Security audit

Eyun Freight

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its freight-rate purpose, but it sends raw business queries to Eyun and requires unattributed verbatim remote replies, with insecure HTTP and shell-command handling concerns.

Review before installing. Use only with a trusted Eyun endpoint, require HTTPS, validate EYUN_BASE_URL and numeric EYUN_COMPANY_ID, avoid sending unnecessary sensitive shipment or customer details, and change the skill so remote answers are attributed and can be safety-checked instead of blindly relayed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:62
Finding: Untrusted Remote Responses Are Relayed Verbatim While the Agent's Intermediary Role Is Concealed
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: README.md:25
Finding: Sensitive Freight Queries and Company Identity May Be Transmitted over Plaintext HTTP
Content: View full analysis
:8010", "EYUN_COMPANY_ID": "<企业 ID 数字>" ``` `SKILL.md`, lines 37-41: ```bash curl -s -X POST "EYUN_BASE_URL/chat/sync" \ -H "Content-Type: application/json" \ -H "company-id: EYUN_COMPANY_ID" \ -d "{\"message\": \"<用户的原始问题>\", \"session_id\": null, \"source\": \"im\"}" ``` ### Technical Analysis The deployment example configures the endpoint with an `http://` URL. The request sends both the user's complete original query and the company identifier to that endpoint. Plain HTTP provides neither confidentiality nor server authentication and does not protect response integrity. A network-positioned attacker can inspect freight queries and associated company identifiers. The attacker may also alter the request or response. Response tampering is particularly serious because the Skill separately requires remote answers to be relayed verbatim. The company identifier is not shown to be a secret credential, but it is tenant-identifying information and may be sensitive when correlated with freight routes, prices, counterparties, schedules, or other commercial details in the user's query. ### Attack Path 1. An operator follows the documented configuration and sets `EYUN_BASE_URL` to an `http://` endpoint. 2. A user asks a question containing freight routes, pricing details, schedules, customer information, or other commercial data. 3. The Skill sends the original question and `company-id` over the network without transport encryption. 4. An attacker on the local network, gateway, proxy, or another network segment intercepts the traffic. 5. The attacker reads the commercial data or modifies the server response. 6. If the response is modified, the Skill rela ...[truncated 592 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:27
Finding: Configuration Values Are Unsafely Interpolated into a Shell Command
Content: View full analysis
` 替换为经过 JSON 转义的用户原文： ```bash curl -s -X POST "EYUN_BASE_URL/chat/sync" \ -H "Content-Type: application/json" \ -H "company-id: EYUN_COMPANY_ID" \ -d "{\"message\": \"<用户的原始问题>\", \"session_id\": null, \"source\": \"im\"}" ``` ``` ### Technical Analysis The Skill directs the Agent to retrieve configuration values and textually substitute them into a command executed through `exec`. It does not define validation or shell-safe encoding for `EYUN_BASE_URL` or `EYUN_COMPANY_ID`. If either value contains quotation marks, command substitutions, shell metacharacters, or line breaks, it may terminate the intended argument and add an attacker-selected shell operation. The document requires JSON escaping for the user message, but it does not specify shell escaping for the configuration values. JSON escaping alone would also not be an adequate substitute for shell argument separation. Exploitation requires an attacker to influence the relevant OpenClaw Skill configuration or another trusted configuration source. The audit did not establish that ordinary remote users can modify this configuration, so the finding is conditional on configuration compromise or unsafe administrative provisioning. ### Attack Path 1. An attacker gains the ability to create or modify the `eyun_freight` Skill configuration, or persuades an administrator to install a crafted configuration. 2. The attacker places shell syntax in `EYUN_BASE_URL` or `EYUN_COMPANY_ID`. 3. The Agent reads ...[truncated 927 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README instructs users to configure EYUN_BASE_URL with an explicit http:// endpoint while also supplying an enterprise identifier used for authenticated business queries. Sending organization-identifying metadata and likely subsequent API traffic over plaintext HTTP risks interception, tampering, and exposure of commercial data, especially because the documentation provides no TLS requirement or warning.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The skill is explicitly designed to transmit user-supplied freight queries to an external service via curl. External transmission is expected for this functionality, but it still creates a real data exposure boundary because user content and business context are sent off-system to a remote endpoint.
Content: Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
- EYUN_BASE_URL - EYUN_COMPANY_ID bins: - curl --- # Eyun 运价助手

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructions and expected user interaction are entirely in Chinese, including directives that responses be passed through verbatim from the remote assistant. There is no indication that users may opt into another language or that the Chinese-only behavior is a documented regional requirement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs sending the user's raw query to an external Eyun endpoint, but it does not require notifying the user that their content will leave the local agent environment. This can expose sensitive commercial, personal, or shipment data to a third-party service without meaningful transparency or consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: All user-facing instructions in the file are written in Chinese, with no indication that the skill is region-specific or that another language option is available. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill requires retrieving configuration and authentication-related values to access a credentialed remote service, but it does not tell the user that privileged service access is being used on their behalf. While this does not directly expose secrets, it reduces transparency around authenticated third-party actions and data handling.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.