T08 · Insecure Dependencies
Warning
- Location
references/layer3-skills.md:5- Finding
Unpinned Third-Party Skill Installation Commands Create Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
AgentLove
Security checks for vulnerabilities and agentic risk
Overview
AgentLove appears to be a low-permission conversational setup wizard, but users should not treat its recommendations as completed installations or paste credentials into it.
Install only if you want a Chinese-first setup-planning wizard. Treat its output as a checklist, not proof that an agent, backup, platform binding, or skill installation has actually happened. Configure platform secrets only in the official OpenClaw console, review any separately recommended skills before installing them, and avoid sending personal data or credentials because runtime logging is not comprehensively redacted.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.js:129- Finding
Incomplete Log Redaction Can Expose Credentials and Personal Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (28)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill markets itself as providing backup migration, marriage/evolution workflows, and one-click robot creation, but the body only collects preferences and instructs the user to perform actions manually. This kind of description-behavior mismatch can mislead users into overtrusting the skill, causing unsafe assumptions about what was actually configured, backed up, or protected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill markets itself as providing backup migration, marriage/evolution workflows, and one-click robot creation, but the body only collects preferences and instructs the user to perform actions manually. This kind of description-behavior mismatch can mislead users into overtrusting the skill, causing unsafe assumptions about what was actually configured, backed up, or protected.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | 飞书 | App ID, App Secret | 飞书开放平台 | | Discord | Bot Token | Discord Developer Portal | | Telegram | Bot Token | @BotFather | | WhatsApp | Phone ID, Access Token | Meta for Developers | ## 配置引导
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js 💡 提示：说"重新开始"可以配置新机器人` }; return prompts[step] || `📍 第 ${step} 步：${STEPS[step]}\n\n请按照提示回复相应选项...\n\n💡 提示：说"上一步"可以回退修改，说"状态"查看进度`; } /**
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The changelog records a workflow in Step 6 that includes '选择平台 → 提供凭证' and mentions credential handling, while later versions claim the skill no longer collects credentials and only guides users to configure them in the official console. This inconsistency is dangerous because it indicates the skill may still be designed, documented, or tested around collecting secrets in chat, which creates a realistic risk of credential disclosure and weakens trust in the stated security boundary.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Several triggers such as '/配置', '/备份', '配置机器人', and especially broad conversational phrases can cause the skill to activate in common, ambiguous contexts. Overbroad activation increases the chance of unintended invocation, confusing users, hijacking conversations, or eliciting configuration-related prompts in the wrong context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The slash-command triggers include very generic terms such as /备份 and /配置, which can unintentionally activate this skill during unrelated user workflows. In an agent environment, broad command collisions can cause the wrong skill to intercept requests, leading to unintended actions, confusion, or disclosure of contextual conversation data to an unnecessary workflow.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The keyword triggers are broad and ambiguous, including common phrases like 创建机器人, 配置机器人, and agentlove without scope constraints. This increases the chance of accidental invocation from normal conversation, which can misroute user intent, expose conversational context to this skill, and create opportunities for prompt-trigger abuse by third-party content embedded in chats.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file’s headings, messages, and user-facing error text are all in Chinese, including prompts such as '输入无效' and the completion message. This imposes a specific language on users without any visible opt-in, alternative language support, or justification that the skill is intended only for a Chinese-language context.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The file documents state management as a StateManager class with in-memory storage and methods saveState/loadState. However, completeConfiguration directly calls loadState(userId) as a free function, which contradicts the documented implementation and leaves the actual state source ambiguous.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The entire skill content, including headings and example responses, is written in Chinese and presents the interaction flow only in that language. This indicates a language-specific behavior without any visible opt-in, alternative locale choice, or justification that the skill is intended only for Chinese-speaking users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The entire skill reference and usage instructions are presented only in Chinese, with no indication that users may choose another language or locale. Under the stated policy, a skill that effectively enforces a specific language without opt-in is a natural-language policy concern.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The troubleshooting guidance reinforces use of a very generic trigger path by telling users to invoke the skill with broad phrases like '/agentlove' or '创建机器人'. In this skill's context, the metadata already includes highly common triggers such as '配置', '备份', and '创建机器人', which increases the chance of accidental or unintended invocation in unrelated conversations, potentially launching sensitive configuration or migration flows without clear user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The "语言类型（4种）" section enumerates fixed language modes such as Simplified Chinese, Traditional Chinese, mixed Chinese-English, and English, but does not state that the user may choose among them or that a default language requires consent. This can be interpreted as enforcing a language/locale behavior without explicit user opt-in, which matches the policy-violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file’s user-facing instructions and prompts are entirely in Chinese and direct the user to reply using specific Chinese phrases such as “上一步”, “状态”, and “重新开始”. This imposes a single language for operation without documenting an opt-in or offering an alternative locale, which is a natural-language policy issue under the language/locale rule.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file contains natural-language comments and returned messages exclusively in Chinese, including user-facing status strings such as the rollback and step-progress messages. Under the policy, forcing a specific language without user choice or a documented regional justification is a locale-policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file contains natural-language strings intended for users/test operators entirely in Chinese, such as the file description and many console messages. Under the policy, forcing a specific language without user opt-in is a locale-policy violation unless the constraint is clearly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file contains user-facing natural language entirely in Chinese, including headings, descriptions, and examples, with no indication that the language is optional or region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The summary asserts all 11 steps are implemented, but earlier TODO items explicitly say Step 9 '实现实际的机器人创建逻辑' and Step 10 '实现配置摘要的动态生成' remain unfinished. That is an active contradiction in documentation about what the skill actually does.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The persona configuration defines allowed "语言类型" as a fixed set of options: 简体、繁体、中英混合、英文. This can impose a language/locale constraint in the skill's interaction model without stating that other user-preferred languages are supported or that the restriction is required for a documented reason.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents all guidance exclusively in Chinese, including headings and behavioral descriptions, with no indication that the user can choose another language. The policy requires flagging forced language or locale constraints unless they are optional or clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
All visible instructions, trigger phrases, and workflow descriptions are presented only in Chinese, with no indication that users may choose another language. Under the policy, a language-specific constraint should either be optional for the user or explicitly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file presents all role descriptions exclusively in Chinese, which can impose a specific language on users without any stated opt-in or alternative. The policy requires flagging natural-language locale constraints when the skill does not explicitly offer language choice or justify the locale restriction.
- Content
Static analysis
No suspicious patterns detected.