit overwrite approval or use exclusive creation mode where appropriate.
  6. Consider rejecting symbolic-link destinations or opening files with platform-specific no-follow protections to prevent symlink-based escapes.
  7. Add tests for absolute paths, traversal sequences, nested traversal, symbolic links, and encoded path separators.

T05 · Unauthorized Access and Privilege Escalation

Note
Location
scripts/output-handler.py:98
Finding

Routine Tool Detection Reads a Privileged Credential-Bearing MCP Configuration

Content
View full analysis

Vulnerability Details

File Location: scripts/output-handler.py:98-127; workflow requirement in SKILL.md:39-42
Vulnerability Type: Excessive access to sensitive integration configuration
Risk Level: Low

Vulnerable Code

python
def _check_feishu_mcp(self) -> bool:
    """检查飞书 MCP 是否可用"""
    try:
        # 检查 mcporter.json 配置
        if os.path.exists(self.mcp_config_path):
            with open(self.mcp_config_path, 'r') as f:
                config = json.load(f)
                mcp_servers = config.get('mcpServers', {})
                if 'feishu' in mcp_servers:
                    feishu_config = mcp_servers['feishu']
                    # 检查是否有 baseUrl 或 command
                    if 'baseUrl' in feishu_config or 'command' in feishu_config:
                        return True
        return False
    except Exception as e:
        print(f"检查飞书 MCP 配置失败：{e}")
        return False

def _detect_mcp_servers(self) -> List[str]:
    """检测已配置的 MCP 服务器"""
    servers = []
    
    try:
        if os.path.exists(self.mcp_config_path):
            with open(self.mcp_config_path, 'r') as f:
                config = json.load(f)
                mcp_servers = config.get('mcpServers', {})
                servers = list(mcp_servers.keys())
    except Exception as e:
        print(f"读取 MCP 配置失败：{e}")
    
    return servers

The path is hardcoded during initialization:

python
def __init__(self):
    self.available_tools = {}
    self.mcp_config_path = "/root/config/mcporter.json"

Technical Analysis

Tool detection parses the complete /root/config/mcporter.json file merely to determine which MCP servers exist and whether the Feishu entry contains baseUrl or command. MCP configuration files may contain authentication tokens, application secrets, credential paths, or credential-bearing environment variables.

The current implementation ...[truncated 1532 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make MCP capability detection opt-in rather than mandatory for ordinary documentation generation.
  2. Use a dedicated non-secret capability endpoint or sanitized server inventory instead of parsing the credential-bearing configuration.
  3. Split server metadata from secrets and store credentials in a system secret manager or protected environment.
  4. Run detection with the least-privileged account capable of reading only the sanitized inventory.
  5. Avoid retaining the complete configuration object after extracting the required server names.
  6. Ensure exceptions and diagnostic logs never include configuration contents.
  7. Document and enforce restrictive filesystem permissions for MCP configuration and credential files.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (33)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is presented as a documentation-writing guide, but it also directs environment probing, local file writes, GitHub publication, and Feishu document creation. This mismatch is dangerous because users and policy systems may trust the skill as low-risk content guidance while it actually enables side effects and external data transfer.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/output-platforms.md (reported line 190)May include surrounding context.

md
"command": "npx",
      "args": ["-y", "mcp-server-google"],
      "env": {
        "GOOGLE_APPLICATION_CREDENTIALS": "/path/to/credentials.json"
      }
    }
  }

Instruction Override

High
Category
Prompt Injection
Confidence
70% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/writing-language.md (reported line 174)May include surrounding context.

md
Port to listen on. Valid range: 1-65535.

**debug** (boolean, default: False)
    Enable debug mode. Must be True or False.

### Return Value

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file implements local file writing and external publishing operations that exceed the advertised purpose of a Diataxis writing guide. Capability creep is dangerous in agent skills because users may invoke what appears to be advisory functionality while unknowingly granting the skill the ability to modify files or send data to external systems.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

Feishu document creation is an outbound publishing action unrelated to a practice guide for documentation frameworks, making the mismatch especially risky in an agent context. This can be used to exfiltrate generated or user-provided content to an external service under the guise of normal documentation assistance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README advertises very broad automatic trigger conditions such as generic documentation and knowledge-sharing requests, which can cause the skill to activate outside the user's intended scope. While this is not directly code execution, over-triggering can lead to inappropriate context capture, unexpected behavior, or steering users into workflows they did not explicitly request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The README states that the skill supports writing to local Markdown files, Feishu documents, and GitHub repositories, but it does not warn users about possible data disclosure, persistence, or external transmission. In a documentation skill, users may provide sensitive internal content, so exporting it to local or third-party destinations without prominent notice increases the risk of accidental leakage.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill instructs the agent to read/write files and execute shell commands, but the manifest does not declare any explicit tool scope or permissions boundary. This creates an implicit capability expansion where a user may invoke a seemingly harmless writing guide that actually performs filesystem and command execution operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instructions direct the agent to execute local Python commands and inspect local configuration files to detect tools and server settings, even though the skill's primary purpose is documentation guidance. This unnecessarily exposes local environment details and increases attack surface for reconnaissance and unintended disclosure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes a writing/practice guide, but the skill also instructs the agent to publish content to external services and repositories. This broadens the trust boundary from local content assistance to external transmission and modification of persistent systems, which users may not reasonably expect.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill includes GitHub, Feishu, and other platform integration flows unrelated to the core Diataxis guidance function. These integrations increase the chance of data exfiltration, unintended publication, or misuse of connected credentials under the guise of a documentation helper.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Feishu document creation/update is described without an explicit privacy notice that the document content will be transmitted to an external service. Users may unknowingly send internal drafts or sensitive material outside the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs local Markdown output without warning that it will write to the user's filesystem. Silent persistence can overwrite files, place sensitive content in unexpected locations, or create artifacts the user did not knowingly authorize.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs GitHub repository output without clearly warning that it may modify version-controlled content and potentially publish it remotely. This can expose sensitive information, trigger CI/CD workflows, and create durable public or team-visible changes from what appears to be a simple writing task.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

  • Chat → Reply directly
  • Feishu (MCP) → Use mcporter to call Feishu MCP server
    bash
    node /path/to/mcporter/dist/cli.js call feishu doc.create '{"title":"...", "content":"..."}'
# Note: mcporter path varies by installation, common paths:
# - ~/.npm/_npx/*/node_modules/mcporter/dist/cli.js
# - Or use: npx mcporter call feishu doc.create ...

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

Using npx mcporter without a pinned version can fetch and execute whatever package version is currently resolved, introducing supply-chain risk. An attacker controlling or compromising the package, dependency chain, or resolution path could cause arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill's stated purpose is Diataxis documentation guidance, but this file broadens into operational publishing instructions for local files and multiple external services. That scope expansion increases the chance an agent will perform data movement or content publication actions unrelated to the user’s documentation request, which can lead to unintended disclosure or modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The Feishu examples describe creating and updating documents on an external service without warning that content is transmitted outside the local environment. This can result in unintentional sharing of internal or sensitive information through enterprise collaboration tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file provides direct local write instructions to a workspace path without warning that files will be created or overwritten. In an agent context, this can lead to unreviewed modification of user files, accidental data loss, or persistence of sensitive content on disk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The document recommends git and shell-based publication workflows, including commit and push operations, despite those capabilities not being necessary for a Diataxis writing guide. In an agent setting, such instructions normalize execution and remote publication actions that can persist or expose content beyond the local session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The GitHub publishing instructions include add/commit/push flows without warning that content may be sent to a remote repository and become broadly accessible depending on repo visibility. In practice, this can cause irreversible publication of sensitive or unreviewed material and create an audit trail that is difficult to fully retract.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/output-handler.py (reported line 134)May include surrounding context.

python
def _check_git(self) -> bool:
        """检查 git 是否可用"""
        try:
            result = subprocess.run(['git', '--version'], 
                                  capture_output=True, 
                                  timeout=5)
            return result.returncode == 0

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The local write capability persists content to /root/.openclaw/workspace/docs, which is a side effect not justified by the stated educational/guidance purpose of the skill. In agent environments, unjustified write access can be abused to plant files, overwrite expected outputs, or create persistence artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The local output path performs a filesystem write without any built-in warning, dry-run preview, or explicit confirmation at the time of modification. This is dangerous because users interacting with a documentation-oriented skill may not expect local state changes, increasing the risk of unintended file creation or overwrite.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This path transmits content to an external service through mcporter without a clear in-band warning that data is leaving the local environment. In a skill framed as a writing guide, silent external transmission materially increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.