Security audit

crypto daily report

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed crypto-report automation, but it silently posts to a hardcoded Telegram destination and reads a local API token, so users should review it before installing.

Install only if you intend this agent to generate Chinese crypto daily reports and publish them to the listed Telegram chat/thread. Before use, replace the hardcoded destination with your own trusted configuration, require an explicit send confirmation, avoid direct reads from ~/.openclaw/.env where possible, and harden the /tmp file handling in fetch_news.sh.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:13
Finding: Hardcoded Telegram Recipient with Suppressed User Confirmation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_news.sh:7
Finding: Predictable Shared Temporary Files Allow Local File Clobbering
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个完整的“加密货币日报生成并发送”技能，核心能力应包括新闻/数据收集、内容加工、日报组织以及发送到 Telegram。所给代码并未实现这些主功能，也没有任何与加密货币新闻、日报结构、Telegram 发送接口相关的逻辑。它仅是一个辅助性的字数检查脚本，用于判断文本是否接近 Telegram 消息长度上限。虽然这可能在发送 Telegram 消息前作为配套工具使用，但就该代码块本身而言，其主要目的与声明的技能目的明显不一致，因此属于描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个完整的“加密新闻日报生成与发送”技能，核心能力包括多板块日报编排、新闻采集与处理、以及向 Telegram 发送消息。实际代码的主功能则是独立获取 DeFiLlama 的收益率数据并打印前几个生息机会，属于单一数据抓取/筛选工具。它访问的资源是 DeFiLlama yields API，而不是面向新闻日报的多源数据；也没有任何 Telegram 发送、三条消息拆分、日报结构化输出或新闻脱水处理的实现。因此代码实际行为与声明用途存在明显且实质性的偏差。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明的核心用途是生成并发送一份完整的加密货币日报；而实际代码只是一个独立的数据抓取脚本，面向 Solana trending meme/pools 数据，带有备用数据源和简单文本输出。它既不体现日报编排流程，也没有 Telegram 投递行为。因此其主要目的、处理范围和输出方式都与声明明显不符，属于实质性描述—行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: 声明描述的是一个完整的“加密货币日报生成并发送”技能，包含采集、处理、排版、分三条消息发送等端到端能力。实际提供的代码片段只执行网络抓取：访问 4 个新闻站点并将 HTML 保存到 /tmp 文件。虽然“采集数据”是声明流程的一部分，因此抓取新闻源本身并非完全无关，但该代码没有体现日报生成流程中的关键后续步骤，尤其缺少内容提取/清洗、结构化汇总、日报排版以及 Telegram 发送。因此该代码行为与声明的主要目的相比明显不完整，属于描述与实际行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个完整的“加密货币日报生成并发送”技能，核心能力应包括多板块数据采集、内容处理/脱水、日报排版，以及向 Telegram 指定 Topic 分三条消息发送。实际代码只是一个价格抓取脚本：访问 Binance 公开接口获取少数币种的行情，做简单错误处理，然后打印结果。虽然“采集数据”可视为日报系统中的一个子步骤，但该代码片段的直接、主要行为与声明的整体用途存在明显差距，尤其缺失 Telegram 发送和日报生成相关逻辑，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly requires silent execution and silent transmission to a Telegram topic, followed by replying only 'NO_REPLY' in the main conversation. This removes user awareness and consent around external data posting, which is especially risky because the skill aggregates content from multiple sources and transmits it off-platform.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: Directly accessing ~/.openclaw/.env to retrieve OPENNEWS_TOKEN is credential access behavior. In a skill that already performs network operations, this creates a clear path from local secret retrieval to external use, and the context makes it more dangerous because the credential is immediately consumed in a remote request.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
OpenNews 高分补漏（score≥75）：

bash
TOKEN=$(grep OPENNEWS_TOKEN ~/.openclaw/.env | cut -d'=' -f2) curl -s -X POST "https://ai.6551.io/open/news_search" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill invokes network access and shell commands but does not declare any explicit tool scope or allowed-tools boundary. That increases the chance the runtime grants broader capabilities than necessary, making unintended command execution or data access harder to constrain and audit.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The natural-language description is written as a fixed Chinese-language reporting workflow and does not indicate that the user can choose another language or locale. Under the policy criteria, a forced language behavior without opt-in can constitute a locale/language policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Using the generic trigger word '日报' makes accidental activation likely in unrelated conversations. Because this skill performs network collection and may post externally, unintended activation can lead to unapproved data gathering or outbound actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs reading a local .env file to extract an API token, which is credential access from the host environment. Even if intended for legitimate API use, embedding secret extraction into skill logic is dangerous because it normalizes access to local secrets and can be repurposed for unauthorized credential harvesting or leakage.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The skill performs an outbound POST request to a third-party API using a bearer token. External transmission is security-relevant here because it sends data and authorization material to an external service, and in the context of this skill it occurs as part of an automated workflow with no user-visible approval step.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
OpenNews 高分补漏（score≥75）：

bash
TOKEN=$(grep OPENNEWS_TOKEN ~/.openclaw/.env | cut -d'=' -f2) curl -s -X POST "https://ai.6551.io/open/news_search" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"minScore": 75, "limit": 20, "page": 1}'

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger list is broad and generic for common Chinese phrases such as “日报”, “生成日报”, and “发日报”, which can cause the skill to activate in contexts where the user did not specifically intend a crypto-report workflow. Because this skill performs external data collection and message publishing to Telegram, accidental activation can lead to unintended outbound actions and disclosure or spam in downstream channels.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module docstring presents all user-facing instructions and status context exclusively in Chinese, which imposes a specific language on users without any opt-in or alternative. The policy explicitly calls out language or locale constraints as violations unless the skill offers choice or documents a justified regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The natural-language description in the module docstring is entirely in Chinese and gives no indication that the language is configurable or intentionally region-specific. Per the policy criteria, forcing a specific language without user opt-in is a locale-policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module docstring is entirely in Chinese and describes the skill behavior in a single fixed language, with no indication that users can choose another language or that the locale restriction is required for a region-specific purpose. This matches the language/locale policy violation category because the skill presents a fixed-language experience without opt-in.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/fetch_meme_trending.py (reported line 77)May include surrounding context.
python
# --- 主逻辑 --- # 优先：GeckoTerminal data = fetch_json('https://api.geckoterminal.com/api/v2/networks/solana/trending_pools?page=1') if isinstance(data, tuple): # GeckoTerminal 失败，降级到 DEXScreener

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/fetch_meme_trending.py (reported line 82)May include surrounding context.
python
if isinstance(data, tuple): # GeckoTerminal 失败，降级到 DEXScreener print(f"⚠️ GeckoTerminal 不可用（{data[1]}），降级到 DEXScreener", file=sys.stderr) data2 = fetch_json('https://api.dexscreener.com/token-boosts/top/v1') if isinstance(data2, tuple): print("今日 Meme 数据暂时不可用（GeckoTerminal & DEXScreener 均无响应）") sys.exit(0)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script comments, status messages, and several target URLs are explicitly Chinese-language, including locale-specific endpoints such as '/zh-CN/newsflash'. This imposes a language/locale choice on users without offering an alternative or documenting why the skill is restricted to Chinese content.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/fetch_prices.py (reported line 34)May include surrounding context.
python
results = [] for s in SPOT_SYMBOLS: url = f'https://api.binance.com/api/v3/ticker/24hr?symbol={s}' d = fetch_with_retry(url) if isinstance(d, tuple): # 失败 results.append({'symbol': s.replace('USDT',''), 'error': d[1], 'type': 'spot'})

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The natural-language description and trigger set are entirely Chinese, which implies a language-specific interaction model, but the manifest does not state that the skill is intended only for Chinese-speaking users or provide any language choice. This can violate language/locale policy when a skill silently forces one language without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring is written only in Chinese, which imposes a specific language on users without any opt-in or alternative. This matches the language/locale policy concern because the skill does not indicate that Chinese is required or configurable.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.