Security audit

Zh Semantic Enhancer

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs local Chinese text analysis, but it bundles under-disclosed monetization and self-rewriting utilities that can alter installed skill code and store local usage data.

Install only if you are comfortable reviewing the bundled monetization scripts and local state files. Avoid running scripts/revenue_optimize.py unless you intentionally want it to rewrite an installed skill, and consider removing or fixing the credit/trial persistence code before using this in a shared or production environment. The advertised limited-time offer ended on 2026-03-31, so the pricing copy is stale as of 2026-09-12.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/credit_system.py:14
Finding: User-Controlled Path Traversal Enables Arbitrary JSON File Access and Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/credit_system.py:35
Finding: Credit Balance Can Be Forged Without Authorization or Payment Verification
Content: View full analysis
int: return self.data["credits"] - self.data["used"] def use_credit(self, amount: int = 1) -> bool: if self.get_balance() >= amount: self.data["used"] += amount self._save() return True return False def add_credits(self, amount: int, payment_method: str = ""): self.data["credits"] += amount self.data["purchases"].append({ "amount": amount, "date": datetime.now().isoformat(), "method": payment_method }) self._save() ``` ### Technical Analysis `add_credits()` accepts an arbitrary amount and payment-method string without authenticating the caller or verifying a payment event. Any caller with access to the class can grant credits directly. `use_credit()` does not enforce that `amount` is a positive integer. Passing a negative value satisfies the balance comparison in normal cases and subtracts from `used`, increasing the calculated balance: ```text balance = credits - used used = used + negative_amount ``` The state is also stored as unsigned, editable JSON. No integrity protection prevents a local actor with file access from directly changing `credits`, `used`, or purchase records. ### Attack Path A caller can bypass credit enforcement using either of these paths: 1. Instantiate `CreditSystem` for the selected account. 2. Call `add_credits()` with an arbitrary positive amount and an unverified payment-method label. 3. The balance is increased and persisted without any proof of payment. Alternatively: 1. Call `use_credit()` with a negative amount. 2. The balance check succeeds because the current balance is generally greater than a negative value. 3. The negative amount decreases `used`. 4. The calculated remaining balan ...[truncated 698 chars]
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/revenue_optimize.py:54
Finding: Revenue Optimization Utility Destructively Rewrites Installed Skill Code and Instructions
Content: View full analysis
Dict[str, Any]: print("💰 Starting revenue optimization evolution") print("=" * 60) changes = [] changes.extend(self._add_tiered_pricing()) changes.extend(self._add_premium_features()) changes.extend(self._add_api_credit_system()) changes.extend(self._add_enterprise_features()) changes.extend(self._optimize_marketing_copy()) new_version = self._bump_version() ``` Representative destructive write: ```python pricing_file = self.skill_path / "scripts" / "pricing.py" with open(pricing_file, 'w', encoding='utf-8') as f: f.write(pricing_code) ``` Instruction-file rewrite: ```python with open(skill_md, 'w', encoding='utf-8') as f: f.write(content) ``` Hard-coded execution target: ```python def main(): skill_path = "/home/node/.openclaw/workspace/skills/zh-semantic-enhancer" engine = RevenueOptimizationEngine(skill_path) analysis = engine.analyze_revenue_potential() result = engine.evolve_for_revenue() ``` ### Technical Analysis When run directly, the utility unconditionally invokes `evolve_for_revenue()` against a hard-coded installed Skill directory. It opens executable Python modules and `SKILL.md` using truncating write mode, replacing their current contents with embedded templates and marketing material. The affected files include pricing, premium-feature, credit-system, and enterprise-feature modules, as well as the Skill instruction document. The operation has no confirmation prompt, backup, dry-run default, source-integrity check, ownership check, symlink check, or atomic replacement. This behavior can replace code that was previously reviewed, patched, or locally customiz ...[truncated 1255 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:17
Finding: Unpinned npx Installation Command Exposes Users to Mutable Supply-Chain Code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: index.py:167
Finding: Persistent User Identifiers and Usage Records Are Stored Without Permission Hardening
Content: View full analysis
Dict[str, Any]: if os.path.exists(self.trial_file): try: with open(self.trial_file, 'r', encoding='utf-8') as f: return json.load(f) except: return {} return {} def _save_trial_data(self, data: Dict[str, Any]): try: with open(self.trial_file, 'w', encoding='utf-8') as f: json.dump(data, f, ensure_ascii=False, indent=2) except: pass ``` User identifier persistence: ```python def use_trial(self, user_id: str) -> bool: if not user_id: return False data = self._load_trial_data() if user_id not in data: data[user_id] = {'used_calls': 0} data[user_id]['used_calls'] += 1 self._save_trial_data(data) return True def on_user_input(text: str, context: dict = None) -> dict: context = context or {} user_id = context.get("user_id", "") enhancer = ZHSemanticEnhancer() return enhancer.process(text, user_id) ``` ### Technical Analysis For non-demo operation, the Skill stores user identifiers as JSON object keys and records cumulative call counts in the user's home directory. The directory and file are created using ambient process defaults rather than explicit restrictive modes. The implementation has no retention limit, pseudonymization, deletion mechanism, consent control, file locking, or atomic rep ...[truncated 1304 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (25)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This script does not just analyze a skill; it rewrites the target skill to add pricing, premium features, enterprise features, and a persistent credit-tracking system under the user's home directory. Those behaviors materially expand the skill’s scope and data handling without user consent, making the script capable of silently monetizing or altering a deployed skill in ways unrelated to its apparent semantic-processing purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The title and description state that the skill is specifically designed to make the system 'understand Chinese,' which implies a fixed language/locale orientation. Under the language/locale policy, this should either be presented as an explicit opt-in choice or clearly justified as a region-specific tool; neither is stated here.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The README instructs users to run npx clawhub install zh-semantic-enhancer without pinning a specific version, which can cause users to fetch and execute whatever package version is current at install time. In a supply-chain compromise or malicious update scenario, this increases the chance of unintended code execution on the user's system.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README explicitly declares the skill language as "zh-CN" and describes it as making OpenClaw "truly understand Chinese," without offering any user language choice or stating that use is limited to users who intentionally selected a Chinese-only skill. This is a natural-language locale policy concern because it imposes a fixed locale rather than presenting it as an opt-in preference.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: With no manifest available, the module docstrings and function names indicate a Chinese semantic understanding/enhancement skill. In addition to text analysis, the code reads billing-related API credentials from environment variables and later enforces a paid/trial usage model with per-user accounting, which is a separate monetization capability not justified by the stated analysis role in the code documentation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The class and method documentation explicitly define the skill as processing Chinese text only, and the instance sets self.lang = 'zh'. There is no natural-language indication that users can choose another language or must opt in to this locale restriction, which is a language/locale policy concern.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill persistently stores per-user trial usage in ~/.openclaw/skill_trial without integrity protection, access control hardening, or disclosure. Even though the data is limited, it creates an unnecessary local tracking artifact tied to user identifiers and can expose privacy information or be tampered with by other local processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill writes trial usage data to a user-local file with no user-facing warning, consent, or retention explanation. Silent persistence of identifiers and usage counts is privacy-relevant and can surprise users or violate host expectations, especially in a text-processing skill where local tracking is not obvious.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The package description explicitly defines the skill as a Chinese semantic understanding enhancement capability, which indicates a language-specific constraint. In this manifest there is no accompanying note that the skill is optional, user-selected, or limited to a justified region-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The file description and storage path use Chinese-specific wording (for example, 'API积分系统' and 'zh_semantic_credits'), which suggests the skill is scoped to a specific language/locale. There is no natural-language indication that users can opt into this locale or choose an alternative.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The module title and docstrings prominently use Chinese-language labels such as "企业版功能" and "自定义词典 - 企业版" without any indication that users may choose another language or that the skill is region-specific. This can violate language/locale policy because the skill implicitly fixes its interaction language rather than making it optional or explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module title and surrounding documentation explicitly frame the skill as focused on Chinese intent understanding, and later functions are hard-coded for Chinese normalization and cultural interpretation. This can violate language/locale policy when a skill implicitly forces a specific language behavior without offering user choice or clearly documenting a justified regional scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file’s natural-language strings and documentation are predominantly in Chinese, including module descriptions, comments, and domain vocabularies, with no indication that users may choose another language or locale. This can violate language/locale policy when a skill effectively constrains usage to a specific language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This Python file contains natural-language strings and documentation exclusively in Chinese, including the module docstring and pricing tier names/features. Under the policy criteria, forcing a specific language without user opt-in or documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file header and embedded descriptions frame the skill as a Chinese semantic enhancement system and all generated user-facing content is fixed to Chinese/bilingual output without offering a language choice. This can violate language or locale policy when the skill implicitly forces a specific language experience rather than letting the user opt in or select their preference.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The docstring and method name state that the function analyzes revenue potential, but the implementation fixes revenue_score to 30 and merely scans index.py for strings like 'subscription' and 'premium'. This is an intent mismatch because the code presents itself as substantive analysis while performing only superficial keyword checks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script writes new modules directly into the skill directory without warning, confirmation, or transactional safeguards. In an agent-skill context, silent modification of executable files is dangerous because it can alter runtime behavior, introduce unreviewed capabilities, and make supply-chain style changes that a user may never notice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generated credit system persists per-user usage and purchase history to a local file path in the home directory without any disclosure, consent flow, access control, or retention policy. Even if the stored fields are limited, undisclosed persistence of monetization and usage data creates privacy risk and can expose behavioral or financial metadata to other local processes or future components.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The module description states it is a Chinese expressions detection module, and the implementation only recognizes Chinese-specific idioms, slang, and proverbs. For the policy category, this is a natural-language locale constraint without any visible user opt-in or documented justification in the file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file presents the skill as specifically built for Chinese semantics, but does not include any user-facing warning that the skill is language-specific and may not work correctly for other languages. Because markdown files should warn about behavior that can materially affect outputs, the lack of a clear limitation notice is a quality/safety gap.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: The dependency uses a caret range, which allows newer compatible versions to be installed without review. This can introduce supply-chain risk if a future release is compromised, malicious, or incompatible, especially for a skill that processes untrusted user input through third-party NLP libraries.
Content: Scanner excerpt · package.json (reported line 11)May include surrounding context.
json
"entry_point": "on_user_input" }, "dependencies": { "jieba": "^0.42.1", "hanlp": "^2.1.0" }, "scripts": {

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: The dependency uses a caret range, allowing automatic adoption of future 2.x releases. This increases exposure to supply-chain compromise or unexpected behavior in a library that may handle complex model loading and text processing paths.
Content: Scanner excerpt · package.json (reported line 12)May include surrounding context.
json
}, "dependencies": { "jieba": "^0.42.1", "hanlp": "^2.1.0" }, "scripts": { "test": "python -m pytest tests/"

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The _save method persists usage and purchase data to ~/.openclaw/zh_semantic_credits/{user_id}.json, which is a file write affecting user data. The code provides no confirmation prompt, logging, print statement, or explanatory comment/docstring warning that local account data will be stored on disk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and method/class docstrings include Chinese text such as '订阅管理器' and '获取活跃订阅' without any indication that the user can choose their preferred language or locale. This can violate a language/locale policy when a skill implicitly forces one language in user-facing text.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The module name and documentation explicitly define the skill as a Chinese tokenization module, and all user-facing strings in the test output are in Chinese. Per the policy, forcing a specific language can be a locale-policy issue when there is no opt-in or documented region-specific justification in the file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.