Security audit
Security checks for vulnerabilities and agentic risk
This Quicker integration needs review because it can execute actions without confirmation, run code unexpectedly, and store remote-access credentials insecurely.
Prefer a corrected release that requires an actual action choice, removes shell interpretation, and checks dependencies without executing script-derived text. Raising the matching threshold does not fix the current confirmation bypass. Skip optional cloud credentials unless needed, protect configuration and Quicker backups, and avoid the blanket permissions command. The evidence supports concrete safety defects, not demonstrated malicious intent. Windows execution and live cloud-service behavior were not tested.
scripts/gen_run_action.pyScript text becomes executable Python during JSON generation
Arbitrary Python statements can execute with the generator user's privileges. For example, an import line containing import os;print('probe') survives extraction and executes the extra statement during probing. The same statement position permits arbitrary code, not merely dependency imports.
scripts/svg_raster.pyMalformed remote SVG paths cause an infinite parsing loop
The parsing worker consumes CPU indefinitely and prevents export completion. resolve_many() waits for futures without a timeout, so its exception handling cannot recover from the non-terminating parser.
The suggested recursive chmod sets every file and directory across all installed skills to mode 755, making previously private files readable by other local users where parent-directory access permits. It also marks ordinary files executable and changes unrelated skills, potentially exposing credentials or sensitive configuration.
Most functionality matches the declared Quicker integration and maintenance purpose. However, QuickerPushRunner.push_action and QuickerConnector.push_action introduce a separate remote execution route, whereas the description specifically identifies local QuickerStarter execution. This route reads push_user and push_code from config.json and sends them, together with action information and optional data, in an HTTPS POST to Quicker's cloud service. That external credential/data transfer and remote execution capability are material omissions, not merely supporting details of local execution. These calls occur when the push functionality is invoked, not automatically on import. The missing ActionType 11 generator is noted only as absent from the supplied chunk, not treated as evidence of undeclared behavior.
The commands modify skill configuration and control an OpenClaw service rather than operate on Quicker actions or settings. These are undeclared capabilities involving resources outside the stated Quicker integration, and the supplied chunk provides no connection establishing them as necessary supporting implementation details.
The command changes permissions for the entire skills tree, not merely Quicker-related resources. Mode 755 grants group and other users read and execute permissions and makes affected files executable. This broad permission change is not described by the declared purpose and exceeds a narrowly scoped supporting implementation detail.
The supplied commands deploy an updated OpenClaw skill and restart its host service. They do not read, search, execute, or maintain Quicker actions or configuration. Modifying the integration's own skill files and controlling the OpenClaw Gateway are distinct administrative operations not covered by the declared Quicker functionality.
Bulk icon export is disclosed in the body, but the documented fallback downloads contradict the categorical claims of no network access and no data transmission. Fetching URLs from action data can reveal request metadata or contact attacker-chosen destinations if URL validation and network restrictions are absent.
Checking paths and saving initialization settings are supporting implementation details consistent with the declared integration. However, the optional cloud-push setup introduces an undeclared execution channel and sensitive credential handling: push_user and push_code are collected interactively and written unencrypted to config.json. This chunk does not transmit credentials or execute remote actions, so no network access or actual remote execution is established. The absence of other advertised features in this initialization-only chunk is not itself a mismatch.
The supplied chunk's primary function is graphics rendering, which is not described in the declared Quicker integration and configuration-management purpose. It contains no Quicker-specific interaction or demonstrated connection between its image-rendering functions and the declared workflows. Icon rendering could be a supporting implementation detail in a larger skill, but that relationship is not established here. No network access, command execution, or configuration-file modification is present in this chunk.
The supplied commands expose a standalone icon-export capability, which is not described among action execution, configuration maintenance, or action JSON generation. Nothing in the chunk establishes that this export is merely an internal supporting step for those declared operations. The underlying Python implementation is not supplied, so this assessment is limited to the visible commands and comments.
Referenced artifact was not completely inspected
[:#AARRGGBB]`（字体图标） | 读取 Quicker 自带 `FontAwesomeIconsWpf.dll` 的 SVG 路径数据（已预提取为 `data/fontawesome5_svg_index.json.gz`，5996 个图标，覆盖 Solid/Regular/Light/Brands），纯 P
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
-BasicToolsSettingPage）。备份会复制 quicker.db 并移除访问密码，并将所有动作页和动作拆分为独立 JSON 文件。",
"file_types": [
{
"id": "actionpage",
"pattern": "actionpage_*.json",
"location": "export_root 根目录",
"purpose": "动作页（Profile）定义：面板布局与动作项",
"quicker_feature": "动作页/面板",
"description": "每个文件是一个动作页。ActionItems 是页面上放置的动作项；ExeFile/ExeFullpath 指示关联程序；ProfileType 3=单程序页。",
"key_fields": [
{
"name": "Id",
"desc": "动作页 ID"
},
{
"name": "Name/DisplayName",
"desc": "动作页名称"
},
{
"name": "ExeFile/ExeFullpath",
"desc": "关联程序（空/全局=通用页）"
},
{
"name": "ProfileType",
"desc": "页面类型（3=单程序页）"
},
{
Action identifiers and parameters are concatenated into an argument that is subsequently processed by a shell. An attacker able to influence these values can exploit Windows shell metacharacters to execute commands outside the intended Quicker operation; this is the same underlying issue as the synchronous subprocess finding.
try:
cmd = [self.starter_path]
if wait_for_result:
cmd.append(f"-c{timeout}")
# 构建动作调用参数
if action_identifier.startswith('quicker:'):
action_cmd = action_identifier
else:
action_cmd = f"runaction:{action_identifier}"
if parameters:
action_cmd = f"{action_cmd}?{parameters}"
cmd.append(action_cmd)
if wait_for_result:
process = subprocess.Popen(
cmd,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
text=True,
encoding='utf-8',
shell=True
)
stdout, stderr = process.communicate(timeout=timeout)
exit_code = process.returncode
return QuickerActionResult(
success=exit_code == 0,
output=stdout.strip(),
The asynchronous branch exposes the same attacker-influenced action argument to Windows shell interpretation. A crafted value can execute additional commands with the calling process's privileges, and detached execution does not mitigate that injection.
text=True,
encoding='utf-8',
shell=True
)
stdout, stderr = process.communicate(timeout=timeout)
exit_code = process.returncode
return QuickerActionResult(
success=exit_code == 0,
output=stdout.strip(),
error=stderr.strip() if stderr else None,
exit_code=exit_code
)
else:
subprocess.Popen(
cmd,
shell=True,
creationflags=subprocess.DETACHED_PROCESS
)
return QuickerActionResult(
success=True,
output="动作已启动"
)
except subprocess.TimeoutExpired:
return QuickerActionResult(
success=False,
output="",
error=f"动作执行超时（{timeout}秒）"
)
except Exception a
The documented policy treats a keyword-based relevance score as sufficient authorization to execute an action without confirmation. Quicker actions can invoke programs and modify user data, so an incorrect or manipulated match could cause consequential execution; restricting the initial executable to QuickerStarter does not restrict what the selected action does.
## Key Design Decisions
- **Dual data source**: CSV and DB readers share the same interface; CSV is preferred, DB is fallback
- `auto_select_threshold` (default 0.8) — if top match score ≥ this value, auto-execute without confirmation
- Permissions declared in `skill_optimized.json` restrict subprocess execution to `QuickerStarter.exe` paths and disable network access
Skipping confirmation solely because a match exceeds 0.8 conflates relevance with informed consent. This is especially risky for an automation launcher whose actions may have destructive or external effects, and is the same underlying authorization weakness as the other finding on this line.
## Key Design Decisions
- **Dual data source**: CSV and DB readers share the same interface; CSV is preferred, DB is fallback
- `auto_select_threshold` (default 0.8) — if top match score ≥ this value, auto-execute without confirmation
- Permissions declared in `skill_optimized.json` restrict subprocess execution to `QuickerStarter.exe` paths and disable network access
The documented trigger includes an everyday word that does not establish a request to use Quicker. Combined with this report's preference for automatic execution, this can route unrelated requests into local automation without sufficiently establishing user intent; the actual runtime trigger behavior is not shown.
The proposed trigger accepts “快速” without requiring a reference to Quicker. Because the same report directs automatic execution above a matching threshold, accidental activation can become an authorization problem rather than merely an irrelevant recommendation.
“帮我翻译这段文字” means “help me translate this text” and does not identify Quicker or request local automation. Presenting it as a trigger leaves the boundary between ordinary assistant translation and Quicker invocation unclear.
The skill specifies filesystem modification, process launching, and network-capable icon retrieval without declaring a machine-readable tool scope in this definition. Its prose restrictions do not enforce least privilege, although an independently enforced external manifest could mitigate the omission.
Triggers such as “quick” and “快速,” together with an ordinary translation example, can select this skill without an explicit request for local automation. The system prompt then prefers automatic execution above a match threshold, allowing broad routing to cross into consequential action without a distinct authorization check.
Generic triggers such as "quick" and "快速" can route unrelated requests into an integration capable of executing local automation. This is security-relevant because the same document encourages automatic execution based on matching scores rather than separately establishing authorization to use Quicker.
The everyday term "快速" does not establish intent to invoke Quicker, but is configured as an activation keyword for a subprocess-capable integration. Activation alone does not prove execution, yet it introduces an authorization ambiguity if downstream matching treats routing as permission to run an action.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def version_of(py: str) -> tuple[int, int, int]:
try:
r = subprocess.run(
[py, "-c", "import sys;print('%d.%d.%d'%sys.version_info[:3])"],
capture_output=True, text=True, timeout=15,
)
Dependency names extracted from script text are concatenated into executable Python source without strict validation; the import-line parser can retain semicolon-separated statements. Consequently, generating an action for an untrusted script can execute attacker-controlled code during interpreter detection, and even valid imports can execute module initialization code.
ok: list[tuple[tuple[int, int, int], str]] = []
for py in candidate_pythons():
try:
r = subprocess.run(
[py, "-c", "import " + ", ".join(mods)],
capture_output=True, text=True, timeout=15,
)
Combining --no-detach with --log still forces generation of a launcher whose Start-Process invocation detaches the target. Once imported and executed, the resulting action can leave a background process outside the lifecycle control the user explicitly requested.