T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.js:132- Finding
Shell Command Injection in Generated Cron Registration Commands
- Content
View full analysis
- Remediation
View remediation
Security audit
Jiajiaoy Morning
Security checks for vulnerabilities and agentic risk
Overview
This daily briefing skill is mostly purpose-aligned, but it ships personal subscriber details and generates unsafe scheduled-task commands from unvalidated setup fields.
Review before installing. Remove the bundled subscriber file and documentation row, require explicit user confirmation for saved profiles and cron jobs, validate channel and recipient fields before command generation, and only use reviewed or pinned dependency skills. Users should also understand that evening fortune generation may read bazi profile data from the yunshi skill.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Error
- Location
scripts/build-prompts.js:22- Finding
Unpinned Third-Party Skills Are Installed and Executed as Trusted Code
- Content
View full analysis
# 一键安装所有依赖 clawhub install newstoady clawhub install dailytech clawhub install dailyfinance clawhub install weather-daily clawhub install yunshi clawhub install daily-history clawhub install daily-recipe clawhub install daily-quote clawhub install daily-mindful clawhub install daily-fitness clawhub install english-daily ``` ```js const REQUIRED_SKILLS = [ { slug: 'newstoady', script: 'scripts/morning-push.js' }, { slug: 'dailytech', script: 'scripts/morning-push.js' }, { slug: 'dailyfinance',script: 'scripts/morning-push.js' }, { slug: 'weather-daily',script: 'scripts/morning-push.js' }, { slug: 'yunshi', script: 'scripts/daily-push.js' }, { slug: 'daily-history',script: 'scripts/morning-push.js' }, { slug: 'daily-recipe',script: 'scripts/morning-push.js' }, { slug: 'daily-quote', script: 'scripts/morning-push.js' }, { slug: 'daily-mindful',script: 'scripts/morning-push.js' }, { slug: 'daily-fitness',script: 'scripts/morning-push.js' }, { slug: 'english-daily',script: 'scripts/daily-push.js' }, ]; const missing = REQUIRED_SKILLS.filter(dep => !fs.existsSync(path.join(SKILLS_BASE, dep.slug, dep.script)) ); ``` ```js function runScript(scriptPath, scriptArgs) { try { const cmd = `node "${scriptPath}" ${scriptArgs.map(a => `"${a}"`).join(' ')}`; const output = execSync(cmd, { timeout: 10000, encoding: 'utf8', stdio: ['pipe','pipe','pipe'] }); ``` ### Technical Analysis The installation instructions identify dependencies only by mutable registry slug. No exact version, cryptographic integrity hash, trusted publisher verification, or vendored source is specified. The local dependency check verifies only that expected paths exist ...[truncated 1683 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
data/users/8603011439.json:1- Finding
Personal Subscriber Information Is Included in the Distributed Artifact
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (22)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
从代码看，核心功能是聚合并执行 11 个子 skill 的脚本，生成早间简报模块结果，并可输出给 cron 的说明消息。虽然包含“yunshi”模块，但它位于早间分组中，名称也是“今日运势”，并非声明中的 18:00“明日运势”。代码中没有任何 18:00 计划任务、触发器、注册逻辑、用户首次交互逻辑，只有读取现有用户配置并按配置过滤模块。声明描述的是一个完整的早晚推送与自动注册能力集合，而提供的代码片段仅支持早间简报的构建与执行指令生成，属于实质性描述不符。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
代码行为与描述存在明显范围不一致。该脚本的核心功能只是为单个用户生成晚间“明日运势”的 prompt：读取本地用户配置文件与另一个 skill 的八字档案，判断 evening.yunshi_tomorrow 开关后输出一段用于后续生成运势内容的指令。它并不包含描述中的完整 skill 能力，尤其缺少早间 11 模块简报、任何定时器/触发器、真正的消息发送或推送、首次偏好询问及自动注册流程。虽然代码确实与“晚间明日运势（结合八字个性化推算）”这一子功能一致，但相对于声明的整体 skill 功能来说，提供的代码只是其中一小部分，因此应判定为描述与实际代码不匹配。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 如果缺少依赖，运行 `node scripts/build-prompts.js` 时会自动提示缺少哪些 skill 及安装命令。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 如果缺少依赖，运行 `node scripts/build-prompts.js` 时会自动提示缺少哪些 skill 及安装命令。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/setup.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/setup.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/setup.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/evening-push.js <userId>
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation exposes a real-looking registered user's identifier, name, city, channel, and enabled modules without any privacy notice or masking. Publishing personally identifiable information in skill docs creates immediate privacy risk, enables profiling, and can facilitate targeted phishing or harassment, especially because the skill is explicitly tied to scheduled personal messaging.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger phrases include broad everyday expressions like '我想订阅' and '今天早报', which can cause accidental invocation in normal conversation. In an agent context, unintended triggering is risky because this skill can initiate setup flows, write configuration, and lead to scheduled task registration or message sending without sufficiently explicit user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to save user configuration data and then register scheduled tasks, but it does not clearly disclose data retention, where files are stored, what system changes are made, or require explicit informed consent for those changes. In a multi-agent or automation environment, silent persistence and scheduler registration can surprise users and create unwanted long-lived behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The template preselects a specific city (上海) and language (zh), which imposes a locale/language choice by default. This can violate language/locale policy when users are not offered a choice or when the constraint is not documented as region-specific and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s user-facing description, error messages, module names, and generated instructions are all fixed in Chinese, and one module explicitly passes
--lang zh. This creates a language/locale constraint without any visible opt-in or justification that the skill is region-specific.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This file uses child_process.execSync to launch numerous other skills' scripts from the local filesystem. For a skill whose stated purpose is scheduled morning/evening content delivery, acting as a subprocess orchestrator across installed skills is a more powerful execution capability than the manifest itself describes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Natural-language strings, usage text, and generated content are all fixed in Chinese, and the fallback date formatting explicitly uses zh-CN. The file does not offer opt-in language selection or document that the skill is intentionally limited to a Chinese-language/locale context.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script directly reads personal 八字 profile data from another skill’s datastore (
../../yunshi/data/profiles) and uses it to generate personalized output. Cross-skill access to sensitive profile data creates an unnecessary trust boundary violation unless there is explicit consent, documented data sharing, and platform-level authorization; otherwise one skill can silently harvest another skill’s user data.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script consumes a user’s personal 八字 profile and emits personalized fortune-generation prompts without any visible notice at execution time that sensitive profile data is being accessed. Even though the output is not sent externally in this file, silent use of personal profile attributes for personalization is a privacy issue and can lead to unexpected disclosure or misuse downstream by whatever agent consumes the prompt.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The configuration hard-codes a Chinese city default and sets
languagetozhwhen the user does not provide a language. Under the policy, forcing a specific language or locale without explicit user choice is a natural-language policy violation unless it is clearly documented and justified.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This JSON manifest sets the user's language to "zh" as a fixed locale value, but the file provides no natural-language indication that the user chose this language or that the locale restriction is required for a region-specific purpose. Under the policy rule, forcing a specific language without visible opt-in can be a locale-policy concern.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This manifest-style JSON template hard-codes a default city of Shanghai and language of zh, but provides no explanation of whether these are merely placeholders, required defaults, or examples to be replaced. In a template file, such unspecified defaults can act as overly broad activation/context assumptions and may cause unintended behavior if consumed as-is.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The header comments frame this script as a morning-briefing prompt builder, but the actual behavior is broader orchestration across many external skills including horoscope content and grouped message-generation instructions. This is a mild manifest/code mismatch because the skill manifest advertises both morning and evening flows, while this file’s own documentation presents a narrower purpose than the implemented multi-skill orchestration.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The code checks for the presence of multiple separate skills under a shared skills directory and emits installation commands when they are missing. Dependency checking is understandable for implementation, but coupling this skill to discovery of many external packages goes beyond the manifest’s user-facing description of sending daily briefings and horoscopes.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/build-prompts.js:190