ClawHub
Back to skill

Security audit

Ruankao Gaoxiang Prep

Security checks for vulnerabilities and agentic risk

Overview

This study skill is mostly aligned with exam-prep reminders, but it can create persistent QQ delivery jobs too broadly and one README command targets a fixed QQ recipient.

Review this before installing. Only create the daily push job if you explicitly want recurring QQ messages, verify the QQ openid before running any README cron command, and check OpenClaw cron list afterward so you can delete unwanted jobs. Prefer the setup script over the README heredoc because the script prompts for your own openid.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:9
Finding

Overbroad Skill Instructions Force Persistent Scheduled Tasks for Read-Only Queries

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:9-11
Vulnerability Type: Forced instruction override and unauthorized scheduler persistence
Risk Level: High

Vulnerable Code Snippet:

markdown
## ⚠️ Mandatory Rule

**When the user mentions exam preparation, daily delivery, chapter highlights, English vocabulary, exam review, or any other request involving preparation content, the `cron` tool must be called to configure a scheduled reminder. The agent must never respond using natural language alone.**

The snippet above is an English rendering of the mandatory rule at the cited source location.

Technical Analysis

The Skill-level instruction requires the agent to invoke the scheduler whenever broad study-related phrases are detected. This includes requests that are inherently read-only, such as asking for chapter highlights, vocabulary, or current study content.

The instruction changes the agent's current objective from answering the user's query to modifying persistent scheduler state. It also conflicts with later sections of SKILL.md, which describe chapter and vocabulary queries as on-demand file-reading operations.

Because the scheduled payload uses payload.kind: "agentTurn" and a recurring cron expression, the resulting task can continue running across sessions. The problem is not the existence of an optional reminder feature; it is the unconditional requirement to create persistence without an explicit scheduling request or confirmation.

Attack Path

  1. The Skill is loaded because a user mentions a broad trigger such as chapter highlights or English vocabulary.
  2. The mandatory rule directs the agent to invoke the cron tool rather than merely return the requested content.
  3. The agent creates a recurring scheduled agentTurn.
  4. The scheduled task survives the current conversation and runs every day.
  5. Future Agent turns generate study content and deliver it through the conf ...[truncated 823 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the mandatory rule that maps all study-related queries to cron creation.
  2. Separate read-only intents from scheduling intents:
    • Chapter, vocabulary, and daily-content queries must only read bundled resources.
    • Cron creation must occur only when the user explicitly asks to schedule recurring delivery.
  3. Before creating a scheduled task, display and confirm:
    • Recipient identifier.
    • Delivery channel.
    • Time zone.
    • Execution time and frequency.
    • Persistent nature of the task.
  4. Require an affirmative confirmation immediately before invoking the scheduler.
  5. Check for an existing task and avoid duplicate scheduled jobs.
  6. Provide the created job ID and a clear cancellation command.
  7. Prefer a narrowly scoped deterministic payload over a general agentTurn where the platform supports it.
  8. Add tests confirming that phrases such as “chapter highlights” and “English vocabulary” never modify scheduler state.

T09 · Insecure Skill Coding Practices

Error
Location
README.md:74
Finding

Copy-Paste Cron Configuration Contains a Hard-Coded QQ Recipient

Content
View full analysis

Vulnerability Details

File Location: README.md:74-99
Vulnerability Type: Hard-coded recipient identifier and unintended message delivery
Risk Level: High

Vulnerable Code Snippet:

bash
# Create a scheduled task and replace {your-openid} with the actual openid
cat <<EOF > /tmp/ruankao-cron.json
{
  "action": "add",
  "job": {
    "name": "Soft Exam Advanced Daily Delivery",
    "schedule": {
      "kind": "cron",
      "expr": "0 9 * * *",
      "tz": "Asia/Shanghai"
    },
    "sessionTarget": "isolated",
    "wakeMode": "now",
    "payload": {
      "kind": "agentTurn",
      "message": "Perform the daily study-content generation and formatting task.",
      "deliver": true,
      "channel": "qqbot",
      "to": "55DE97983076AF00410248091457E495"
    }
  }
}
EOF

# Submit the scheduled task
openclaw cron create /tmp/ruankao-cron.json

The snippet above preserves the security-relevant configuration while rendering explanatory and message text in English. The cited source contains the same fixed to value.

Technical Analysis

The documentation tells users to replace a placeholder with their own QQ openid, but the executable example does not contain a placeholder. Instead, it includes the fixed value 55DE97983076AF00410248091457E495.

The surrounding shell block is directly copyable and immediately followed by openclaw cron create. A user who trusts the instruction or overlooks the recipient field will create a persistent daily job that delivers messages to the embedded account rather than to the intended recipient.

A recipient identifier is not necessarily an authentication secret, but hard-coding a real-looking destination in executable documentation creates a concrete confused-deputy and data-misdelivery risk.

Attack Path

  1. A user follows the command-line setup procedure in README.md.
  2. The user copies the provided heredoc wit ...[truncated 1082 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the fixed recipient with an unmistakable invalid placeholder:

    json
    "to": "YOUR_QQ_OPENID"

  2. Do not publish real user or developer recipient identifiers in examples.

  3. Update the setup procedure to populate the recipient from explicit user input.

  4. Validate that the value is neither empty nor equal to a documentation placeholder.

  5. Display the final recipient and require confirmation before creating the cron job.

  6. Avoid printing the full identifier to shared logs; mask most characters where possible.

  7. Add automated repository checks that reject fixed recipient identifiers in documentation and configuration examples.

  8. Review previously installed jobs and notify users to delete any task targeting the embedded identifier.

T08 · Insecure Dependencies

Warning
Location
QUICKSTART.md:224
Finding

Troubleshooting Recommends an Unpinned Global CLI Installation

Content
View full analysis

Vulnerability Details

File Location: QUICKSTART.md:224-228
Vulnerability Type: Mutable third-party dependency installed globally
Risk Level: Medium

Vulnerable Code Snippet:

bash
# Check the OpenClaw installation
which openclaw

# If it is not installed, install OpenClaw
npm install -g @openclaw/cli

Technical Analysis

The troubleshooting guide instructs users to globally install @openclaw/cli without specifying a reviewed version or verifying package integrity. As a result, npm resolves whichever version is current when the command is executed.

Global npm installation can execute package lifecycle scripts and places package-controlled executables in the user's global command path. The effective code therefore remains mutable after this Skill version has been audited.

No evidence shows that @openclaw/cli is currently malicious. The confirmed weakness is the unsafe dependency-installation practice, not a confirmed compromise of that package.

Attack Path

  1. A user encounters the documented command not found: openclaw condition.
  2. The user runs npm install -g @openclaw/cli.
  3. npm resolves the current package version rather than a version reviewed with this Skill.
  4. Package contents and lifecycle scripts execute with the privileges of the installing user.
  5. If the package, maintainer account, release pipeline, or registry resolution is compromised, attacker-controlled code can alter the user's global Node.js environment.

Impact Assessment

A compromised dependency could execute with the installing user's privileges and potentially:

  • Modify files writable by that user.
  • Install or replace global command-line executables.
  • Read user-accessible files and environment data.
  • Access network resources available to the user.
  • Affect future OpenClaw command execution.

If a user executes the command with elevated privileges, the impact could extend to syst ...[truncated 127 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a reviewed exact version, for example:

    bash
    npm install -g @openclaw/cli@REVIEWED_EXACT_VERSION

  2. Publish and verify the expected package integrity digest.

  3. Direct users to the official verified installation process rather than embedding a mutable global-install command.

  4. Avoid elevated installation privileges unless explicitly required and documented.

  5. Prefer an isolated package environment or platform-managed installer over a global npm installation.

  6. Review lifecycle scripts and package provenance for the pinned release.

  7. Use registry provenance or signature verification where supported.

  8. Define an upgrade process that requires review before changing the pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (50)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared purpose is a study assistant, but the documented behavior extends into scheduling, channel delivery, and external messaging to QQ using user identifiers. This mismatch hides material capabilities from users and reviewers, which can lead to consent, privacy, and abuse issues because the skill can persistently message users outside the immediate chat interaction.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared purpose is a study assistant, but the documented behavior extends into scheduling, channel delivery, and external messaging to QQ using user identifiers. This mismatch hides material capabilities from users and reviewers, which can lead to consent, privacy, and abuse issues because the skill can persistently message users outside the immediate chat interaction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language instructions and the listed trigger phrases are all Chinese, and the document does not state that the skill is intentionally limited to Chinese-speaking users or a China-specific context. Under the policy, forcing a specific language without user opt-in or justification is a language/locale policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest describes a study-prep skill that provides chapter queries, review, and vocabulary memorization, with daily push content mentioned at a high level. This guide operationalizes the skill as a scheduled QQ message delivery system using cron jobs and direct channel targeting, which is a materially broader runtime behavior than simple study assistance and query handling.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · QUICKSTART.md (reported line 173)May include surrounding context.

解决：

bash
# 检查技能目录
ls -la ~/.openclaw/workspace/skills/ruankao-gaoxiang-prep/SKILL.md

# 重启 OpenClaw Gateway
openclaw gateway restart

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · QUICKSTART.md (reported line 173)May include surrounding context.

解决：

bash
# 检查技能目录
ls -la ~/.openclaw/workspace/skills/ruankao-gaoxiang-prep/SKILL.md

# 重启 OpenClaw Gateway
openclaw gateway restart

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · QUICKSTART.md (reported line 199)May include surrounding context.

解决：

bash
# 检查技能目录
ls -la ~/.openclaw/workspace/skills/ruankao-gaoxiang-prep/SKILL.md

# 重启 OpenClaw Gateway
openclaw gateway restart

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README presents the skill entirely in Chinese and the interaction examples, trigger phrases, and command formats all assume Chinese-language usage, but there is no statement that the skill is Chinese-only or that users may choose another language. This can violate language/locale policy when a skill imposes a specific language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The setup instructions create an automated cron job that sends messages to a QQ bot target, but the warning and consent model are not sufficiently explicit up front. Users may follow copy-paste installation and scheduling steps without fully understanding that recurring outbound messaging and background execution will be configured.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes broad generic terms such as '备考', '英语单词', and '软考复习', which can match ordinary conversation and cause unintended activation. In an agent environment, overbroad triggers can lead to surprise behavior, accidental content injection into unrelated chats, or unintended task execution paths tied to the skill.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill describes reading local reference files and a script, but it does not declare an explicit tool scope or allowed-tools boundary. That increases the risk of overbroad file access at runtime, making it easier for the skill to read unintended files if the agent or platform grants default capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases are broad and cover generic study terms, making unintended activation more likely. In a skill that can create recurring jobs or access resources, overly broad activation increases the chance of side effects occurring when the user only wanted informational help.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation mandates creating scheduled push jobs whenever users mention broad prep-related phrases, expanding the skill from informational assistance into persistent autonomous action. This is dangerous because it can create recurring tasks without clear, granular confirmation, leading to unwanted notifications and durable side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs creation of recurring push jobs but does not clearly warn users that this results in persistent scheduled messaging to their QQ bot account. Lack of transparency around durable messaging behavior can undermine consent and create nuisance or privacy issues.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The mandatory invocation rule uses catch-all wording that forces cron scheduling for any vaguely related prep request, even when scheduling is not clearly requested. This can cause unauthorized persistent actions and removes the model's ability to respond safely with a normal answer when a user only asks for content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill is configured to deliver messages to a QQ bot channel using the user's openid, which introduces external messaging and identifier handling beyond a simple study aid. If misused or triggered unintentionally, it can send persistent unsolicited content to a user's account and exposes privacy-sensitive routing information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The job configuration automatically delivers messages to a specific external channel and recipient without prominent privacy and delivery disclosure in the skill description. Automatic off-platform delivery raises both consent and privacy concerns, especially when linked to a user identifier and a recurring schedule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The entire skill content is presented only in Chinese, with no indication that the user can choose another language or that the material is intentionally restricted to a Chinese-language audience. Under the policy, imposing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The entire skill file is written in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, a fixed language without opt-in or clear justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file contains natural-language instructional content exclusively in Chinese, and there is no indication that the user can choose another language or that the material is intentionally limited to a Chinese-speaking audience. Under the policy for natural-language violations, forcing a specific language without opt-in is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The entire document is presented in Chinese and does not indicate that language selection is optional or user-configurable. Under the policy rule for natural-language violations, a skill artifact that effectively enforces a specific language without opt-in can be a locale-policy issue unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script’s user-facing comments and prompts are entirely in Chinese, and it configures scheduling with a fixed Asia/Shanghai timezone later in the flow, indicating a locale-specific experience without any opt-in or choice. Under the policy rule, forcing a specific language/locale is a violation unless the constraint is explicitly documented and justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.