Openclaw Aligenie Genie

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:42 AM UTC
• Version: 1.0.2

Overview

The skill has a coherent Tmall Genie relay purpose, but its documented public plain-HTTP deployment and overprivileged persistence create real security review concerns.

Review before installing. Only use this with a trusted self-managed server behind HTTPS, restricted firewall rules, and narrowly scoped API keys. Do not follow the public plain-HTTP examples for real credentials, avoid the Administrator scheduled task from C:\temp, pin and verify dependencies, and confirm server-side permissions before enabling destructive device or agent management endpoints.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: genie_client.py:39

Finding

API keys, session keys, and message data are transmitted over plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: genie_client.py:39-58; supporting deployment configuration at SKILL.md:39, DEPLOY.md:103-124, and SPEC.md:361
Vulnerability Type: Cleartext transmission of credentials and private message content
Risk Level: High

Vulnerable Code

python

def __init__(self, server_url: str = None, agent_id: str = None, api_key: str = None):
    self.server_url = server_url or DEFAULT_SERVER
    self.agent_id = agent_id or os.environ.get("ALIGENIE_AGENT_ID", "")
    self.api_key = api_key or os.environ.get("ALIGENIE_API_KEY", "")
    self._session = requests.Session()
    self._session.headers["Content-Type"] = "application/json"
    if self.api_key:
        self._session.headers["X-Api-Key"] = self.api_key

def _url(self, path: str) -> str:
    return f"{self.server_url.rstrip('/')}{path}"

def register(self, session_key: str = "", timeout: int = 30) -> dict:
    """Register this agent with the server."""
    r = self._session.post(
        self._url("/genie/register"),
        json={"agentId": self.agent_id, "sessionKey": session_key, "timeout": str(timeout)},
        timeout=10,
    )
    r.raise_for_status()
    return r.json()

The documented configuration explicitly uses plaintext HTTP:

python

client = GenieClient(
    server_url="http://101.43.110.225:58472",
    agent_id="lobster",
    api_key="ak_xxx"
)

text

| TCP | 58472 | 0.0.0.0/0 | HTTP API |

bash

curl -H "X-Api-Key: ak_xxx" http://101.43.110.225:58472/api/v1/devices

Technical Analysis

The client places the API key in the X-Api-Key header and transmits the registration session key in a JSON body. The same session is also used to poll voice requests and submit replies. The documented remote endpoint uses http:// and is exposed to 0.0.0.0/0.

Header-based authentication provides no transport confidentiality or server authenticity. W ...[truncated 1414 chars]

Remediation

View remediation

Remediation Suggestions

• Require HTTPS for every non-loopback server URL and reject plaintext HTTP by default.
• Place the Java backend behind a TLS reverse proxy using a valid, automatically renewed certificate.
• Redirecting HTTP is insufficient for credential-bearing requests; disable or reject plaintext API traffic.
• Restrict port 58472 so only the reverse proxy or explicitly authorized source networks can reach it.
• Use narrowly scoped, expiring API keys instead of broadly privileged credentials.
• Rotate all API keys and session keys that may previously have crossed an untrusted network.
• Consider certificate pinning or mutual TLS where the operating environment supports it.
• Avoid exposing management endpoints on the same unrestricted public listener as webhook traffic.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: DEPLOY.md:51

Finding

Persistent scheduled task runs server code from a temporary directory as Administrator

Content

View full analysis

Vulnerability Details

File Location: DEPLOY.md:51-55
Vulnerability Type: Overprivileged scheduled-task persistence
Risk Level: Medium

Vulnerable Code

powershell

### 5. Configure automatic startup (optional)

# Create scheduled task
schtasks /create /tn AligenieServer /tr "java -cp C:\temp AligenieServer --port 58472" /sc onlogon /ru Administrator

Technical Analysis

Persistent operation can be legitimate for a relay server, but the documented task runs under the built-in Administrator account even though a Java process listening on the non-privileged port 58472 does not require administrative authority.

The task loads its application class from C:\temp, which is not an appropriate trusted installation directory for privileged persistent software. The command also relies on resolving java through the task's environment rather than specifying a trusted absolute executable path. If an insufficiently privileged user can replace the class or influence executable resolution, the scheduled task can become a privilege-escalation mechanism.

The /sc onlogon trigger also ties server availability to an Administrator logon rather than using a restricted service identity and controlled service lifecycle.

Attack Path

1. The operator creates the documented scheduled task as Administrator.
2. An attacker obtains write access to C:\temp\AligenieServer.class, another class loaded from that directory, or an applicable dependency.
3. The attacker replaces the file with code under their control.
4. An Administrator logs on, triggering the persistent task.
5. The substituted code executes with the Administrator account's privileges.

A similar path may exist if the task resolves an attacker-controlled java executable through an unsafe environment, although exploitability depends on the task's effective path resolution and filesystem permissions.

Impact Assessment

Successful exploit ...[truncated 353 chars]

Remediation

View remediation

Remediation Suggestions

• Run the server under a dedicated, non-administrative service account with no interactive logon rights.
• Install application files under a dedicated directory such as C:\Program Files\AligenieServer, not C:\temp.
• Configure ACLs so only Administrators and the deployment mechanism can modify executable files and dependencies.
• Use absolute paths for the Java executable, application classes, JAR files, working directory, and log destinations.
• Prefer a properly configured Windows service with restricted privileges and recovery settings over an Administrator logon task.
• Grant only the filesystem and network permissions required to read application files, write the database, and bind port 58472.
• Record the persistence mechanism clearly and require explicit operator consent before installation.

T08 · Insecure Dependencies

Warning

• Location: DEPLOY.md:23

Finding

Unpinned and unverified JDBC dependency is executed by the server

Content

View full analysis

Vulnerability Details

File Location: DEPLOY.md:23-48
Vulnerability Type: Unverified executable third-party dependency
Risk Level: Medium

Vulnerable Code

powershell

# Download SQLite JDBC if it is not already present
# Download sqlite-jdbc-xxx.jar from https://github.com/xerial/sqlite-jdbc/releases

# Upload files from the local machine
scp -i ~/.ssh/id_rsa_workspace_backup sqlite-jdbc-xxx.jar Administrator@101.43.110.225:C:/temp/
scp -i ~/.ssh/id_rsa_workspace_backup AligenieServer.java Administrator@101.43.110.225:C:/temp/

powershell

cd C:\temp
javac -encoding UTF-8 -cp .;sqlite-jdbc-xxx.jar AligenieServer.java

powershell

cd C:\temp
java -cp ".;sqlite-jdbc-xxx.jar" AligenieServer --port 58472

Technical Analysis

The deployment instructions use the placeholder sqlite-jdbc-xxx.jar rather than pinning an exact release. They provide no expected SHA-256 digest, signature, or other integrity verification step.

Although the named GitHub project is a recognizable upstream source, users can select an unintended version, download a substituted artifact, or execute a file that was altered after download. The JAR is placed directly on the Java classpath, so its code can execute in the server process. The risk is amplified by the separate recommendation to launch the application through an Administrator scheduled task.

The two scp -i commands read an existing SSH private key for authentication; they do not write to or modify SSH key files. The principal vulnerability is the lack of dependency pinning and verification, not SSH-key modification.

Attack Path

1. An operator downloads a file matching the generic sqlite-jdbc-xxx.jar instruction.
2. The artifact is malicious, compromised, incorrectly sourced, or altered before deployment.
3. The operator uploads it to C:\temp.
4. The operator compiles or starts the server with the artifact on the classpath.

...[truncated 551 chars]

Remediation

View remediation

Remediation Suggestions

• Pin an exact SQLite JDBC release and exact artifact filename.
• Publish the expected SHA-256 digest in the deployment documentation and verify it before compilation or execution.
• Verify upstream signatures or attestations where available.
• Retrieve dependencies through a reproducible dependency manager or authenticated internal artifact repository.
• Prevent ordinary users from replacing deployed JARs by applying restrictive filesystem ACLs.
• Maintain a dependency inventory and defined update process for security patches.
• Run the server under a dedicated unprivileged identity so dependency compromise does not immediately provide administrative access.

T09 · Insecure Skill Coding Practices

Note

• Location: genie_client.py:123

Finding

Callback exception details are disclosed to remote requesters

Content

View full analysis

Vulnerability Details

File Location: genie_client.py:123-130
Vulnerability Type: Information disclosure through verbose remote errors
Risk Level: Low

Vulnerable Code

python

try:
    reply = callback(req)
    if reply and rid:
        self.submit_result(rid, reply)
        print(f"[Poll] Reply sent: {reply[:80]}")
except Exception as e:
    print(f"[Poll] Callback error: {e}", file=sys.stderr)
    if rid:
        self.submit_result(rid, f"Processing error: {e}")

The final string above represents the source behavior in English: the implementation sends the caught exception text, interpolated through {e}, as the remote result.

Technical Analysis

The polling loop catches every exception raised by the caller-provided callback and sends its string representation to the relay. Exception messages are not designed as a safe external interface and can contain local paths, backend hostnames, database details, configuration values, request content, library versions, or other operational information.

Whether sensitive data is exposed depends on the callback implementation and the exception triggered. The client provides no sanitization, error classification, or separation between internal diagnostics and user-facing messages.

Attack Path

1. A remote requester submits an utterance that reaches the registered agent.
2. The callback processes attacker-controlled request fields.
3. Crafted input causes the callback or a downstream component to throw a descriptive exception.
4. The client converts the exception to text and submits it through /genie/result.
5. The requester receives internal diagnostic information in the device response or associated relay output.
6. The requester uses the disclosed details to refine subsequent attacks against the callback, filesystem, database, or dependent services.

Impact Assessment

The direct impact is information disclosure rather tha ...[truncated 293 chars]

Remediation

View remediation

Remediation Suggestions

• Return a generic user-facing message such as Request processing failed without including the exception text.
• Generate a random correlation identifier and include only that identifier in the remote response.
• Write detailed exceptions to protected local logs with appropriate access controls.
• Sanitize logs to prevent credentials, session keys, utterances, or personal data from being recorded unnecessarily.
• Catch expected exception types separately and map them to stable, non-sensitive error codes.
• Add tests that trigger representative callback failures and verify that internal details are not included in submitted results.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · DEPLOY.md (reported line 29)May include surrounding context.

从 https://github.com/xerial/sqlite-jdbc/releases 下载 sqlite-jdbc-xxx.jar

上传文件（在本机执行）

scp -i ~/.ssh/id_rsa_workspace_backup sqlite-jdbc-xxx.jar Administrator@101.43.110.225:C:/temp/ scp -i ~/.ssh/id_rsa_workspace_backup AligenieServer.java Administrator@101.43.110.225:C:/temp/

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · DEPLOY.md (reported line 30)May include surrounding context.

从 https://github.com/xerial/sqlite-jdbc/releases 下载 sqlite-jdbc-xxx.jar

上传文件（在本机执行）

scp -i ~/.ssh/id_rsa_workspace_backup sqlite-jdbc-xxx.jar Administrator@101.43.110.225:C:/temp/ scp -i ~/.ssh/id_rsa_workspace_backup AligenieServer.java Administrator@101.43.110.225:C:/temp/

text

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide instructs operators to expose the service on TCP 58472 to 0.0.0.0/0 and advertises a public HTTP API endpoint, but provides no requirement for TLS, reverse proxying, IP restriction, or VPN/private-network access. Because this service stores account, device, and API key data and supports management operations, publishing it directly to the Internet materially increases the risk of unauthorized access, interception, scanning, and attack surface exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation shows X-Api-Key authentication sent over plain HTTP to a public IP address, which exposes credentials and requests to interception or modification by any network observer or on-path attacker. In this skill’s context, the API appears to manage devices and agent communications, so compromise of the API key could allow unauthorized control or data access.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SPEC.md (reported line 196)May include surrounding context.

Body: {"name": "agent-key", "permissions": ["push", "poll"], "expiresAt": "2027-01-01T00:00:00Z"} Response: {"apiKey": "ak_xxxx_full_key", "id": "uuid", "name": "agent-key"}

DELETE /api/v1/keys/:id Header: X-Api-Key: ak_xxx (需要 admin 权限) Response: {"success": true}

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

The device deletion endpoint is destructive, but the spec only shows possession of an API key and does not state a distinct write/admin permission requirement. In an agent-integrated system, insufficiently scoped deletion capability can let any compromised or over-privileged key remove bound devices, causing denial of service and breaking user-device trust relationships.

Content

Scanner excerpt · SPEC.md (reported line 208)May include surrounding context.

Header: X-Api-Key: ak_xxx Response: [{"id": "uuid", "openId": "ou_xxx", "deviceType": "speaker", "boundAt": "..."}]

DELETE /api/v1/devices/:id Header: X-Api-Key: ak_xxx Response: {"success": true}

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SPEC.md (reported line 221)May include surrounding context.

Response: {"code": "384721", "expiresAt": "2026-03-30T12:10:00Z", "expiresIn": 300} 注意：6位数字，5分钟有效，同一用户最多3个未使用验证码

DELETE /api/v1/verifycodes/active Header: X-Api-Key: ak_xxx 作废当前用户所有未使用的验证码

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 82% confidence

Finding

Deleting an agent is a high-impact destructive action because it can sever bindings and disable the communication path between OpenClaw and 天猫精灵 devices. The spec does not state that DELETE /api/v1/agents/:id requires agent:write or admin permission, so a lower-privileged API key may be able to remove agents if implementation follows the spec loosely.

Content

Scanner excerpt · SPEC.md (reported line 239)May include surrounding context.

Response: {"id": "uuid", "agentId": "lobster", "pushKey": "pk_xxx_full_key"} 注意：pushKey 只在创建时返回一次，之后不存储原文

DELETE /api/v1/agents/:id Header: X-Api-Key: ak_xxx Response: {"success": true}

text

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill demonstrates network access and use of environment-style configuration values such as API keys, but it does not declare any explicit tool scope or permissions boundary. This weakens least-privilege controls and makes it harder for a host platform or reviewer to understand and constrain what the skill can access, increasing the risk of unintended outbound communication or secret misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger conditions are broad enough to overlap with normal conversation, such as any request to communicate with Tmall Genie or receive its messages. Overbroad activation can cause accidental invocation of the skill, resulting in unintentional data transmission, command handling, or exposure of connected-agent functionality without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that it performs bidirectional communication through a cloud server, yet it does not disclose what data is transmitted, stored, or retained, nor the privacy implications for users. Because the skill handles messages and commands across systems, accidental sharing of personal content, device state, or authentication-related metadata becomes more likely when users are not clearly informed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The deployment instructions tell operators to have users speak a numeric phrase to Tianmao Genie, and the overall document is written as a Chinese-only interaction spec without any opt-in or alternative locale handling. Under the policy, forcing a specific language or locale without user choice is a natural-language policy concern unless the regional constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The polling loop sends the natural-language message "处理出错" as an error reply when callback processing fails. This forces a specific language for user-visible output, and the file does not offer a language choice or document a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The entire skill file is written in Chinese and does not offer an alternative language or state that the skill is intended only for Chinese-speaking users or a China-specific operational context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

整个技能说明以中文呈现，且围绕“天猫精灵”交互展开，但未说明这是面向特定中文用户群体的区域性技能，也未给出语言选择或用户需自行选择语言的说明。根据该规则，若技能在自然语言层面强制特定语言且无 opt-in 或明确合理化，构成潜在政策问题。

Content

No source excerpt is available for this finding.