文件上传

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:39 PM UTC
• Version: 1.0.1

Overview

This skill does what it says, but it can upload arbitrary local data to shareable storage over an unauthenticated plaintext connection with unclear expiry and scoping.

Install only if you intend agents to upload user-selected files to this internal BS3 bucket. Require explicit confirmation of the exact file path and destination before use, avoid secrets or regulated data, and prefer HTTPS, authenticated uploads, pinned dependencies, consistent bucket documentation, and a real expiry mechanism before broad deployment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: upload.py:15

Finding

File uploads are transmitted over an unauthenticated plaintext connection

Content

View full analysis

Vulnerability Details

File Location: upload.py, lines 15-31; upload operations at lines 61-66 and 82-86
Vulnerability Type: Plaintext transport and unsigned storage requests
Risk Level: High

Vulnerable Code

python

BS3_ENDPOINT = os.getenv("BS3_ENDPOINT", "http://bs3-hb1.internal")
BS3_BUCKET = os.getenv("BS3_BUCKET", "kim-mario-claw")
BS3_REGION = os.getenv("BS3_REGION", "hb1")

from botocore.session import Session

botocore_session = Session()
botocore_session.set_config_variable("region", BS3_REGION)

client = botocore_session.create_client(
    "s3",
    endpoint_url=BS3_ENDPOINT,
    config=Config(signature_version=UNSIGNED),
    use_ssl=False,
)

The resulting client uploads file contents directly to the configured bucket:

python

with open(file_path, "rb") as data:
    client.put_object(
        Body=data,
        Bucket=BS3_BUCKET,
        Key=obj_key
    )

python

client.put_object(
    Body=data,
    Bucket=BS3_BUCKET,
    Key=obj_key
)

Technical Analysis

The default storage endpoint uses HTTP rather than HTTPS. The S3-compatible client also explicitly disables SSL and selects UNSIGNED as the request signature version. Consequently, neither transport encryption nor request-level authentication protects uploaded content.

An attacker with access to a relevant network segment could passively inspect uploaded files or actively modify HTTP traffic. Because requests are unsigned, any party that can reach an endpoint configured to allow these operations may also attempt to submit arbitrary PutObject requests without possessing storage credentials.

The BS3_ENDPOINT, bucket, and region values can also be overridden through environment variables. If an attacker controls the process environment, uploaded data could be redirected to an attacker-controlled S3-compatible endpoint. The principal confirmed weakness remains the insecure p ...[truncated 1443 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the default endpoint with an HTTPS endpoint and set use_ssl=True.
2. Require valid certificate verification and do not suppress TLS validation.
3. Remove Config(signature_version=UNSIGNED) and use authenticated, short-lived credentials.
4. Assign a dedicated identity with permission to upload only to a narrowly scoped bucket prefix.
5. Configure the bucket policy to reject anonymous requests and requests not transported over TLS.
6. Apply server-side upload size limits, content-type controls, quotas, malware scanning, and lifecycle rules.
7. Protect environment configuration so untrusted callers cannot redirect BS3_ENDPOINT or change the destination bucket.
8. Consider validating the configured endpoint against an approved allowlist before sending data.
9. Log upload identities and object destinations while avoiding disclosure of confidential file contents.
10. Review existing bucket access policies and remove any unnecessary anonymous read or write access.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Python dependencies are installed without version or integrity pinning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-17 and line 28
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

yaml

"requires": { "bins": ["python3"], "pip": ["boto3", "botocore"] },
"install":
  [
    {
      "id": "pip",
      "kind": "pip",
      "packages": ["boto3", "botocore"],
      "label": "Install boto3 and botocore via pip",
    },
  ],

The documented installation command is also unpinned:

bash

pip3 install boto3 botocore

Technical Analysis

Both dependencies are specified only by package name. No reviewed version constraints, lock file, package hashes, or trusted-index restrictions are supplied. Installation therefore resolves whichever versions the configured Python package index considers current at installation time.

This makes builds non-reproducible and increases exposure to supply-chain incidents. If a dependency release or package repository is compromised, a future skill installation could retrieve attacker-controlled code despite the skill source itself remaining unchanged. Unexpected incompatible releases could also alter runtime security behavior.

No evidence was found that the project intentionally references a typosquatted package or an untrusted repository. The finding concerns the absence of dependency pinning and integrity controls.

Attack Path

1. An attacker compromises a dependency maintainer account, distribution infrastructure, or package index used by the installation environment.
2. The attacker publishes a malicious release under one of the unpinned dependency names.
3. A user installs the skill dependencies with the documented command or automated installation metadata.
4. The package resolver selects the malicious release because no approved version or hash is required.
5. Attacker-controlled package code executes during installation, import, or subsequent skill invoca ...[truncated 543 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin both direct dependencies to reviewed versions using exact constraints.
2. Generate and maintain a lock file that includes resolved transitive dependency versions.
3. Require cryptographic hashes for every downloaded distribution, for example through a hash-locked requirements file.
4. Install only from an approved, authenticated package repository or controlled internal mirror.
5. Disable unintended fallback to public indexes where organizational policy requires an internal repository.
6. Add automated dependency vulnerability and provenance scanning to the release process.
7. Test and review dependency upgrades before updating pinned versions.
8. Prefer isolated virtual environments and avoid installing skill packages with administrative privileges.
9. Ensure installation metadata and the documented command use the same pinned dependency manifest.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

~/.openclaw/workspace/skills/file-upload/ ├── SKILL.md # 技能文档 ├── upload.py # Python 脚本 └── .env # 可选配置（如需要）

text

---

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill declares executable/installable capabilities and references environment-based configuration, but it does not explicitly constrain tool scope with permissions or allowed-tools. In an agent setting, that increases the chance the skill can access local environment data or perform actions beyond what users reasonably expect during a file upload workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation description is broad enough to match many ordinary requests about files, images, and documents, which can cause the agent to invoke this upload skill without clear user intent to publish data. In this context, that is dangerous because the skill creates shareable URLs for potentially sensitive local content, increasing the risk of unintended data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill does not clearly warn users that uploaded files become accessible through shareable URLs, which can expose confidential data if users think this is merely an internal save operation. In a file-upload skill, omission of that disclosure is especially risky because users may provide documents, screenshots, or reports containing sensitive information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example trigger phrases are vague and include requests like 'save this data' or 'upload this screenshot' without guardrails, which encourages automatic handling of sensitive material. Because the skill uploads to an internal store and returns a shareable URL, ambiguous triggers materially increase the chance of unintended disclosure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The function tells users the returned link is valid for 7 days, but it only builds a static object URL and does not create any expiring token or signed URL. This can mislead users into sharing sensitive content under the false assumption that access will automatically expire, when the object may remain accessible as long as bucket/object permissions allow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code reads a local file and sends its contents to a remote BS3 storage service via put_object, but the function and surrounding comments/docstrings do not warn users that local data will be transmitted off-host. The CLI reports success after upload, but it does not disclose the privacy or data-handling implications before or during the operation.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This code uploads arbitrary local file contents to remote object storage, which is an exfiltration primitive if an untrusted caller can choose the file path or trigger the skill on sensitive files. The risk is heightened because the client is configured for unsigned access over plain HTTP to an internal endpoint, reducing transport and request-authentication assurances.

Content

Scanner excerpt · upload.py (reported line 68)May include surrounding context.

python

obj_key = _unique_key(key)
    
    with open(file_path, "rb") as data:
        client.put_object(
            Body=data,
            Bucket=BS3_BUCKET,
            Key=obj_key

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This function uploads arbitrary bytes directly to cloud storage, creating a generic data exfiltration channel. In an agent skill context, that is dangerous because any upstream component able to supply sensitive in-memory data could persist it externally without strong guardrails, and the use of unsigned HTTP further weakens the security posture.

Content

Scanner excerpt · upload.py (reported line 91)May include surrounding context.

python

"""
    obj_key = _unique_key(key)
    
    client.put_object(
        Body=data,
        Bucket=BS3_BUCKET,
        Key=obj_key

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The upload_bytes function sends provided binary data to BS3, but its docstring only says 'upload' and does not warn that the bytes are transmitted to a remote storage endpoint. Under the stated criteria for code files, network calls that transmit user or system data should have some user disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The description line combines Chinese text with English instructions, implicitly fixing the skill's documentation style without offering any language preference or opt-in. This may violate language/locale policy where user-facing skill content should respect user language choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation claims a fixed bucket of kkim-mario-claw and later repeats that bucket name, but the example returned URL uses the path segment kim-mario-claw, and the FAQ says the bucket name contains temp. These statements cannot all be true at once, so the skill's documentation gives conflicting intent about the actual upload target and retention expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill describes generating a shareable file URL and earlier emphasizes unsigned internal BS3 uploads, which implies a stable object URL rather than a time-limited signed link. The note that the returned link is valid for only 7 days introduces a contradictory expectation about what kind of URL is actually produced.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Multiple user-facing strings and docstrings are presented only in Chinese, such as the file description and command descriptions, with no indication that users can choose another language. The policy specifically calls out language or locale constraints that are imposed without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The command help labels 'upload_bytes <file_path>' as uploading binary content, which implies byte-oriented input, but the CLI takes a filesystem path and reads the file in lines 137-138. This is not just incomplete wording; it describes a different input mode than what the command actually supports.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.