三只虾协作系统

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:44 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent task-collaboration automation, but it enables persistent background monitoring and can send task details to hard-coded or unvalidated Feishu destinations.

Review this skill carefully before installing. It is tailored to a specific local account and Feishu recipient, and it can create persistent background jobs that keep monitoring workspace files after setup. Replace hard-coded paths and recipients, inspect or supply the missing plist files yourself, disable automatic external notifications unless intended, and avoid running the queue reset commands unless you have a verified backup.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T06 · System Persistence

Error

• Location: install.sh:48

Finding

Persistent LaunchAgent and Cron Registration Executes Mutable Workspace Scripts

Content

View full analysis

/dev/null || true fi if launchctl list | grep -q "com.openclaw.fswatch"; then launchctl unload "$LAUNCH_AGENTS_DIR/com.openclaw.fswatch.plist" 2>/dev/null || true fi # Load new configurations launchctl load "$LAUNCH_AGENTS_DIR/com.openclaw.heartbeat.plist" launchctl load "$LAUNCH_AGENTS_DIR/com.openclaw.fswatch.plist" ``` From `docs/shrimp-heartbeat-config.md`: ```xml ProgramArguments /Users/zhangyang/.openclaw/workspace/scripts/heartbeat-check.sh StartCalendarInterval Hour8Minute0 Hour9Minute0 Hour10Minute0 Hour11Minute0 Hour12Minute0 Hour13Minute0 Hour14Minute0 Hour15Minute0 Hour16

Remediation

View remediation

T02 · Agent Memory Poisoning

Warning

• Location: docs/shrimp-collaboration-protocol.md:24

Finding

Shared Task and Document Content Can Influence Persistent Agent Memory

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: docs/shrimp-task-notification.md:56

Finding

Mandatory Task Notifications Target a Hard-Coded Feishu User

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/notify-task-complete.sh:50

Finding

Task Details Are Sent to an Unvalidated Webhook Using Unsafe JSON Construction

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fswatch-monitor.sh:8

Finding

Hard-Coded User Workspace Produces Unsafe and Non-Portable Execution Boundaries

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: install.sh:10

Finding

Installer Automatically Installs an Unpinned Homebrew Dependency

Content

View full analysis

/dev/null; then echo " ⚠️ fswatch is not installed; installing..." brew install fswatch else echo " ✅ fswatch is installed" fi ``` ### Technical Analysis The installer automatically invokes Homebrew to install the current `fswatch` formula. It does not request separate confirmation, document a reviewed version, verify an artifact checksum, or validate the resolved package source. Homebrew is a recognized package manager, so this is not evidence that the current dependency is malicious. The security concern is that the dependency resolved at installation time can differ from the version reviewed with the Skill, expanding the effective trusted computing base. ### Attack Path 1. The user runs `install.sh` on a system without `fswatch`. 2. The script automatically invokes `brew install fswatch`. 3. Homebrew resolves the formula and artifacts available at that time. 4. If the formula source, repository, package infrastructure, or resolved artifact is compromised, malicious installation or runtime code executes with the user's privileges. 5. The installed binary is subsequently used by the persistent file-monitoring service. ### Impact Assessment A compromised dependency could execute with the installing user's privileges and later operate continuously through the fswatch LaunchAgent. Under normal Homebrew operation, the practical risk is low; no evidence of an actually malicious package or typosquatted dependency was found. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (85)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section contains a full heredoc overwrite of tasks/queue.md that resets the task file contents, which will erase all existing queued, in-progress, and completed task data. Because the command is presented as a repair step without a prominent destructive-action warning, it creates a high risk of accidental operational data loss if executed by a user or autonomous agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script copies LaunchAgent plist files into ~/Library/LaunchAgents and loads them immediately with launchctl, establishing persistence and starting background services without explicit opt-in. This is dangerous because persistent agents execute beyond the installer session, can monitor or modify user activity depending on plist contents, and are a common persistence mechanism abused by unwanted software.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README provides destructive file-modification commands that overwrite queue data without an explicit warning about data loss or safeguards such as confirmation, backup validation, or scoped editing. In an agent skill context, users or downstream agents may copy these commands verbatim, causing unintended loss of task history or corruption of the shared coordination file.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 257)May include surrounding context.

重启服务

launchctl unload ~/Library/LaunchAgents/com.openclaw.fswatch.plist launchctl load ~/Library/LaunchAgents/com.openclaw.fswatch.plist

text

### 问题 2：通知没收到

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill instructs users to copy launchd plist files into ~/Library/LaunchAgents, establishing user-session persistence for the monitoring and heartbeat components. Persistence is not inherently malicious here, but it is security-relevant because it causes code to auto-run on login and increases the blast radius of any unsafe behavior in the referenced scripts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

bash

# 加载 launchd 配置
cp scripts/com.openclaw.heartbeat.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/com.openclaw.heartbeat.plist

# 加载 fswatch 监控

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This finding reflects the same persistence behavior associated with the heartbeat LaunchAgent plist referenced in the installation instructions. Even if intended for convenience, instructing users to install persistent agents without a security notice can surprise users and create ongoing background execution beyond the immediate task.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

bash

# 加载 launchd 配置
cp scripts/com.openclaw.heartbeat.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/com.openclaw.heartbeat.plist

# 加载 fswatch 监控
cp scripts/com.openclaw.fswatch.plist ~/Library/LaunchAgents/

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This finding reflects the same persistence behavior associated with the heartbeat LaunchAgent plist referenced in the installation instructions. Even if intended for convenience, instructing users to install persistent agents without a security notice can surprise users and create ongoing background execution beyond the immediate task.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

bash

# 加载 launchd 配置
cp scripts/com.openclaw.heartbeat.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/com.openclaw.heartbeat.plist

# 加载 fswatch 监控
cp scripts/com.openclaw.fswatch.plist ~/Library/LaunchAgents/

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The fswatch LaunchAgent plist is another persistence mechanism that keeps file-monitoring logic running automatically in the user session. Persistent filesystem monitoring is especially sensitive because it can observe task file changes continuously and may trigger downstream notifications containing those contents.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

launchctl load ~/Library/LaunchAgents/com.openclaw.heartbeat.plist

加载 fswatch 监控

cp scripts/com.openclaw.fswatch.plist ~/Library/LaunchAgents/ launchctl load ~/Library/LaunchAgents/com.openclaw.fswatch.plist

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicate plist-related finding corresponds to the same fswatch persistence mechanism. The danger comes from unattended continued execution of local monitoring code, not from the plist file format itself, and the skill currently does not frame that risk clearly.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

加载 fswatch 监控

cp scripts/com.openclaw.fswatch.plist ~/Library/LaunchAgents/ launchctl load ~/Library/LaunchAgents/com.openclaw.fswatch.plist

text

### 3. 验证状态

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicate plist-related finding corresponds to the same fswatch persistence mechanism. The danger comes from unattended continued execution of local monitoring code, not from the plist file format itself, and the skill currently does not frame that risk clearly.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

加载 fswatch 监控

cp scripts/com.openclaw.fswatch.plist ~/Library/LaunchAgents/ launchctl load ~/Library/LaunchAgents/com.openclaw.fswatch.plist

text

### 3. 验证状态

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly describes automatic completion notifications that send task names, executors, timestamps, and results to Feishu, but it does not warn users that task content may be transmitted to an external service. In a multi-agent workflow, task details can easily contain sensitive business, personal, or internal operational data, so undisclosed outbound transmission creates a meaningful privacy and data-leak risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to configure a Feishu webhook and user ID but gives no warning that these are sensitive integration values and that messages will be delivered to an external platform. This omission can lead users to mishandle secrets, commit them to files or shells, and enable unintended exfiltration of task data to third-party endpoints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The workflow explicitly describes automatically reading pending notification files and sending Feishu messages to a boss, but it does not mention any user consent, approval gate, recipient validation, or data-classification check before outbound transmission. That creates a real risk of unintended disclosure if task results or notification files contain sensitive internal information, credentials, personal data, or misdirected content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document explicitly describes an automated heartbeat that performs recurring queue checks, full file reads, and cleanup actions on a schedule, but it does not include meaningful warnings, consent boundaries, or safeguards around what data will be accessed and modified. In an agent skill context, unattended periodic reads and cleanup can expand data exposure and trigger unintended state changes without a fresh user decision each time.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

Writing a LaunchAgent plist into ~/Library/LaunchAgents sets up a macOS persistence artifact that can cause the heartbeat script to run automatically in future sessions. In the context of an agent skill, this is risky because it installs unattended recurring execution tied to the user environment.

Content

Scanner excerpt · docs/shrimp-heartbeat-config.md (reported line 38)May include surrounding context.

md

# 创建目录
mkdir -p ~/Library/LaunchAgents

# 创建 plist 文件
cat > ~/Library/LaunchAgents/com.openclaw.heartbeat.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This heredoc command writes the LaunchAgent configuration file, which is a concrete step toward persistent scheduled execution. Even if intended for convenience, creating persistence from within skill instructions can lead to unnoticed long-term automation and repeated access to local data.

Content

Scanner excerpt · docs/shrimp-heartbeat-config.md (reported line 39)May include surrounding context.

md

mkdir -p ~/Library/LaunchAgents

# 创建 plist 文件
cat > ~/Library/LaunchAgents/com.openclaw.heartbeat.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
 "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 98% confidence

Finding

launchctl load activates the LaunchAgent, causing the configured heartbeat script to run automatically on schedule in future sessions. This is classic user-level persistence and is especially sensitive in a skill because it enables ongoing autonomous execution against local workspace files and logs.

Content

Scanner excerpt · docs/shrimp-heartbeat-config.md (reported line 94)May include surrounding context.

bash

# 加载
launchctl load ~/Library/LaunchAgents/com.openclaw.heartbeat.plist

# 检查状态
launchctl list | grep openclaw.heartbeat

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 98% confidence

Finding

launchctl load activates the LaunchAgent, causing the configured heartbeat script to run automatically on schedule in future sessions. This is classic user-level persistence and is especially sensitive in a skill because it enables ongoing autonomous execution against local workspace files and logs.

Content

Scanner excerpt · docs/shrimp-heartbeat-config.md (reported line 94)May include surrounding context.

bash

# 加载
launchctl load ~/Library/LaunchAgents/com.openclaw.heartbeat.plist

# 检查状态
launchctl list | grep openclaw.heartbeat

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This instruction tells the user to install a cron job that will run the heartbeat script automatically every hour during the workday, creating persistence across sessions. In a skill repository, persistence is security-relevant because it causes code or automation to continue executing after the original interaction ends, potentially reading files and appending logs indefinitely.

Content

Scanner excerpt · docs/shrimp-heartbeat-config.md (reported line 111)May include surrounding context.

bash

# 编辑 crontab
crontab -e

# 添加以下内容（每小时 8:00-17:00）
0 8-17 * * * /Users/zhangyang/.openclaw/workspace/scripts/heartbeat-check.sh >> /Users/zhangyang/.openclaw/logs/heartbeat.log 2>&1

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · docs/shrimp-heartbeat-config.md (reported line 174)May include surrounding context.

md

launchctl list | grep openclaw.heartbeat

# cron
crontab -l

# 进程
ps aux | grep heartbeat

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The quickstart tells the user to run a setup script that configures an automatic heartbeat service, but it does not warn that this likely installs persistent launchd behavior and scheduled execution. That creates a transparency and consent problem: users may enable recurring background activity and file access without understanding the scope or persistence of the change.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The heartbeat design explicitly describes scheduled reads of workspace files and scheduled updates to task and memory files, but it does not present this as a consent-sensitive automated behavior. A system that periodically reads and mutates user data on a timer can surprise users, overwrite content, or expose sensitive information if they were not clearly informed and opted in.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The documented file structure includes a launchd plist for the heartbeat, indicating a persistence mechanism that causes code to run automatically over time. Persistence is security-relevant because it increases the blast radius of any misconfiguration or malicious modification to the heartbeat scripts and normalizes background execution.

Content

Scanner excerpt · docs/shrimp-heartbeat-quickstart.md (reported line 150)May include surrounding context.

md

├── scripts/
│   ├── heartbeat-check.sh          # 心跳检查脚本
│   ├── setup-heartbeat.sh          # 配置脚本
│   └── com.openclaw.heartbeat.plist # launchd 配置
└── logs/
    ├── heartbeat-stdout.log        # 标准输出
    └── heartbeat-stderr.log        # 错误输出

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The instructions to unload and reload a LaunchAgent confirm that the skill relies on session persistence through launchd. Even though this section is framed as control and debugging, it still documents persistent scheduled execution that could continue reading logs and workspace files without continual user awareness.

Content

Scanner excerpt · docs/shrimp-heartbeat-quickstart.md (reported line 180)May include surrounding context.

临时关闭心跳

bash

# 卸载服务
launchctl unload ~/Library/LaunchAgents/com.openclaw.heartbeat.plist

# 重新加载
launchctl load ~/Library/LaunchAgents/com.openclaw.heartbeat.plist

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The reference to the LaunchAgent plist at the reload step reinforces use of a persistent autostart configuration. The risk is not that a plist exists by itself, but that persistent background automation is being enabled in combination with scripts that monitor, read, and modify workspace state on a schedule.

Content

Scanner excerpt · docs/shrimp-heartbeat-quickstart.md (reported line 183)May include surrounding context.

launchctl unload ~/Library/LaunchAgents/com.openclaw.heartbeat.plist

重新加载

launchctl load ~/Library/LaunchAgents/com.openclaw.heartbeat.plist

text

---

Static analysis

No suspicious patterns detected.