T09 · Insecure Skill Coding Practices
Error
- Location
modules/export/main.md:105- Finding
Unsafe ZIP Import Instructions Permit Path Traversal Outside the Knowledge-Base Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
MyKnowledge
Security checks for vulnerabilities and agentic risk
Overview
This local knowledge-management skill is mostly purpose-aligned, but it needs Review because hooks, imports, and update checks can persist message content or use network/shell behavior beyond the advertised local-only boundary.
Install only if you are comfortable with a local knowledge manager that writes persistent records and optional hooks. Before enabling hooks, confirm auto_record is explicitly set the way you want, avoid sending secrets in complex-task prompts, and prefer manual review before imports or exports. Treat shared ZIP imports as untrusted unless the importer is updated to validate every archive path, and disable automatic update checks if you need a strict no-network/no-shell setup.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T09 · Insecure Skill Coding Practices
Warning
- Location
hooks/openclaw/handler.ts:17- Finding
OpenClaw Hook Fails Open and Can Persist Message Content Without Recorded Consent
- Content
View full analysis
) { const { message } = ctx.event; if (message.role !== "user") { return; } if (!isAutoRecordEnabled()) { return; } const isComplex = analyzeComplexity(message.content); if (isComplex) { const taskInfo = extractTaskInfo(message.content); try { await ctx.agent.execute("myknowledge", { action: "auto_create", content: taskInfo, timestamp: new Date().toISOString(), privacy_mode: true }); } catch (error) { // Error suppressed unless debugging is enabled } } } ``` ```typescript function isAutoRecordEnabled(): boolean { try { if (!fs.existsSync(CONFIG_PATH)) { // 配置文件不存在，默认启用 return true; } const content = fs.readFileSync(CONFIG_PATH, "utf-8"); const match = content.match(/auto_record:\s*(true|false)/); if (match) { return match[1] === "true"; } // 配置不明确，默认启用 return true; } catch (error) { if (process.env.MYKNOWLEDGE_DEBUG) { console.error("[MyKnowledge Hook] 读取配置失败:", error.message); } // 读取失败，默认启用 return true; } } ``` The hook enables recording in all of these states: - The consent/configuration file does not exist. - The file does not contain a recognized `auto_record` value. - The file cannot be read. - Parsing fails because of unexpected formatting. This contradicts `modules/auto-track/main.md`, which states that automatic recording must not occur without user consent. The content sanitizer is also narrow: ```typescript let taskInfo = content.slice(0, maxLength); taskInfo = task ...[truncated 2512 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
hooks/openclaw/hook-guide.md:93- Finding
Documented OpenClaw Hook Template Forwards Full Messages Without Consent or Redaction
- Content
View full analysis
) { const { message } = ctx.event; // 忽略非用户消息 if (message.role !== "user") return; // 分析任务复杂度 const isComplex = analyzeComplexity(message.content); if (isComplex) { // 调用 MyKnowledge 创建知识库 await ctx.agent.execute("myknowledge", { action: "auto_create", content: message.content }); } } function analyzeComplexity(content: string): boolean { const keywords = ["分析", "统计", "挖掘", "开发", "设计", "调研", "整理", "清洗"]; const count = keywords.filter(kw => content.includes(kw)).length; return count >= 2; } ``` The guide states that MyKnowledge will create this hook file under `~/.openclaw/hooks/myknowledge/`. This documented implementation differs materially from the packaged `hooks/openclaw/handler.ts`: - It forwards the complete user message. - It performs no secret redaction. - It does not read or enforce `auto_record`. - It does not verify completed onboarding or recorded consent. - It uses a lower trigger threshold than the main configuration. - It provides no per-message opt-out handling. ### Technical Analysis Users following the official guide can deploy a less secure implementation than the one described in `PRIVACY.md`. Manual hook enablement indicates that the user wants hook functionality, but it does not necessarily authorize unrestricted persistence of every matching message, particularly where the onboarding policy distinguishes one-time recording from permanent automatic recording. Because `message:received` processes arbitrary user messages, forwarding the full content violates data-minimization principles. The recipient is an ...[truncated 1319 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
hooks/claude/handler.js:67- Finding
Claude Hook Silently Forwards and Persists Complete User Messages
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
core/main.md:29- Finding
Mandatory Background Update Check Violates the Declared No-Network and No-Shell Boundary
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:90- Finding
Unpinned npx Installation Command Executes Mutable Third-Party Package Content
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (107)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash # CodeBuddy rm -rf ~/.codebuddy/skills/myknowledge # WorkBuddy rm -rf ~/.workbuddy/skills/myknowledge
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash # CodeBuddy rm -rf ~/.codebuddy/skills/myknowledge # WorkBuddy rm -rf ~/.workbuddy/skills/myknowledge
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash # CodeBuddy rm -rf ~/.codebuddy/skills/myknowledge # WorkBuddy rm -rf ~/.workbuddy/skills/myknowledge
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash # CodeBuddy rm -rf ~/.codebuddy/skills/myknowledge # WorkBuddy rm -rf ~/.workbuddy/skills/myknowledge
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md rm -rf ~/.codebuddy/skills/myknowledge # WorkBuddy rm -rf ~/.workbuddy/skills/myknowledge # OpenClaw rm -rf ~/.openclaw/skills/myknowledge
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
rm -rf ~/.workbuddy/skills/myknowledge
OpenClaw
rm -rf ~/.openclaw/skills/myknowledge
text ---
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `SKILL.md` | 本文件，Skill 主入口 |
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states that it does not perform networking or call external APIs, yet its update-check design instructs loading source-based update-check logic that may require external version checks. This contradiction is dangerous because users may trust a no-network guarantee while the skill still contains a pathway for outbound access or externally influenced behavior.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 采用 JWT + Refresh Token 双令牌方案： - 客户端 → Nginx → Auth Service → Redis（Token 存储） - 客户端 → Nginx → Auth Service → PostgreSQL（用户数据） - 会话管理：Access Token（15min）+ Refresh Token（7d） ### 1.2 模块划分
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 采用 JWT + Refresh Token 双令牌方案： - 客户端 → Nginx → Auth Service → Redis（Token 存储） - 客户端 → Nginx → Auth Service → PostgreSQL（用户数据） - 会话管理：Access Token（15min）+ Refresh Token（7d） ### 1.2 模块划分
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 采用 JWT + Refresh Token 双令牌方案： - 客户端 → Nginx → Auth Service → Redis（Token 存储） - 客户端 → Nginx → Auth Service → PostgreSQL（用户数据） - 会话管理：Access Token（15min）+ Refresh Token（7d） ### 1.2 模块划分
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 采用 JWT + Refresh Token 双令牌方案： - 客户端 → Nginx → Auth Service → Redis（Token 存储） - 客户端 → Nginx → Auth Service → PostgreSQL（用户数据） - 会话管理：Access Token（15min）+ Refresh Token（7d） ### 1.2 模块划分
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 采用 JWT + Refresh Token 双令牌方案： - 客户端 → Nginx → Auth Service → Redis（Token 存储） - 客户端 → Nginx → Auth Service → PostgreSQL（用户数据） - 会话管理：Access Token（15min）+ Refresh Token（7d） ### 1.2 模块划分
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 采用 JWT + Refresh Token 双令牌方案： - 客户端 → Nginx → Auth Service → Redis（Token 存储） - 客户端 → Nginx → Auth Service → PostgreSQL（用户数据） - 会话管理：Access Token（15min）+ Refresh Token（7d） ### 1.2 模块划分
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The documentation recommends a destructive command that deletes the configuration file. Even though this is presented as recovery guidance, destructive file operations triggered through agent-assisted workflows are risky because users may execute them without understanding scope, and similar patterns can normalize unsafe deletion-based remediation.
- Content
✅ 恢复方法：
bash cp ~/.myknowledge/config/skill-state.yaml ~/.myknowledge/config/skill-state.yaml.bak rm ~/.myknowledge/config/skill-state.yaml # 重新加载 Skill，会触发首次引导重建配置
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The provided skill context says this skill creates knowledge bases, manages project documents, tracks requirements, and organizes personal knowledge. However, the manifest description states it is a 'path list / single source of truth' used by lint-paths.sh to validate documentation and configuration path references, which describes a developer-facing path-validation manifest rather than the declared end-user knowledge-management behavior.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Allowing '修' or '1' to trigger automatic repair is highly ambiguous and can be misfired by routine user replies, especially in multilingual or numbered-option conversations. Because the skill promises to '自动执行修复', an accidental trigger could lead to file or config changes without informed user intent.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The skill includes a destructive shell command that deletes a local configuration file. Even though the path is user-scoped, embedding raw 'rm' commands in a skill increases the risk of unsafe execution, copy-paste errors, or automated invocation without adequate validation.
- Content
md cp ~/.myknowledge/config/skill-state.yaml ~/.myknowledge/config/skill-state.yaml.bak 2. 删除损坏文件： rm ~/.myknowledge/config/skill-state.yaml rm ~/.myknowledge/config/install-source 3. 重新触发 Skill，执行首次引导重建配置
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
This command deletes another configuration marker file and is paired with guidance to rebuild configuration afterward, making it an operationally destructive action. In context, the danger is elevated because the same module also promotes lightweight repair triggers, increasing the chance that destructive recovery flows are entered too easily.
- Content
-
删除损坏文件： rm ~/.myknowledge/config/skill-state.yaml rm ~/.myknowledge/config/install-source
-
重新触发 Skill，执行首次引导重建配置
text -
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file is natural-language content, so language-policy review applies. The changelog content is consistently Chinese and does not indicate that users or developers may choose another language, nor does it justify the locale restriction as region-specific, which can violate the rule against forcing a specific language without opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The changelog states that exports include detailed requirements and session content, which may contain sensitive project or personal information, but there is no adjacent privacy warning. In this skill's context, exporting knowledge bases for sharing materially raises the chance of accidental data disclosure if users are not clearly warned about what content is bundled.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The changelog documents ZIP import with automatic extraction into a user directory, which signals filesystem-modifying behavior without nearby warning about archive safety boundaries. In a knowledge-management skill, importing shared ZIPs increases risk of unsafe extraction behavior such as overwriting files, path traversal if implementation is weak, or surprising writes into the user's home directory.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md 审计评分：95 → **98+** - `chmod 755` 改为引导性表述 - `console.log` 改为条件日志 + 脱敏 - 测试场景文件加安全警告
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md 审计评分：95 → **98+** - `chmod 755` 改为引导性表述 - `console.log` 改为条件日志 + 脱敏 - 测试场景文件加安全警告
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file is entirely written in Chinese and repeatedly instructs users to issue commands to the AI in Chinese, such as the examples at L155, L189-L191, L205, L273, L315, L320, and L353. There is no indication that language selection is optional or that the skill supports other locales, which can violate a language/locale policy requiring user choice or opt-in.
- Content
Static analysis
Detected: suspicious.destructive_delete_command
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- INSTALL.md:88