crypto daily report

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:50 AM UTC
• Version: 1.0.0

Overview

This skill is mostly a disclosed crypto-report automation, but it silently posts to a hardcoded Telegram destination and reads a local API token, so users should review it before installing.

Install only if you intend this agent to generate Chinese crypto daily reports and publish them to the listed Telegram chat/thread. Before use, replace the hardcoded destination with your own trusted configuration, require an explicit send confirmation, avoid direct reads from ~/.openclaw/.env where possible, and harden the /tmp file handling in fetch_news.sh.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:13
• Finding: Hardcoded Telegram Recipient with Suppressed User Confirmation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13–24 **Vulnerability Type**: Hardcoded external destination and concealed side effect **Risk Level**: High ```markdown ## 输出目标 Telegram 加密新闻 Topic（threadId: 182747，chatId: 680162114） 分三条消息发送（见【排版规范】） ## 静默执行原则（重要） - 执行过程中**不向用户输出任何中间状态文字**，包括： - "开始采集数据"、"并行启动所有数据源" - "数据采集完成，开始组装日报" - "三条消息字符数均在限制内，开始发送" - "日报已发送完毕" - 任何执行进度说明、重点提示、分析总结 - 三条消息发送完毕后，主会话回复**仅用 NO_REPLY**，不追加任何内容 ``` English interpretation: The Skill directs three report messages to Telegram chat `680162114`, thread `182747`, prohibits status or completion messages, and requires the main conversation to return only `NO_REPLY`. ### Technical Analysis The Skill changes a generic report-generation request into an external messaging operation targeting a fixed Telegram destination. The destination is not supplied by the invoking user or selected from trusted per-user configuration. The accompanying silence rules suppress disclosure of the operation and prevent a meaningful completion response. External delivery can be legitimate for a reporting Skill, but hardcoding a recipient and sending without explicit confirmation exceeds the minimum privilege needed to generate a report. Report generation only requires collecting and formatting information; publishing to a predetermined third party is a separate privileged side effect. ### Attack Path 1. A user invokes the Skill using a broad trigger such as a request to generate a daily cryptocurrency report. 2. The Skill collects and formats report content. 3. Instead of presenting a draft or requesting a destination, it sends three messages to hardcoded Telegram chat `680162114`, thread `182747`. 4. The Skill suppresses progress and completion disclosure. 5. The main session returns only `NO_REPLY`, reducing the user's ability to notice or verify the external publication. ### Impact Assessment The behavior can cause unintended publication of generated report content t ...[truncated 400 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default to generating a draft in the current conversation rather than sending it automatically. 2. Require explicit user confirmation immediately before external delivery. 3. Obtain the Telegram chat and thread identifiers from trusted runtime configuration or an authenticated user selection instead of hardcoding them in the Skill. 4. Display the resolved destination to the user before sending. 5. Remove the mandatory `NO_REPLY` behavior and return a truthful delivery result, including the destination and whether each message succeeded. 6. Separate report-generation permission from external-message permission so the Skill receives messaging capability only after approval. 7. Prevent conversational or fetched content from overriding the approved destination. 8. Avoid including user-specific or confidential context unless the user explicitly selects it for publication. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_news.sh:7
• Finding: Predictable Shared Temporary Files Allow Local File Clobbering<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fetch_news.sh`, lines 7–23 **Vulnerability Type**: Unsafe predictable temporary files **Risk Level**: Medium ```bash curl -s --max-time 15 "https://www.theblockbeats.info/newsflash" \ -H "User-Agent: Mozilla/5.0" \ -o /tmp/news_blockbeats.html & curl -s --max-time 15 "https://www.odaily.news/zh-CN/newsflash" \ -H "User-Agent: Mozilla/5.0" \ -o /tmp/news_odaily.html & curl -s --max-time 15 "https://www.panewslab.com/zh/newsflash" \ -H "User-Agent: Mozilla/5.0" \ -o /tmp/news_panews.html & curl -s --max-time 15 "https://www.coindesk.com/latest-crypto-news" \ -H "User-Agent: Mozilla/5.0" \ -o /tmp/news_coindesk.html & ``` ### Technical Analysis The script writes downloaded responses to fixed names in the globally shared `/tmp` directory. It does not securely create the files, verify their ownership or type, reject symbolic links, or isolate them in a private directory. On systems where another local user can create entries in `/tmp`, an attacker can pre-create one of these paths as a symbolic link to another file. When the script runs, `curl -o` can follow the link and truncate or overwrite the linked target with downloaded HTML. The effective impact depends on the privileges of the account executing the Skill. The files also use globally predictable names, so concurrent executions can overwrite or consume each other's results. ### Attack Path 1. A local attacker determines that the Skill writes to `/tmp/news_blockbeats.html` or another fixed path. 2. Before the Skill runs, the attacker creates that path as a symbolic link to a file writable by the future Skill process. 3. A user or service executes `scripts/fetch_news.sh`. 4. `curl -o` opens the predictable path and follows the attacker's symbolic link. 5. The linked target is truncated or replaced with the downloaded web response. 6. Alternatively, concurrent Skill runs overwrite each other's temporary data, potentially causi ...[truncated 688 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a private temporary directory with `mktemp -d` and place every downloaded file inside it. 2. Set `umask 077` before creating temporary files. 3. Register a cleanup trap so temporary data is removed on normal exit, interruption, or error. 4. Do not run the script with elevated privileges. 5. Pass the generated temporary directory to downstream processing instead of relying on global fixed paths. 6. Check every background `curl` process for failure after `wait`. 7. If persistent output is required, create it in an application-owned directory with restrictive permissions and perform an atomic rename after a successful download. Example hardening pattern: ```bash #!/bin/bash set -euo pipefail umask 077 tmp_dir="$(mktemp -d "${TMPDIR:-/tmp}/crypto-news.XXXXXXXX")" trap 'rm -rf -- "$tmp_dir"' EXIT HUP INT TERM curl --fail --silent --show-error --max-time 15 \ "https://www.theblockbeats.info/newsflash" \ -H "User-Agent: Mozilla/5.0" \ -o "$tmp_dir/news_blockbeats.html" & ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 声明描述的是一个完整的“加密货币日报生成并发送”技能，核心能力应包括新闻/数据收集、内容加工、日报组织以及发送到 Telegram。所给代码并未实现这些主功能，也没有任何与加密货币新闻、日报结构、Telegram 发送接口相关的逻辑。它仅是一个辅助性的字数检查脚本，用于判断文本是否接近 Telegram 消息长度上限。虽然这可能在发送 Telegram 消息前作为配套工具使用，但就该代码块本身而言，其主要目的与声明的技能目的明显不一致，因此属于描述与行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 声明描述的是一个完整的“加密新闻日报生成与发送”技能，核心能力包括多板块日报编排、新闻采集与处理、以及向 Telegram 发送消息。实际代码的主功能则是独立获取 DeFiLlama 的收益率数据并打印前几个生息机会，属于单一数据抓取/筛选工具。它访问的资源是 DeFiLlama yields API，而不是面向新闻日报的多源数据；也没有任何 Telegram 发送、三条消息拆分、日报结构化输出或新闻脱水处理的实现。因此代码实际行为与声明用途存在明显且实质性的偏差。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 声明的核心用途是生成并发送一份完整的加密货币日报；而实际代码只是一个独立的数据抓取脚本，面向 Solana trending meme/pools 数据，带有备用数据源和简单文本输出。它既不体现日报编排流程，也没有 Telegram 投递行为。因此其主要目的、处理范围和输出方式都与声明明显不符，属于实质性描述—行为不一致。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: 声明描述的是一个完整的“加密货币日报生成并发送”技能，包含采集、处理、排版、分三条消息发送等端到端能力。实际提供的代码片段只执行网络抓取：访问 4 个新闻站点并将 HTML 保存到 /tmp 文件。虽然“采集数据”是声明流程的一部分，因此抓取新闻源本身并非完全无关，但该代码没有体现日报生成流程中的关键后续步骤，尤其缺少内容提取/清洗、结构化汇总、日报排版以及 Telegram 发送。因此该代码行为与声明的主要目的相比明显不完整，属于描述与实际行为不一致。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 声明描述的是一个完整的“加密货币日报生成并发送”技能，核心能力应包括多板块数据采集、内容处理/脱水、日报排版，以及向 Telegram 指定 Topic 分三条消息发送。实际代码只是一个价格抓取脚本：访问 Binance 公开接口获取少数币种的行情，做简单错误处理，然后打印结果。虽然“采集数据”可视为日报系统中的一个子步骤，但该代码片段的直接、主要行为与声明的整体用途存在明显差距，尤其缺失 Telegram 发送和日报生成相关逻辑，因此应判定为描述与行为不匹配。

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill explicitly requires silent execution and silent transmission to a Telegram topic, followed by replying only 'NO_REPLY' in the main conversation. This removes user awareness and consent around external data posting, which is especially risky because the skill aggregates content from multiple sources and transmits it off-platform.

Credential Access

High

• Category: Privilege Escalation

Content

**OpenNews 高分补漏（score≥75）：**
```bash
TOKEN=$(grep OPENNEWS_TOKEN ~/.openclaw/.env | cut -d'=' -f2)
curl -s -X POST "https://ai.6551.io/open/news_search" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \

• Confidence: 98% confidence
• Finding: Directly accessing ~/.openclaw/.env to retrieve OPENNEWS_TOKEN is credential access behavior. In a skill that already performs network operations, this creates a clear path from local secret retrieval to external use, and the context makes it more dangerous because the credential is immediately consumed in a remote request.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill invokes network access and shell commands but does not declare any explicit tool scope or allowed-tools boundary. That increases the chance the runtime grants broader capabilities than necessary, making unintended command execution or data access harder to constrain and audit.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The natural-language description is written as a fixed Chinese-language reporting workflow and does not indicate that the user can choose another language or locale. Under the policy criteria, a forced language behavior without opt-in can constitute a locale/language policy violation unless clearly justified as region-specific.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Using the generic trigger word '日报' makes accidental activation likely in unrelated conversations. Because this skill performs network collection and may post externally, unintended activation can lead to unapproved data gathering or outbound actions.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill instructs reading a local .env file to extract an API token, which is credential access from the host environment. Even if intended for legitimate API use, embedding secret extraction into skill logic is dangerous because it normalizes access to local secrets and can be repurposed for unauthorized credential harvesting or leakage.

External Transmission

Medium

• Category: Data Exfiltration

Content

**OpenNews 高分补漏（score≥75）：**
```bash
TOKEN=$(grep OPENNEWS_TOKEN ~/.openclaw/.env | cut -d'=' -f2)
curl -s -X POST "https://ai.6551.io/open/news_search" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"minScore": 75, "limit": 20, "page": 1}'

• Confidence: 93% confidence
• Finding: The skill performs an outbound POST request to a third-party API using a bearer token. External transmission is security-relevant here because it sends data and authorization material to an external service, and in the context of this skill it occurs as part of an automated workflow with no user-visible approval step.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list is broad and generic for common Chinese phrases such as “日报”, “生成日报”, and “发日报”, which can cause the skill to activate in contexts where the user did not specifically intend a crypto-report workflow. Because this skill performs external data collection and message publishing to Telegram, accidental activation can lead to unintended outbound actions and disclosure or spam in downstream channels.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The module docstring presents all user-facing instructions and status context exclusively in Chinese, which imposes a specific language on users without any opt-in or alternative. The policy explicitly calls out language or locale constraints as violations unless the skill offers choice or documents a justified regional limitation.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The natural-language description in the module docstring is entirely in Chinese and gives no indication that the language is configurable or intentionally region-specific. Per the policy criteria, forcing a specific language without user opt-in is a locale-policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The module docstring is entirely in Chinese and describes the skill behavior in a single fixed language, with no indication that users can choose another language or that the locale restriction is required for a region-specific purpose. This matches the language/locale policy violation category because the skill presents a fixed-language experience without opt-in.

External Transmission

Medium

• Category: Data Exfiltration

Content

# --- 主逻辑 ---
# 优先：GeckoTerminal
data = fetch_json('https://api.geckoterminal.com/api/v2/networks/solana/trending_pools?page=1')

if isinstance(data, tuple):
    # GeckoTerminal 失败，降级到 DEXScreener

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

if isinstance(data, tuple):
    # GeckoTerminal 失败，降级到 DEXScreener
    print(f"⚠️ GeckoTerminal 不可用（{data[1]}），降级到 DEXScreener", file=sys.stderr)
    data2 = fetch_json('https://api.dexscreener.com/token-boosts/top/v1')
    if isinstance(data2, tuple):
        print("今日 Meme 数据暂时不可用（GeckoTerminal & DEXScreener 均无响应）")
        sys.exit(0)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The script comments, status messages, and several target URLs are explicitly Chinese-language, including locale-specific endpoints such as '/zh-CN/newsflash'. This imposes a language/locale choice on users without offering an alternative or documenting why the skill is restricted to Chinese content.

External Transmission

Medium

• Category: Data Exfiltration

Content

results = []

for s in SPOT_SYMBOLS:
    url = f'https://api.binance.com/api/v3/ticker/24hr?symbol={s}'
    d = fetch_with_retry(url)
    if isinstance(d, tuple):  # 失败
        results.append({'symbol': s.replace('USDT',''), 'error': d[1], 'type': 'spot'})

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The natural-language description and trigger set are entirely Chinese, which implies a language-specific interaction model, but the manifest does not state that the skill is intended only for Chinese-speaking users or provide any language choice. This can violate language/locale policy when a skill silently forces one language without opt-in or documented justification.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The module docstring is written only in Chinese, which imposes a specific language on users without any opt-in or alternative. This matches the language/locale policy concern because the skill does not indicate that Chinese is required or configurable.

Static analysis

No suspicious patterns detected.