Security audit

知识自动沉淀引擎

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent daily-briefing purpose, but it asks for broad private chat and secret-file access, uploads results externally, grants a fixed Feishu account full control, and understates those side effects.

Install only if this is intentionally for the named Chinese personal workflow and you are comfortable giving it access to private conversations, GetNote content, OpenClaw secret files, Feishu document creation, sharing, and deletion authority. Before use, remove hard-coded Feishu recipients and folder tokens, stop direct secret-file reads and credential-prefix logging, require a local preview, and make each external sync or permission change explicitly user-approved.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:93
Finding: Overbroad Secrets-File Access and Partial API-Key Disclosure
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:277
Finding: Overbroad Collection of Private Conversations for Remote Synchronization
Content: View full analysis
" \ --title "Daily Briefing {target_date} | Zhang Gongzi" \ --tag AI整理 \ --tag 日志简报 ``` ```bash ${LARK_CLI} docs +update \ --api-version v2 \ --doc "" \ --command overwrite \ --doc-format xml \ --content @./2026-05-25-日志简报.md ``` ```bash ${LARK_CLI} docs +create \ --api-version v2 \ --parent-token FQfXfYBGGllxxydJ1SgcJZWqnpf \ --doc-format xml \ --content @./2026-05-25-日志简报.md ``` ### Technical Analysis The Skill enumerates all sessions active during a date range and reads user messages from every matching session. Selection by timestamp does not establish that a session belongs to the journaling workflow, that its participants consented to archival, or that its content is appropriate for disclosure. The report-generation function may legitimately process notes and conversations explicitly selected by the user. It does not require blanket access to all same-day sessions. The broad query therefore exceeds minimum privilege. The collected content is transformed into a briefing and synchronized to GetNote and two Feishu destinations. Summarization does not reliably eliminat ...[truncated 1355 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:450
Finding: Hard-Coded Feishu Principal Receives Full Control of Generated Documents
Content: View full analysis
/members?type=docx' \ -H 'Authorization: Bearer {tenant_access_token}' \ -H 'Content-Type: application/json' \ -d '{"member_type":"openid","member_id":"ou_d8ace8a146610ca26bc07d8e68a5620f","perm":"full_access"}' ``` ### Technical Analysis The Skill automatically assigns `full_access` to a fixed Feishu OpenID after creating a document. The recipient is embedded in the Skill rather than selected from trusted runtime configuration or confirmed by the invoking user. `full_access` is broader than the access required to read a generated report. According to the Skill's own documentation, this permission includes deletion capability. Report generation and archival do not inherently require a third party to modify, reshare, or delete the resulting document. Because the report can include private notes and conversation-derived information, the permission operation creates a persistent disclosure path to a fixed principal. If the OpenID is incorrect, stale, transferred, or controlled by an unintended account, every generated report may be exposed. ### Attack Path 1. The Skill collects notes and conversation records. 2. It generates a potentially sensitive daily briefing. 3. It authenticates to Feishu using the tenant application secret. 4. It creates a Feishu document containing the briefing. 5. It extracts the new document identifier. 6. It invokes the Feishu permission API with a hard-coded OpenID. 7. The named account receives full access without runtime identity verification or user confirmation. 8. That account can read, modify, reshare, or delete the document. ### Impact Assessment The hard-coded principal can obtain full control over every document process ...[truncated 397 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:475
Finding: Deletion-Before-Recreation Can Destroy Existing User Content
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:64
Finding: Security Declaration Materially Understates Privileges and External Side Effects
Content: View full analysis
" \ --title "Daily Briefing {target_date} | Zhang Gongzi" ``` ```bash ${LARK_CLI} docs +create \ --api-version v2 \ --parent-token FQfXfYBGGllxxydJ1SgcJZWqnpf \ --doc-format xml \ --content @./2026-05-25-日志简报.md ``` ```bash curl -X POST 'https://open.feishu.cn/open-apis/drive/v1/permissions//members?type=docx' \ -H 'Authorization: Bearer {tenant_access_token}' \ -H 'Content-Type: application/json' \ -d '{"member_type":"openid","member_id":"ou_d8ace8a146610ca26bc07d8e68a5620f","perm":"full_access"}' ``` A user or platform evaluating the Skill based on the security statement could approve it under the false assumption that its network activity is read-only and that shell execution is limited to local writes. This prevents informed authorization and obscures the Skill's actual risk profile. ### Attack Path 1. A user or review system reads the security declaration. ...[truncated 887 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill is designed to read conversation history, infer the user's learning state and work status, and then archive that synthesized profile to multiple external platforms. This is sensitive behavioral profiling combined with cross-system data export, which creates significant privacy and confidentiality risk if activated without narrow scope and explicit consent.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: The changelog explicitly instructs that runtime credentials must be read from openclaw.json and secrets.json because environment injection is unavailable. Normalizing direct secret-file access in the skill enables credential harvesting behavior and bypasses safer secret-delivery boundaries.
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
## v0.1.15 更新说明（2026-06-27 Bug 修复） - **根因**：cron isolated session 不会自动注入 `GETNOTE_CLIENT_ID` 和 `GETNOTE_API_KEY` 环境变量，导致 `getnote auth login` 失败，提示"API未授权"。 - **修复**：新增「运行时凭证读取」章节，所有调用 Get笔记 CLI 的步骤均需先从配置文件（openclaw.json + secrets.json）读取凭证后再执行，彻底摆脱对环境变量的依赖。 ## v0.1.14 更新说明（2026-06-06 Bug 修复） - **根因**：cron 执行时使用了 `grep "^2026-06-05"`（行首匹配），但日期在最后一列（行首是笔记 ID），导致 7 条笔记全部漏读。v0.1.12/v0.1.13 均已警告此 Bug，但执行端仍违反。

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill's security note materially misrepresents its behavior by claiming external API calls are read-only, while the documented workflow creates and updates Get notes, Feishu wiki nodes, Feishu docs, and permissions. This can mislead reviewers or operators into granting the skill broader trust and permissions than they otherwise would, increasing the chance of unauthorized data modification and exfiltration.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: This line documents exact locations of live Getnote and Feishu secrets, giving the skill actionable instructions for credential retrieval. Providing a model with both the path and structure of secret storage materially lowers the barrier to credential misuse and cross-service abuse.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
Get笔记 API 凭证存储位置： - `GETNOTE_CLIENT_ID` → `openclaw.json` 的 `skills.entries.getnote.env.GETNOTE_CLIENT_ID` - `GETNOTE_API_KEY` → `secrets.json` 的 `skills.entries.getnote.apiKey`（SecretRef 解析后的实际值）飞书 appSecret → `secrets.json` 的 `channels.feishu.accounts.main.appSecret`

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: This instruction makes credential loading from local files mandatory before CLI use, effectively requiring the skill to perform secret extraction as part of normal operation. That broadens the skill's privilege boundary from document processing into credential access and reuse.
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
- `GETNOTE_CLIENT_ID` → `openclaw.json` 的 `skills.entries.getnote.env.GETNOTE_CLIENT_ID` - `GETNOTE_API_KEY` → `secrets.json` 的 `skills.entries.getnote.apiKey`（SecretRef 解析后的实际值）飞书 appSecret → `secrets.json` 的 `channels.feishu.accounts.main.appSecret` > ⚠️ **核心约束**：cron isolated session **不会**自动注入环境变量 `GETNOTE_CLIENT_ID` 和 `GETNOTE_API_KEY`，所有调用 Get笔记 CLI 的 shell 命令前**必须**先从配置文件读取凭证（详见下方「运行时凭证读取」章节）。不读取凭证直接调用 CLI 会导致"API 未授权"错误。

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: The embedded Python snippet opens secrets.json directly, which is an explicit credential-access operation. Once the model is instructed to parse local secret stores, any compromise or prompt injection in the workflow can leverage those secrets beyond the intended note-sync task.
Content: Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.
md
import json with open('/Users/openclawer/.openclaw/openclaw.json') as f: oc = json.load(f) with open('/Users/openclawer/.openclaw/secrets.json') as f: sec = json.load(f) # GETNOTE_CLIENT_ID：从 openclaw.json 直接读取

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: This code path resolves the API key from a secret reference inside secrets.json, demonstrating structured extraction of a sensitive token. The danger is not just possession of the secret but teaching the agent how to traverse the secret schema to obtain it reliably.
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
md
# GETNOTE_CLIENT_ID：从 openclaw.json 直接读取 client_id = oc.get('skills',{}).get('entries',{}).get('getnote',{}).get('env',{}).get('GETNOTE_CLIENT_ID','') # GETNOTE_API_KEY：从 secrets.json 读取（SecretRef 解析） apikey_ref = oc.get('skills',{}).get('entries',{}).get('getnote',{}).get('apiKey',{}) if isinstance(apikey_ref, dict) and apikey_ref.get('source') == 'file': key_path = apikey_ref.get('id','')

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: This repeated secret-file access in the auth flow reinforces credential extraction as a normal execution step and increases opportunities for accidental logging, mishandling, or reuse. Repetition across multiple workflow stages also makes containment harder because many code paths depend on raw secrets.
Content: Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
md
import json with open('/Users/openclawer/.openclaw/openclaw.json') as f: oc = json.load(f) with open('/Users/openclawer/.openclaw/secrets.json') as f: sec = json.load(f) client_id = oc.get('skills',{}).get('entries',{}).get('getnote',{}).get('env',{}).get('GETNOTE_CLIENT_ID','') apikey_ref = oc.get('skills',{}).get('entries',{}).get('getnote',{}).get('apiKey',{})

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: This step again reads secrets.json before data retrieval, meaning secret access is embedded into routine content-fetch operations. Coupling secret extraction with broad exec use makes the context more dangerous because the same execution surface can handle both sensitive credentials and outbound actions.
Content: Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.
md
import json with open('/Users/openclawer/.openclaw/openclaw.json') as f: oc = json.load(f) with open('/Users/openclawer/.openclaw/secrets.json') as f: sec = json.load(f) client_id = oc.get('skills',{}).get('entries',{}).get('getnote',{}).get('env',{}).get('GETNOTE_CLIENT_ID','') apikey_ref = oc.get('skills',{}).get('entries',{}).get('getnote',{}).get('apiKey',{})

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: These steps direct the agent to enumerate sessions, retrieve session history, and use user messages as source material for the report. That converts private conversational data into an exportable artifact, increasing the risk of leaking sensitive discussions, credentials, or personal information into persistent external systems.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This workflow synchronizes a compiled briefing containing note content and conversation-derived analysis to multiple third-party destinations, including permission changes that grant another principal full access. Multi-destination export magnifies the blast radius of any mistaken inclusion of sensitive data and makes revocation and auditing harder.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: The save operation once more requires reading secrets.json, this time for a write path that publishes content externally. That combination of credential access plus external write capability raises the stakes: a compromised or misfiring skill could both authenticate and exfiltrate without further barriers.
Content: Scanner excerpt · SKILL.md (reported line 351)May include surrounding context.
md
import json with open('/Users/openclawer/.openclaw/openclaw.json') as f: oc = json.load(f) with open('/Users/openclawer/.openclaw/secrets.json') as f: sec = json.load(f) client_id = oc.get('skills',{}).get('entries',{}).get('getnote',{}).get('env',{}).get('GETNOTE_CLIENT_ID','') apikey_ref = oc.get('skills',{}).get('entries',{}).get('getnote',{}).get('apiKey',{})

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: This code reads the Feishu appSecret from secrets.json in order to request a tenant access token. It enables the skill to mint fresh bearer tokens for downstream API operations, which is especially sensitive because token issuance expands access beyond a single pre-scoped command.
Content: Scanner excerpt · SKILL.md (reported line 422)May include surrounding context.
md
import json, urllib.request with open('/Users/openclawer/.openclaw/openclaw.json') as f: d = json.load(f) # appSecret 从 secrets.json 读取 with open('/Users/openclawer/.openclaw/secrets.json') as f: sec = json.load(f) app_secret = sec.get('channels',{}).get('feishu',{}).get('accounts',{}).get('main',{}).get('appSecret','')

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: This is part of the same direct secret-file read for Feishu credentials, supporting external API authentication. In the context of a skill that also processes conversation history and exports documents, granting it token-generation capability is particularly dangerous because it enables authenticated sharing and permission changes.
Content: Scanner excerpt · SKILL.md (reported line 423)May include surrounding context.
md
with open('/Users/openclawer/.openclaw/openclaw.json') as f: d = json.load(f) # appSecret 从 secrets.json 读取 with open('/Users/openclawer/.openclaw/secrets.json') as f: sec = json.load(f) app_secret = sec.get('channels',{}).get('feishu',{}).get('accounts',{}).get('main',{}).get('appSecret','') req = urllib.request.Request(

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases are broad and overlap with routine requests like organizing logs or study notes, making accidental activation likely. Because this skill reads conversation history, local files, and synchronizes content to external services, overbroad triggering raises the chance of unintended sensitive-data processing.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This section instructs the agent to open local configuration and secret files and extract live credentials at runtime. Allowing a skill to read secrets from disk significantly expands its capability from content summarization to credential access, enabling reuse of those credentials for unintended services or actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill relies on arbitrary shell execution for orchestration, authentication checks, CLI invocation, and file operations. This broad exec-based design increases attack surface because any prompt injection, variable confusion, or future modification could turn a simple automation flow into unrestricted local command execution.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The curl command performs an external API request that modifies sharing permissions on a document, transmitting authorization material and granting full access to a fixed account. While permission management can be legitimate, embedding it in an auto-triggerable skill creates a real risk of unauthorized disclosure if the document contains sensitive compiled user data.
Content: Scanner excerpt · SKILL.md (reported line 452)May include surrounding context.
步骤 4：授予张公子 full_access 权限

bash
curl -X POST 'https://open.feishu.cn/open-apis/drive/v1/permissions/<document_id>/members?type=docx' \ -H 'Authorization: Bearer {tenant_access_token}' \ -H 'Content-Type: application/json' \ -d '{"member_type":"openid","member_id":"ou_d8ace8a146610ca26bc07d8e68a5620f","perm":"full_access"}'

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire template, including the title and all section headings, is written in Chinese and provides no indication that another language may be used. This creates a natural-language locale policy issue because it imposes a specific language by default without documented opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The comment lists activation phrases exclusively in Chinese, which implies a language-specific invocation policy. Because the file does not provide user opt-in, alternatives, or justification for a Chinese-only constraint, this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The natural-language description and required outputs are written as Chinese-only instructions, including fixed Chinese output forms such as the reporting template and notification wording. There is no indication that the user may choose another language or locale, which can violate language-choice policy absent justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.