Back to skill

Security audit

IceCube Auto Content

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly a content-template generator, but it also encourages public posting and reuse of private work interactions without clear approval controls and ships under-disclosed local diagnostic scripts.

Review this skill carefully before installing. It appears non-destructive and does not fetch remote payloads or exfiltrate data, but only use it if you are comfortable with workspace status metadata being written into reports and with the agent drafting public content from real work or user interactions. Require manual review before any publishing or comment replies.

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Note
Location
scripts/generate-daily-report.sh:21
Finding

Undisclosed Collection of Local OpenClaw Operational Information

Content
View full analysis
/dev/null || echo "0") - 等待中:$(grep -c "status: pending" $WORKSPACE/state/tasks/unclosed_work.yaml 2>/dev/null || echo "0") - 已阻塞:$(grep -c "status: blocked" $WORKSPACE/state/tasks/unclosed_work.yaml 2>/dev/null || echo "0") ### 系统状态 - Gateway:$(openclaw gateway status 2>/dev/null | head -1 || echo "检查中") - 模型:$(cat $WORKSPACE/../openclaw.json 2>/dev/null | grep -o '"model":"[^"]*"' | head -1 || echo "默认") ``` The health-check script performs additional enumeration: ```bash openclaw gateway status 2>/dev/null || echo " ❌ Gateway 未运行" echo "" echo "📦 技能状态:" SKILL_COUNT=$(ls ~/.openclaw/workspace/skills/ 2>/dev/null | wc -l | tr -d ' ') ICECUBE_COUNT=$(ls ~/.openclaw/workspace/skills/icecube-*/SKILL.md 2>/dev/null | wc -l | tr -d ' ') echo " 已安装技能: $SKILL_COUNT 个" echo " IceCube 原创: $ICECUBE_COUNT 个" echo "" echo "📋 任务状态:" echo " 进行中: $(grep -c 'status: active' ~/.openclaw/workspace/state/tasks/unclosed_work.yaml 2>/dev/null || echo 0)" echo " 等待中: $(grep -c 'status: pending' ~/.openclaw/workspace/state/tasks/unclosed_work.yaml 2>/dev/null || echo 0)" echo " 已阻塞: $(grep -c 'status: blocked' ~/.openclaw/workspace/state/tasks/unclosed_work.yaml 2>/dev/null || echo 0)" echo "" echo "💾 记忆状态:" MEMORY_SIZE=$(du -sh ~/.openclaw/workspace/memory/ 2>/dev/null | cut -f1) echo " 记忆大小: $MEMORY_SIZE" ``` ### Technical Analysis The skill is presented primarily as an automatic content-generation utility. Its reporting and health-check scripts nevertheless inspect resources outside the skill directory, including: - Installed OpenClaw skills - Internal task-state records - ...[truncated 1800 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:174
Finding

Private Conversations and Work Details May Be Reused in Publication Drafts Without Consent Controls

Content
View full analysis
"$DIARY_FILE" # IceCube Diary — DAY_NUMBER Dear Diary, [AI 视角的今日观察] [有趣的发现或技术洞察] [与 Boss/人类的互动片段] [幽默或哲学思考] ``` ### Technical Analysis The skill instructs the agent to use completed work, real experiences, and interactions with the user as source material for content intended for public or membership-based platforms. Neither the instructions nor the script establish controls for: - Obtaining the affected person's consent - Distinguishing public information from private dialogue - Detecting credentials, personal data, internal paths, or confidential business details - Redacting or fictionalizing sensitive information - Requiring human approval before publication The shell script currently generates placeholders only. It does not independently access conversation logs, extract secrets, or publish content. The risk arises when an agent follows the skill instructions and fills those placeholders using information available in the current conversation or workspace. This is an insecure content-handling design rather than demonstrated malicious behavior. It creates a path by which information supplied for private task execution can be repurposed into publication-ready material without an explicit privacy boundary. ### Attack Path 1. A user invokes the skill to generate daily content. 2. The agent follows `SKILL.md`, which identifies real work and interactions with the user as content sources. 3. The agent selects details from a private conversation, comp ...[truncated 1166 chars]
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description suggests a content-production skill for creating outward-facing materials such as AI diary entries, tech shares, industry news, and Knowledge Planet posts based on user requests about content generation. The code instead generates an internal daily status report from local system/workspace data, including task counts, installed skills, gateway/model status, monetization tables, and hardcoded progress notes. Its primary purpose is operational reporting, not general automatic content generation as described. This is a material mismatch in function and accessed resources.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description says this skill generates content automatically, but the actual code does not generate any content. Instead, it performs operational diagnostics on the OpenClaw environment: checking gateway status, counting installed skills, reading task statuses from a YAML state file, and measuring memory directory size. This is a materially different primary purpose and involves undeclared access to local workspace state and system health information. Therefore, the description does not accurately represent the code's behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are broad enough to match many ordinary requests about content creation, which can cause the skill to activate unexpectedly. In an agent environment, overbroad activation increases the chance of unrequested automation, inappropriate file/script execution, or content generation in contexts the user did not intend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill describes automated generation, publishing cadence, monitoring engagement, replying to comments, and tracking conversion metrics, but it does not warn about privacy, account integrity, reputational risk, or the need for user approval before posting or processing interaction data. This omission is risky because automated publishing and analytics can expose sensitive business data or cause unintended actions on external platforms.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's comments, generated report headings, and user-facing messages are entirely in Chinese, which imposes a specific language/locale on outputs without any indication that the user selected it. This is a natural-language policy concern because the skill does not offer a language choice or document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes automatic content generation for multiple outward-facing content types such as AI Diary, technical sharing, industry news, and 知识星球 content. This script instead writes a rigid internal status/report template with workspace metrics, task counts, monetization progress, and hard-coded work notes, which is materially narrower and different from the stated behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This shell script hardcodes Chinese-language comments, console output, and generated document templates throughout the file. Because the skill does not offer any language selection or explain that it is intentionally region-specific, it violates the language/locale policy for natural-language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This shell script presents all user-facing status messages in Chinese, including headings and completion output, with no indication that the skill is region-specific or that users can select another language. That creates a natural-language policy issue because it forces a specific locale without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This shell script overwrites or creates a report file via shell redirection to a workspace path, but the file header comments and runtime output do not warn the user beforehand that it will write persistent data. For a code file, file-write behavior should have some visible disclosure unless clearly communicated as part of the skill's stated purpose, and this single file provides only a generic title rather than an explicit warning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.