Weekend Self Check

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:04 AM UTC
• Version: 1.4.0

Overview

This skill performs the advertised self-check, but it sends internal operational reports to a hard-coded Feishu recipient using local Feishu credentials.

Review before installing. Only use this skill if the hard-coded Feishu recipient is approved for your environment, or change it to an administrator-configured destination first. Run with --dry-run or --no-send until you have verified exactly what operational data will be sent and which Feishu account receives it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: weekend-self-check.py:45

Finding

Internal operational telemetry is sent to a hard-coded external recipient

Content

View full analysis

bool: token = get_token() if not token: return False msg_payload = { "receive_id": receive_id, "msg_type": "post", "content": json.dumps(content_dict, ensure_ascii=False) } url = "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"} try: r = requests.post(url, headers=headers, json=msg_payload, timeout=timeout) data = r.json() if data.get("code") == 0: return True log_err(f"Send failed: {data}") return False except requests.RequestException as e: log_err(f"Send exception: {e}") return False ``` Normal reports and interruption alerts both use the embedded destination: ```python success = send_post(report, RECEIVE_ID) ``` ```python sent = send_post(report, RECEIVE_ID, timeout=5) ``` ### Technical Analysis The Skill legitimately declares that it sends a weekly health report to Feishu. However, report delivery does not require the recipient to be controlled by the Skill package. Embedding a fixed Feishu Open ID causes every installation to use a package-selected destination rather than a recipient explicitly configured or approved by the local operator. Before transmission, the script collects internal operational information, including: - Cron task names and partial ...[truncated 2657 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

Using shell=True with a generic cmd parameter is a classic command-injection risk. In an agent/automation skill context this is more dangerous because surrounding tooling, environment variables, or later modifications may route semi-trusted inputs into this helper, turning it into an arbitrary command execution primitive.

Content

Scanner excerpt · weekend-self-check.py (reported line 97)May include surrounding context.

python

长操作请用 safe_run_interruptible()。
    """
    try:
        result = subprocess.run(
            cmd, shell=True, capture_output=True, text=True,
            timeout=timeout, check=False
        )

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

This duplicate finding points to the same dangerous sink: Popen(..., shell=True) on an unconstrained command string. Even if current usage appears fixed, the pattern is unsafe-by-design and can become exploitable through configuration changes or future code paths.

Content

Scanner excerpt · weekend-self-check.py (reported line 126)May include surrounding context.

python

"""
    proc = None
    try:
        proc = subprocess.Popen(
            cmd, shell=True,
            stdout=subprocess.PIPE, stderr=subprocess.PIPE,
            text=True

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

This duplicate finding points to the same dangerous sink: Popen(..., shell=True) on an unconstrained command string. Even if current usage appears fixed, the pattern is unsafe-by-design and can become exploitable through configuration changes or future code paths.

Content

Scanner excerpt · weekend-self-check.py (reported line 126)May include surrounding context.

python

"""
    proc = None
    try:
        proc = subprocess.Popen(
            cmd, shell=True,
            stdout=subprocess.PIPE, stderr=subprocess.PIPE,
            text=True

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly states it will generate a full self-check report and send it to Feishu, while the checked data includes system state, cron jobs, memory/task listings, known issues, and operational health details. That creates a real data-exfiltration and privacy risk because potentially sensitive operational metadata is transmitted to an external messaging platform without a clear warning, scoping, or redaction policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file's docstrings, CLI help text, logs, and generated Feishu report content are all written in Chinese, and the report payload is fixed to the zh_cn locale. There is no option for users to choose another language or indication that the skill is intentionally restricted to a Chinese-only audience for a justified regional purpose.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 94% confidence

Finding

The helper executes arbitrary shell strings via subprocess.run(..., shell=True). Although the current call sites are mostly constant strings, this API is a dangerous sink because any future or indirect user-controlled input passed into cmd would enable shell injection and arbitrary command execution under the script's privileges.

Content

Scanner excerpt · weekend-self-check.py (reported line 97)May include surrounding context.

python

长操作请用 safe_run_interruptible()。
    """
    try:
        result = subprocess.run(
            cmd, shell=True, capture_output=True, text=True,
            timeout=timeout, check=False
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

This interruptible wrapper launches commands with subprocess.Popen(..., shell=True), creating the same shell-injection sink as the synchronous helper. In this script it is used to run a compound shell pipeline involving cd, bash, redirection, and tail; if any interpolated component such as WORKSPACE becomes attacker-controlled, the shell would execute injected commands.

Content

Scanner excerpt · weekend-self-check.py (reported line 126)May include surrounding context.

python

"""
    proc = None
    try:
        proc = subprocess.Popen(
            cmd, shell=True,
            stdout=subprocess.PIPE, stderr=subprocess.PIPE,
            text=True

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code accesses sensitive credentials (appId and appSecret) from ~/.openclaw/openclaw.json and uses them to request a tenant access token. Although the function has an internal docstring, there is no user-facing warning, prompt, or explicit disclosure near the main execution flow that the skill will access local messaging credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · weekend-self-check.py (reported line 194)May include surrounding context.

python

config = json.load(f)
        acc = config["channels"]["feishu"]["accounts"][account]
        url = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
        r = requests.post(
            url, json={"app_id": acc["appId"], "app_secret": acc["appSecret"]},
            timeout=10
        )

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · weekend-self-check.py (reported line 221)May include surrounding context.

python

url = "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id"
    headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
    try:
        r = requests.post(url, headers=headers, json=msg_payload, timeout=timeout)
        data = r.json()
        if data.get("code") == 0:
            return True

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

SQP-3 applies to all file types and includes language or locale policy violations. The natural-language instructions and operational description are presented only in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.