循古黄历

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:16 AM UTC
• Version: 1.0.1

Overview

This almanac skill mostly does what it claims, but its sample runtime code can expose unrelated secrets from .env files to the agent process.

Review before installing. Use a dedicated OpenClaw secret or environment variable for HUANGLI_API_TOKEN, avoid placing unrelated secrets in the same .env files this skill may read, and prefer a version that loads only HUANGLI_API_TOKEN without importing the rest of the file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:92

Finding

Overbroad loading of unrelated secrets from environment files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 92–108
Vulnerability Type: Overbroad credential-file access and process-environment modification
Risk Level: Medium

Vulnerable Code

python

if os.environ.get('HUANGLI_API_TOKEN'):
    return
env_paths = [
    Path.home() / '.openclaw' / '.env',
    Path.cwd() / '.env',
]
for p in env_paths:
    if p.exists():
        for line in p.read_text().splitlines():
            line = line.strip()
            if not line or line.startswith('#'):
                continue
            if '=' in line:
                k, v = line.split('=', 1)
                k, v = k.strip(), v.strip()
                if k and k not in os.environ:
                    os.environ[k] = v
        break

Technical Analysis

The Skill requires only HUANGLI_API_TOKEN, but its fallback loader reads the entire first available .env file and copies every parsed entry into the process environment. The searched locations include both the OpenClaw configuration directory and the current working directory.

This exceeds the minimum privileges required for the declared calendar-query functionality. Unrelated passwords, API keys, database credentials, and service tokens stored in the same file become available process-wide to other code executing in the Agent process.

The custom parser also does not correctly implement standard .env syntax, including quoted values, escaping, multiline values, and export declarations. This can cause malformed configuration or unexpected environment values.

The subsequent network request sends only HUANGLI_API_TOKEN to the documented HTTPS endpoint. There is no evidence that this Skill directly transmits the other imported values, so the issue is excessive secret exposure rather than confirmed exfiltration.

Attack Path

1. HUANGLI_API_TOKEN is absent from the process environment.
2. The Skill is invoked to perfo ...[truncated 1264 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer OpenClaw's declared secret-injection mechanism and remove manual .env discovery entirely.
2. If fallback loading is required, parse only the HUANGLI_API_TOKEN entry and keep it in a local variable rather than importing every entry into os.environ.
3. Do not inspect the current working directory's .env file, because its trust boundary may differ from the OpenClaw configuration directory.
4. Use a maintained .env parser when file-based configuration is unavoidable.
5. Validate configuration-file ownership and restrictive permissions before reading it.
6. Never log or include the Bearer token in error messages or formatted results.
7. Retain HTTPS certificate verification and restrict requests to the documented xungufa.com endpoint.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

首次使用前，需设置环境变量 HUANGLI_API_TOKEN：

方法 1：.env 文件（推荐）

在 OpenClaw 工作目录下创建或编辑 .env 文件：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

首次使用前，需设置环境变量 HUANGLI_API_TOKEN：

方法 1：.env 文件（推荐）

在 OpenClaw 工作目录下创建或编辑 .env 文件：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

首次使用前，需设置环境变量 HUANGLI_API_TOKEN：

方法 1：.env 文件（推荐）

在 OpenClaw 工作目录下创建或编辑 .env 文件：

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

if os.environ.get('HUANGLI_API_TOKEN'):
        return
    env_paths = [
        Path.home() / '.openclaw' / '.env',
        Path.cwd() / '.env',
    ]
    for p in env_paths:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

if os.environ.get('HUANGLI_API_TOKEN'):
        return
    env_paths = [
        Path.home() / '.openclaw' / '.env',
        Path.cwd() / '.env',
    ]
    for p in env_paths:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description says to use this skill whenever the user asks about solar terms, lunar dates, whether a day is good or bad, taboos, or almanac-related questions. Phrases like '日子好坏' and the broad '黄历相关问题' lack explicit boundaries or exclusion conditions, which can cause unintended activation for general discussion rather than explicit almanac lookup requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The activation list includes broad items like '吉凶查询' and '每日指南', which can overlap with everyday advice or general recommendation requests. The file does not provide exclusion criteria or clarify that the skill should only activate for Chinese almanac/calendar lookups.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.