Security audit

Volcengine (Volcano Engine)

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a legitimate Volcengine setup guide, but it includes under-scoped optional instructions for a recurring background documentation updater.

Install only if you need Volcengine model support and are comfortable sending prompts, files, and API credentials to Volcengine. Prefer environment variables or a protected credential store, restrict and rotate the API key, and do not follow the optional cron/documentation-updater or unpinned npm/npx crawler instructions unless you review and contain them yourself.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

Location: references/documentation-analysis.md:332
Finding: Recurring Documentation Update Task Creates Cross-Session Persistence
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/documentation-analysis.md:161
Finding: Unpinned npm Dependency Installation with Dangerous Script Execution Mode
Content: View full analysis
Dynamic content requires JavaScript execution', { runScripts: 'dangerously', resources: 'usable' }); // Complex; not recommended for complex SPAs " ``` ### Technical Analysis The command installs `jsdom` without an exact version or lockfile. The package and its transitive dependencies are therefore resolved from the registry at execution time, allowing the installed code to change after the Skill has been reviewed. npm package installation may also run package lifecycle scripts unless explicitly disabled. The example additionally enables `runScripts: 'dangerously'`. In the current snippet, the HTML is a fixed local string and contains no script, so the example does not itself execute a remote payload. However, the setting is unsafe for the surrounding documentation-crawling use case: if remotely fetched or attacker-controlled HTML is later supplied to `JSDOM`, page scripts may execute in the Node.js environment. The project manifest itself declares no runtime dependencies or install hooks. This finding applies to the documented installation and execution workflow rather than automatic package installation. ### Attack Path 1. A user or agent follows the documented extraction option. 2. `npm install jsdom` resolves the current package and transitive dependency graph from the configured npm registry. 3. Any permitted package lifecycle scripts execute with the invoking user's privileges. 4. A compromised package version, registry response, or transitive dependency can execute malicious installation logic. 5. If the example is extended to parse fet ...[truncated 766 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: references/configuration.md:54
Finding: Plaintext API Key Storage Lacks Mandatory File-Permission Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (45)

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.
openclaw --model volcengine/doubao-seed-2-0-pro-260215 "Write a Python function"

Use GLM 4.7 for Chinese content

openclaw --model GLM4 "写一篇关于人工智能的文章"

text
### Setting Default Model

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/configuration.md (reported line 54)May include surrounding context.
"apiKey": "VOLCANO_ENGINE_API_KEY"

text
### 3. .env File Create `~/.openclaw/.env`:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.
Testing Connection

bash
# Test with curl curl -X POST https://ark.cn-beijing.volces.com/api/v3/chat/completions \ -H "Authorization: Bearer $VOLCANO_ENGINE_API_KEY" \ -H "Content-Type: application/json" \

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/configuration.md (reported line 12)May include surrounding context.
md
**Step 1: Get API Key** 1. Log in to [Volcano Engine Console](https://console.volcengine.com/ark) 2. Go to **Access Management** → **Access Keys** 3. Click **Create Access Key** 4. Copy the key (starts with `sk-`) **Step 2: Configure OpenClaw**

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide shows users how to place API keys directly into openclaw.json and also references storing secrets in local files, which can lead to accidental disclosure through source control, backups, screenshots, or overbroad file permissions. Although the document later includes general key-protection advice, the insecure example appears early and is presented as a normal manual configuration path, increasing the chance of unsafe adoption.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The document instructs use of npx playwright without pinning an explicit version, which can cause execution of an unexpected or newly published package version. In an agent or automation context, this creates a supply-chain risk: future runs may fetch changed code with new behavior, including malicious postinstall scripts or incompatible binaries.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The text is entirely presented in Chinese, including the leading phrase "返回示例" and surrounding API reference material, with no indication that language selection is optional or justified by a region-specific requirement. Under the policy, hard-coding a specific language without user choice can be a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The text is entirely in Chinese and does not indicate that the skill or documentation is region-specific, nor does it offer users an option to select another language. Under the policy rule, forcing a specific language without user opt-in can constitute a natural-language policy violation.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/extracted_pages/page_012.txt (reported line 17)May include surrounding context.
text
管控面 API 鉴权管控面的API，如管理API Key、管理推理接入点等接口。 Access Key 签名鉴权Authorization: Bearer $ARK_API_KEYShell curl https://ark.cn-beijing.volces.com/api/v3/chat/completions \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $ARK_API_KEY" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/extracted_pages/page_013.txt (reported line 16)May include surrounding context.
text
• • 2. curl -X POST \ 'https://ark.cn-beijing.volcengineapi.com/?Action=ListEndpoints&Version=2024-01-01' \ -H 'Authorization: HMAC-SHA256 Credential=AKL**/20240710/cn-beijing/ark/request, SignedHeaders=host;x-content-sha256;x-date, Signature=a7a****' \

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This text imposes a single language/locale on the user experience and does not indicate that alternative languages are available or that Chinese-only presentation is required for a region-specific purpose. Under the policy, forced language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This plain-text file presents all user-facing documentation and error explanations in Chinese only, with no indication that the user can select another language or that the content is intentionally limited to a China-specific audience. The policy requires flagging language or locale constraints when they are imposed without opt-in or clear justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The text includes repeated Chinese end-user guidance such as '请您使用其他 prompt' and '请您更换后重试' alongside error descriptions, but there is no indication that language selection is optional or user-configurable. This can violate a language/locale policy when a skill or reference material prescribes one language for user-facing responses without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This Python file contains all user-facing docstrings and console output in Chinese, including usage instructions and runtime status messages. Because the skill does not offer any language choice or explain that it is intentionally limited to a Chinese-speaking context, it creates a natural-language locale restriction that matches the policy-violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: 该文件从标题开始即明确以中文编写，且全文未说明是否允许其他语言、也未提供用户语言选择或切换方式。根据规则，若技能或文档在自然语言层面强制特定语言而无用户选择或合理地域性说明，属于语言/locale policy violation。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file contains user-facing natural-language content that largely assumes Chinese as the operating language, including headings, descriptions, and guidance. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The API key format note contains Chinese text (无需添加sk-前缀) embedded in otherwise English documentation, and similar Chinese appears later in comments. This imposes language-specific content without an explicit user opt-in or a stated reason that the document is intended for Chinese-speaking users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file shows a direct curl call to Volcengine's chat completions API, which sends user prompt content and an authorization bearer token to an external service. While the skill is about configuring a hosted model provider, the documentation does not explicitly warn users that prompts and related data will be transmitted to Volcengine for processing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The document highlights key links with an explicit ?lang=zh locale parameter, indicating a Chinese-language constraint in the skill's referenced documentation flow. There is no accompanying note that users may choose another language or that the locale is region-specific and justified, which can conflict with language/locale choice policy.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: openclaw has 16 known advisory(ies) (CVE-2026-53846 (OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency); CVE-2026-32064 (OpenClaw's andbox browser noVNC observer lacked VNC authentication); CVE-2026-32006 (OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallbac) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest includes the tag "chinese" in a natural-language metadata field, which can imply language or locale targeting. In this file, there is no accompanying note that the skill offers language choice or that the locale constraint is intentional and justified, so it may conflict with the policy against forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file upload section documents sending arbitrary files to an external API but does not warn users that uploaded content may contain sensitive or regulated data. In a skill/reference context, this omission can lead developers to transmit private documents, credentials, or customer data without considering data handling, retention, or compliance implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The test script sends the API key and user-supplied prompt content to a third-party remote endpoint, but the testing section does not clearly disclose that prompts, metadata, and potentially sensitive data leave the local system. This creates a data-handling risk because operators may use real internal text during validation without understanding that it is transmitted externally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: 该 markdown 明确将目标文档语言设为“zh (中文)”，后续示例 URL 也持续固定使用 lang=zh。根据规则，若技能或方案强制特定语言/locale 而未提供用户 opt-in 或合理的区域性说明，属于自然语言层面的语言策略风险。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Playwright 示例直接访问 https://www.volcengine.com/docs/82379/1399009?lang=zh，体现出实现层面对中文 locale 的硬编码。文件中未见提供语言切换参数、用户选择入口，或说明这是因特定合规/区域需求而限定中文。
Content: No source excerpt is available for this finding.

Overview

A.I.G

T06 · System Persistence

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

External Model or Provider Selection

Use GLM 4.7 for Chinese content

Credential Access

External Transmission

Testing Connection

Session Persistence

Missing User Warnings

Rp1

Natural-Language Policy Violations

Natural-Language Policy Violations

External Transmission

External Transmission

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations