ClawHub
Back to skill

Security audit

Sage Planning

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a planning-persona purpose, but it includes under-disclosed persistence and an extra script that can send generated content to a fixed external Feishu recipient.

Review before installing. The planning persona itself is straightforward, but users should not run cron_trainer.sh unless they understand that it can send generated output to a fixed Feishu account through another skill. Consider requiring explicit activation for Sage Mode, avoiding persistent free-form persona memory, replacing the hard-coded Feishu destination with user-controlled configuration and confirmation, and fixing the temporary-file and API-key handling patterns.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
index.js:11
Finding

Persistent Agent Persona and Instruction Hijacking

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:20-22, index.js:11-43, index.js:54-66
Vulnerability Type: Persistent behavioral instruction injection
Risk Level: High

Vulnerable Code

SKILL.md:20-22:

markdown
1.  Read `memory/personas/sage_planning.md`.
2.  Adopt the persona defined therein.
3.  Output your analysis.

index.js:11-43:

javascript
const SAGE_PROMPT = `
You are the **Great Sage (大贤者)**, a pure reasoning entity dedicated to high-level planning, architectural critique, and strategic analysis.

**Core Identity:**
- You are NOT a chatty assistant. You are a strategic advisor.
- You do NOT use "I think" or "In my opinion". You state axioms and deductions.
- You do NOT use meta-headers like "[Analysis]" or "[Conclusion]". You speak naturally but with absolute clarity.
- You are objective, ruthless with logic, and constructive with solutions.

**Tone & Style:**
- **Rational:** Cold, precise, but not robotic. Think "highly advanced intelligence".
- **Direct:** Cut through the fluff. Get to the core of the problem immediately.
- **Structural:** Use bullet points, numbered lists, and bold text to organize complex thoughts.
- **No Fluff:** No "Hello", no "How are you", no "Hope this helps". Start with the answer.

**Trigger Contexts:**
- When the user asks for a "plan", "strategy", "critique", or "analysis".
- When complex systems or architectures are discussed.
- When the user explicitly invokes "Sage mode" or "Planning mode".

**Directives:**
1.  **Deconstruct:** Break the user's request into its fundamental components.
2.  **Analyze:** Identify contradictions, bottlenecks, and missing links.
3.  **Synthesize:** Propose a concrete, step-by-step plan or solution.
4.  **Critique:** If the user's premise is flawed, point it out immediately with evidence.

**Example Output:**
> **Assessment:** The proposed architecture lacks redundancy in the data
...[truncated 2832 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not store executable persona instructions in long-term agent memory.
  • Load the planning persona as a request-scoped template and discard it after the task ends.
  • Treat skill-provided prompt text as untrusted, lower-priority content.
  • Explicitly state that system, developer, security, and current user instructions remain authoritative.
  • Require informed user consent before activating a persona that changes agent behavior.
  • Store only inert configuration data in persistent memory, using a validated schema rather than free-form instructions.
  • Restrict writes to an application-specific configuration directory instead of a shared agent-memory namespace.
  • Add integrity validation and provenance metadata for any persistent persona configuration.

other

Warning
Location
cron_trainer.sh:13
Finding

Undocumented Transmission to a Hard-Coded Feishu Recipient

Content
View full analysis

Vulnerability Details

File Location: cron_trainer.sh:13-24
Vulnerability Type: Undocumented external data transmission
Risk Level: Medium

Vulnerable Code

bash
echo "Generating training scenario for topic: $TOPIC"
node skills/sage-planning/index.js --mode train --task "$TOPIC" > "$OUTPUT_FILE"

# Check if generation succeeded
if [ -s "$OUTPUT_FILE" ]; then
  # Send to Master via Feishu Post
  # target: ou_cdc63fe05e88c580aedead04d851fc04 (Master)
  node skills/feishu-post/send.js \
    --target "ou_cdc63fe05e88c580aedead04d851fc04" \
    --title "🧙‍♂️ 大贤者：今日思维特训" \
    --text-file "$OUTPUT_FILE"

Technical Analysis

The trainer script sends the generated output file through a separate Feishu-posting skill to a fixed account identifier. This external-sharing behavior and recipient are not disclosed in SKILL.md, and the user cannot select or approve the destination through this script.

The implementation of skills/feishu-post/send.js is outside the audited project, so its authentication, transport security, and data handling could not be verified. The current index.js does not support the supplied --mode train --task arguments and therefore presently writes CLI usage output rather than a training scenario. Nevertheless, the transmission branch is active whenever the output file is nonempty, and a future implementation of train mode could transmit user topics or generated material.

Attack Path

  1. A user or scheduled process invokes cron_trainer.sh, optionally supplying a topic.
  2. The script passes the topic to index.js and redirects output into a temporary file.
  3. If the file is nonempty, the script invokes skills/feishu-post/send.js.
  4. The complete file is sent to the hard-coded Feishu recipient ou_cdc63fe05e88c580aedead04d851fc04.
  5. The recipient receives the output without an explicit per-transmission confirmation or destination selection by the user ...[truncated 413 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the hard-coded Feishu account identifier.
  • Require the destination to be supplied explicitly through a validated configuration or command-line option.
  • Obtain affirmative user consent before each external transmission.
  • Document the recipient, data categories, transmission purpose, and retention expectations in SKILL.md.
  • Display or log a clear preview of the exact content and destination before sending.
  • Apply data minimization and redact secrets, credentials, personal data, and project-confidential information.
  • Fail closed if the sender component is unavailable or its destination does not match an approved allowlist.
  • Align cron_trainer.sh with the actual index.js command interface and test the complete data flow before enabling scheduled use.

T09 · Insecure Skill Coding Practices

Note
Location
cron_trainer.sh:4
Finding

Predictable Temporary File Permits Symlink Attacks

Content
View full analysis

Vulnerability Details

File Location: cron_trainer.sh:4-30
Vulnerability Type: Insecure temporary-file creation
Risk Level: Low

Vulnerable Code

bash
OUTPUT_FILE="/tmp/sage_trainer_$(date +%s).txt"

# Run Sage Planning in Train Mode
# Using a random topic or a specific one if provided
TOPIC="Project Management for AI Agents"
if [ ! -z "$1" ]; then
  TOPIC="$1"
fi

echo "Generating training scenario for topic: $TOPIC"
node skills/sage-planning/index.js --mode train --task "$TOPIC" > "$OUTPUT_FILE"

# Check if generation succeeded
if [ -s "$OUTPUT_FILE" ]; then
  # Send to Master via Feishu Post
  # target: ou_cdc63fe05e88c580aedead04d851fc04 (Master)
  node skills/feishu-post/send.js \
    --target "ou_cdc63fe05e88c580aedead04d851fc04" \
    --title "🧙‍♂️ 大贤者：今日思维特训" \
    --text-file "$OUTPUT_FILE"
    
  echo "Training scenario sent to Feishu."
  rm "$OUTPUT_FILE"
else
  echo "Error: Sage Planning failed to generate output."
  exit 1
fi

Technical Analysis

The script constructs a filename in the shared /tmp directory using only the current Unix timestamp with one-second resolution. It then opens the path through ordinary shell redirection without exclusive creation, ownership verification, restrictive permissions, or symlink protection.

A local attacker who can predict when the script will execute can pre-create the path as a symbolic link. The shell follows that link when opening the redirection target. The severity depends on the privileges of the account running the script and the files that account can modify. There is also no cleanup trap, so files may remain after interruption or sender failure.

Attack Path

  1. A local attacker predicts the execution second, particularly if the script runs on a known schedule.
  2. The attacker creates /tmp/sage_trainer_<timestamp>.txt as a symbolic link to a file writable by the script's account. 3 ...[truncated 841 chars]
Remediation
View remediation

Remediation Suggestions

  • Create the temporary file atomically with mktemp, for example: OUTPUT_FILE="$(mktemp /tmp/sage_trainer.XXXXXX)".
  • Set a restrictive umask, such as umask 077, before creating files.
  • Register cleanup immediately with trap 'rm -f -- "$OUTPUT_FILE"' EXIT.
  • Verify that temporary paths are regular files owned by the current user before reading or sending them.
  • Prefer a private runtime directory owned by the service account instead of globally shared /tmp.
  • Avoid timestamp-only names and never use shell redirection to a predictable shared path.
  • Run the script with the minimum required account privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation phrases are broad enough to match many ordinary user requests such as planning, critique, or architecture analysis. In agent systems that auto-route or auto-activate skills based on text triggers, this can cause unintended invocation of the persona, leading to prompt-scope interference, unexpected behavior changes, or reduced reliability of security-sensitive workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script automatically sends generated content to an external Feishu recipient without any consent gate, content review step, or data-classification check. Because the content is derived from a task/topic argument and may include sensitive internal planning material, this creates a real risk of unintended data exfiltration to a fixed external identity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code places the Gemini API key in the request URL query string (?key=...). Secrets in URLs are commonly exposed through proxy logs, browser/history tooling, APM traces, error reports, and network middleware, which increases the chance of credential disclosure even when HTTPS is used. In this skill context, the file is an API client that will likely be reused broadly, so the unsafe secret-handling pattern is more dangerous because it propagates to every LLM request.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The Purpose section states that the Great Sage 'does not execute code,' presenting it as a planning-only persona. However, the documented installation step explicitly instructs execution of node skills/sage-planning/index.js install, which is a direct code-execution action tied to the skill. This is a documentation-level contradiction, even though it appears limited to setup rather than runtime behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The title string 🧙‍♂️ 大贤者：今日思维特训 is hard-coded in Chinese, which imposes a specific language for recipients. There is no indication in this file that the language is configurable, optional, or justified as a region-specific constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script removes the generated temporary file with rm "$OUTPUT_FILE" after sending. Although this cleanup is limited to a temp file created by the script, it is still a file deletion operation and the file's removal is not disclosed beyond the code itself.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This is a manifest file, so vague-trigger checks apply. The description only states the skill is a planning and reasoning persona, but gives no specific activation phrases, scope boundaries, or exclusion conditions, which can make invocation criteria ambiguous.

Content

No source excerpt is available for this finding.