T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bug-fix-flow.mjs:317- Finding
Shell command injection through untrusted callback and repository values
- Content
View full analysis
- Remediation
View remediation
Security audit
yunxiao-devops
Security checks for vulnerabilities and agentic risk
Overview
This DevOps skill is broadly aligned with Yunxiao automation, but it includes high-impact repository and deployment actions with unsafe credential, shell, and persistence behavior.
Review this skill carefully before installing. Use only least-privilege test credentials, rotate or revoke any exposed or generated tokens/SSH keys, avoid running it as root, and do not enable the automated bug-fix or one-click merge/deploy flows until the hardcoded token, shell command construction, broad SSH enrollment, bypassPermissions use, and shared temporary state are fixed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/bug-fix-flow.mjs:353- Finding
Untrusted repository automation runs Claude Code with permission checks disabled
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/bug-fix-flow.mjs:183- Finding
Automatic organization-wide SSH key creation and enrollment violates least privilege
- Content
View full analysis
(k.key ?? '').trim().split(' ')[1] === pubkeyBody); if (exists) { console.log(`[ssh] 公钥已注册: ${exists.title}`); return; } // 未注册，自动注册 console.log('[ssh] 公钥未注册，正在通过 API 注册...'); const result = await yunxiaoPost(`/codeup/organizations/${ORG_ID}/keys`, { key: pubkey, title: '@openclaw-server', keyScope: 'ALL', }); console.log(`[ssh] 注册成功 id=${result.id}, title=${result.title}`); } ``` The function is invoked before the selected work item is even confirmed to be a Bug: ```javascript async function stepSelectRepo(workitemId) { // 前置检查：确保 SSH Key 已注册 await ensureSSHKey(); const [item, repos] = await Promise.all([getWorkitem(workitemId), listRepos()]); if (item.categoryId !== 'Bug') { // ... return; } } ``` ### Technical Analysis Starting the bug-fix workflow silently creates an unencrypted RSA private key when the expected public key is absent and then registers the corresponding public key in Yunxiao with `keyScope: 'ALL'`. The enrollment occurs before validating whether the requested work item qualifies for the workflow and before the user chooses a repository. Thu ...[truncated 1680 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bug-fix-flow.mjs:173- Finding
Predictable shared temporary state permits state tampering and privileged file clobbering
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (570)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The documented purpose does not accurately describe the skill's real behavior: it includes Feishu messaging, local credential/config reads, background polling, and state-changing DevOps actions such as merge, pipeline trigger, and deployment workflow execution. This mismatch undermines informed consent and can cause an agent to invoke the skill in contexts where the user did not intend notification, credential usage, or production-impacting actions.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The skill is designed to load secrets from
.env.local, a local file containing tokens and organization identifiers, and prioritizes local file-based secret access in its configuration flow. In an agent context this increases the chance that the skill reads sensitive credentials from the workspace or user environment without clear scoping, especially when combined with shell and network capabilities.- Content
快速配置（复制示例文件）：
bash cp .env.local.example .env.local # 编辑 .env.local，填入你的 token 和 org ID
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The skill requires a Yunxiao personal access token and is built to consume that credential for broad API actions including merges, pipeline triggers, and workflow execution. This is sensitive credential usage; if the skill is over-triggered or insufficiently permissioned, the token's authority can be abused to alter repositories, pipelines, and deployments.
- Content
md **必须配置：** | 环境变量 | 说明 | |---------|------| | `YUNXIAO_TOKEN` | 云效 Personal Access Token（个人设置 → Access Token） | | `YUNXIAO_ORG_ID` | 云效组织 ID（URL 中 `/organizations/` 后的字符串） | **可选配置：**
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | ☀️ 每日站会 | "今天有什么任务"、"站会" | `scripts/daily-standup-card.mjs` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | ☀️ 每日站会 | "今天有什么任务"、"站会" | `scripts/daily-standup-card.mjs` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 查看我的工作项 | "查下我的工作项"、"我负责什么" | `scripts/my-workitems-card.mjs` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 查看我的工作项 | "查下我的工作项"、"我负责什么" | `scripts/my-workitems-card.mjs` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 查看我的工作项 | "查下我的工作项"、"我负责什么" | `scripts/my-workitems-card.mjs` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 查看工作项详情 | 粘贴云效 URL 或"看下 UHZM-5" | `scripts/workitem-card.mjs <id>` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 查看工作项详情 | 粘贴云效 URL 或"看下 UHZM-5" | `scripts/workitem-card.mjs <id>` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 查看工作项详情 | 粘贴云效 URL 或"看下 UHZM-5" | `scripts/workitem-card.mjs <id>` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 查看工作项详情 | 粘贴云效 URL 或"看下 UHZM-5" | `scripts/workitem-card.mjs <id>` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 创建工作项 | "帮我建个需求/任务/缺陷" | `scripts/create-workitem-flow.mjs` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 创建工作项 | "帮我建个需求/任务/缺陷" | `scripts/create-workitem-flow.mjs` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 创建工作项 | "帮我建个需求/任务/缺陷" | `scripts/create-workitem-flow.mjs` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 创建工作项 | "帮我建个需求/任务/缺陷" | `scripts/create-workitem-flow.mjs` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 工作项关联 | "把这个需求关联到任务"、"看关联项" | `scripts/workitem-relation-flow.mjs <id>` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 工作项关联 | "把这个需求关联到任务"、"看关联项" | `scripts/workitem-relation-flow.mjs <id>` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | ⏱️ 工时打卡 | "打卡"、"记工时"、"登记今日工时" | `scripts/effort-checkin-card.mjs` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | ⏱️ 工时打卡 | "打卡"、"记工时"、"登记今日工时" | `scripts/effort-checkin-card.mjs` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 修复 Bug | "帮我修复这个 bug"、"修 UHZM-5" | `scripts/bug-fix-flow.mjs <id>` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 修复 Bug | "帮我修复这个 bug"、"修 UHZM-5" | `scripts/bug-fix-flow.mjs <id>` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 修复 Bug | "帮我修复这个 bug"、"修 UHZM-5" | `scripts/bug-fix-flow.mjs <id>` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 修复 Bug | "帮我修复这个 bug"、"修 UHZM-5" | `scripts/bug-fix-flow.mjs <id>` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 📝 最近提交 | "谁改了代码"、"看最近 commit" | `scripts/commit-activity-card.mjs` |
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/appstack-card.mjs:307
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/bug-fix-flow.mjs:190
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/create-workitem-flow.mjs:344
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/release-flow.mjs:296
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/appstack-card.mjs:45
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/bug-fix-flow.mjs:390
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/commit-activity-card.mjs:25
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/create-workitem-flow.mjs:66
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/daily-standup-card.mjs:28
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/effort-checkin-card.mjs:27
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/mr-review-card.mjs:30
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/pipeline-log-card.mjs:24
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/release-flow.mjs:35
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/repo-init-flow.mjs:28
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/sprint-dashboard-card.mjs:29
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/testcase-card.mjs:23
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/version-release-flow.mjs:30
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/workitem-relation-flow.mjs:30
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/appstack-card.mjs:45
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/commit-activity-card.mjs:25
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/create-workitem-flow.mjs:66
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/daily-standup-card.mjs:28
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/effort-checkin-card.mjs:27
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/mr-review-card.mjs:30
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/pipeline-log-card.mjs:24
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/release-flow.mjs:35
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/repo-init-flow.mjs:28
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/sprint-dashboard-card.mjs:29
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/testcase-card.mjs:23
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/version-release-flow.mjs:30
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/workitem-relation-flow.mjs:30