Security audit

File Super Assistant - 文件超级助手

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a document-creation and text-rewrite purpose, but it has under-disclosed file writes to a hard-coded OneDrive/Desktop path and includes unsafe installation guidance in generated documents.

Review before installing. Use this only in a workspace where document creation is intended, verify output paths before running scripts, avoid sensitive content unless you are comfortable with local persistence, and do not follow generated sudo/npm registry installation commands without independently verifying package provenance and using least-privilege install methods.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: scripts/create_openclaw_guide_full.py:134
Finding: Generated Guide Recommends Unpinned Package Installation with Elevated Privileges
Content: View full analysis
Vulnerability Details

File Location: scripts/create_openclaw_guide_full.py:134-161 and scripts/create_openclaw_guide.py:88-103
Vulnerability Type: Unsafe third-party dependency installation guidance
Risk Level: Medium

Evidence

python
doc.add_paragraph('Windows users:') add_code_block(doc, 'npm install -g openclaw') doc.add_paragraph('Mac/Linux users:') add_code_block(doc, 'sudo npm install -g openclaw') steps = [ 'Clone the repository: git clone https://github.com/openclaw/openclaw.git', 'Enter the directory: cd openclaw', 'Install dependencies: npm install', 'Create a global link: npm link', 'Verify: openclaw --version' ] add_code_block(doc, 'npm config set registry https://registry.npmmirror.com') add_code_block(doc, 'sudo npm install -g openclaw')

The equivalent unpinned global and elevated installation instructions also appear in the smaller generator:

python
doc.add_paragraph('npm install -g openclaw', style='No Spacing') doc.add_paragraph('sudo npm install -g openclaw', style='No Spacing') steps = [ 'Clone the repository: git clone https://github.com/openclaw/openclaw.git', 'Enter the directory: cd openclaw', 'Install dependencies: npm install', 'Create a global link: npm link', 'Verify: openclaw --version' ]

Technical Analysis

These scripts do not execute the commands directly; they embed them into generated Word guides. However, the guides recommend installing an unpinned npm package globally and, on macOS or Linux, running npm with sudo. No exact version, lockfile, integrity hash, verified publisher identity, or package provenance check is specified.

npm packages may execute lifecycle scripts during installation. Running such scripts through sudo npm install -g can give package code root-level execution. Changing the npm registry to a third-party mirror also changes the trust boundary without ...[truncated 1599 chars]
Remediation: View remediation
Remediation Suggestions

Do not recommend running npm as root. Document a user-scoped installation method, a version manager, or a correctly permissioned npm prefix.

Pin the package to a reviewed exact version, for example openclaw@X.Y.Z, instead of resolving the latest release dynamically.

Require verification against an official package name, publisher, release signature, checksum, and authoritative project documentation.

For source installations, pin a reviewed commit or signed release and use the lockfile-preserving command appropriate to the project, such as npm ci.

Avoid recommending a third-party registry by default. If a mirror is necessary, explain its trust implications and provide a command to restore the official registry.

Warn users that npm lifecycle scripts execute code during installation. Where supported, inspect packages before installation and initially install with lifecycle scripts disabled.

Apply the same corrections to both guide generators so the shorter document cannot reintroduce the unsafe instructions.

T09 · Insecure Skill Coding Practices

Note

Location: file_assistant.py:14
Finding: Importing the Main Module Creates a Hard-Coded Directory Outside the Project Workspace
Content: View full analysis
Vulnerability Details

File Location: file_assistant.py:14-15
Vulnerability Type: Uncontrolled import-time filesystem side effect
Risk Level: Low

Evidence

python
DATA_DIR = Path(__file__).parent FILES_FILE = DATA_DIR / "files.json" OUTPUT_DIR = Path("D:/OneDrive/Desktop/公众号文章") OUTPUT_DIR.mkdir(parents=True, exist_ok=True)

Technical Analysis

Directory creation occurs at module scope. Consequently, merely importing file_assistant performs a filesystem write before a caller selects an operation, supplies an output location, or grants explicit consent.

The destination is a hard-coded personal desktop/OneDrive path rather than a caller-provided workspace. On Windows, this targets drive D:. On other platforms, path interpretation may differ and can create an unexpected project-relative hierarchy named D:. The behavior violates least-surprise and workspace-confinement principles.

The path is fixed rather than attacker-controlled, so this is not an arbitrary-path-write vulnerability by itself. No privilege escalation, network transmission, or credential access was found in this code path.

Attack Path

Another application, test runner, plugin loader, or agent imports file_assistant.

Python immediately evaluates the module-level statements.

mkdir creates the hard-coded directory hierarchy using the importing process's privileges.

Later document operations may write files into that external location.

Exploitation does not provide an attacker with a selectable destination, but importing an otherwise reusable module is sufficient to trigger an unauthorized filesystem side effect.

Impact Assessment

The effect is limited to directory creation and subsequent application-generated files in a fixed location writable by the current process. It can pollute a user's desktop or synchronized OneDrive directory, expose generated content to cloud synchronization, fail appl ...[truncated 169 chars]
Remediation: View remediation
Remediation Suggestions

Remove mkdir from module scope and perform initialization only inside an explicitly invoked function.

Accept the output directory through a command-line argument or API parameter.

Default to a clearly documented application workspace or platform-specific user-data directory.

Resolve and validate the destination before writing, and optionally enforce containment within an approved workspace.

Ask for confirmation before writing to desktop, synchronized, removable, or otherwise external locations.

Handle directory-creation failures without causing module imports to fail.

T09 · Insecure Skill Coding Practices

Note

Location: scripts/remove_ai_flavor.py:227
Finding: Empty Input Causes Division by Zero After the Output File Is Written
Content: View full analysis
Vulnerability Details

File Location: scripts/remove_ai_flavor.py:227-236
Vulnerability Type: Unhandled empty-input condition causing application failure
Risk Level: Low

Evidence

python
try: with open(args.output, 'w', encoding='utf-8') as f: f.write(processed) print(f"[OK] Processing complete; saved to: {args.output}") original_len = len(content) processed_len = len(processed) change_rate = abs(processed_len - original_len) / original_len * 100 print(f" Original: {original_len} characters") print(f" Processed: {processed_len} characters") print(f" Change: {change_rate:.1f}%")

Technical Analysis

When the input file is empty, len(content) is zero. The change-rate calculation divides by original_len without checking for zero, raising ZeroDivisionError.

The calculation occurs after the output file is opened in write mode and written. As a result, the command partially completes and creates or truncates the requested output before reporting a generic error. This can leave automation in an ambiguous state: the output exists, but the process did not complete its reporting path successfully.

The input and output paths are explicit command-line parameters, so the file access itself is part of the tool's declared operation. The flaw is the missing empty-input validation and non-transactional output behavior.

Attack Path

A user or automated workflow supplies a valid but empty UTF-8 input file.

The script reads an empty string and processes it successfully.

The script opens the output path in write mode, truncating any existing file, and writes empty content.

original_len is set to zero.

The change-rate calculation divides by zero.

The exception is caught by the broad surrounding handler, but the output has already been created or truncated and the operation ends in an inconsistent state.

Impact Assess

...[truncated 383 chars]
Remediation: View remediation
Remediation Suggestions

Handle zero-length input explicitly:

python
if original_len == 0: change_rate = 0.0 else: change_rate = abs(processed_len - original_len) / original_len * 100

Validate empty input before opening the output file and either reject it with a nonzero exit status or document that empty output is valid.

Write to a temporary file in the destination directory and atomically replace the final output only after all processing and statistics complete successfully.

Return explicit process exit codes for input, processing, and output failures.

Narrow exception handlers so programming errors such as ZeroDivisionError are not presented as generic file-write errors.

Add regression tests covering empty input, identical input and output paths, and pre-existing output files.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The finding indicates the skill may only perform ordinary text file I/O while claiming richer office-document functionality. Misrepresenting processing depth and file handling is a security concern because users may expose local files or expect structured document handling that does not actually occur, increasing the chance of accidental disclosure, corruption, or misuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding indicates the skill may only perform ordinary text file I/O while claiming richer office-document functionality. Misrepresenting processing depth and file handling is a security concern because users may expose local files or expect structured document handling that does not actually occur, increasing the chance of accidental disclosure, corruption, or misuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding indicates the skill may only perform ordinary text file I/O while claiming richer office-document functionality. Misrepresenting processing depth and file handling is a security concern because users may expose local files or expect structured document handling that does not actually occur, increasing the chance of accidental disclosure, corruption, or misuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding indicates the skill may only perform ordinary text file I/O while claiming richer office-document functionality. Misrepresenting processing depth and file handling is a security concern because users may expose local files or expect structured document handling that does not actually occur, increasing the chance of accidental disclosure, corruption, or misuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding indicates the skill may only perform ordinary text file I/O while claiming richer office-document functionality. Misrepresenting processing depth and file handling is a security concern because users may expose local files or expect structured document handling that does not actually occur, increasing the chance of accidental disclosure, corruption, or misuse.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · scripts/create_openclaw_guide_full.py (reported line 211)May include surrounding context.
python
p.paragraph_format.space_after = Pt(4) doc.add_heading('更新技能', level=2) add_code_block(doc, '# 更新单个技能\nclawhub update skill-name\n\n# 更新所有技能\nclawhub update') doc.add_heading('删除技能', level=2) add_code_block(doc, 'clawhub uninstall skill-name')

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README advertises file creation, editing, conversion, and AI rewriting capabilities without warning users that these actions may modify files, generate new outputs, or transform sensitive content. Lack of safety messaging can lead users to invoke data-affecting operations without understanding overwrite risks, privacy implications, or the need to verify outputs, especially in a skill that handles documents and content rewriting.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The example trigger phrases are short, generic natural-language commands like creating a Word document or converting a file to PDF. In an agent environment, broad triggers can activate the skill during ordinary conversation or ambiguous requests, causing unintended file operations or content processing without clear user intent. The file-editing context makes this more dangerous because accidental activation can create, modify, or transform user data.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documents file creation and content processing workflows that inherently read and write local files, but it does not declare any tool scope such as permissions or allowed-tools. This weakens reviewability and can cause the skill to be granted broader-than-expected filesystem access or to operate without clear user-visible boundaries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented workflows show output-file creation but do not clearly warn that running the scripts may create or overwrite files. That omission can lead to accidental data loss or silent modification of local files, especially when output names collide with existing documents.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Broad invocation examples like ordinary conversational requests can cause the skill to trigger in contexts where the user did not intend filesystem actions. In a file-writing skill, ambiguous triggers increase the risk of accidental document creation, unintended content processing, or invocation on sensitive inputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The notes prescribe Chinese-specific encoding and font usage, including '中文文件使用 UTF-8 编码' and 'Windows 使用中文字体（宋体、微软雅黑）', without presenting this as an optional or context-specific setting. This reads as a locale constraint rather than a user-selectable preference, which can violate language/locale choice expectations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest promises creation and editing of Office/PDF documents, but create_docx/create_xlsx/create_ppt only write simple text data to files named with .docx/.xlsx/.pptx extensions, and convert_to_pdf only returns a path without producing a PDF. This is a semantic mismatch between the advertised file-format capabilities and the actual code behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The function writes persistent files to a fixed desktop path and records metadata without any explicit consent, disclosure, or preview of what will be stored. In an agent setting, silent local writes can expose sensitive user content to other local users, backup/sync services like OneDrive, or later unintended reuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code silently creates spreadsheet files and updates tracking metadata on disk, again using persistent storage without prior disclosure. Spreadsheet content often contains structured personal or business data, so unexpected writes can increase confidentiality and retention risk, especially in synced folders.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Presentation files are written to disk and cataloged without advance notice, creating the same silent-persistence issue as the other creation functions. In a skill context, users may assume a draft or preview response, not a durable artifact on local storage and in a tracking file.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill explicitly invites users to submit arbitrary article content for processing in a tool that persists generated files and file records locally. In context, this raises a real data-handling risk because users may provide sensitive drafts, proprietary text, or personal information without being warned that content may be stored on disk or synced externally.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: Requesting full article text for 'humanization' encourages users to hand over complete source material that may contain confidential or regulated information. The surrounding skill context makes this more dangerous because the tool also performs persistent local writes and file tracking, increasing the chance of unintended retention or exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Lines L083-L087 instruct users to make text more colloquial by adding specific Chinese particles and replacing more formal pronouns with informal ones, such as using "你" instead of "您". This is a language/register policy issue because it imposes a particular locale/tone preference rather than offering it as an optional style choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language usage guidance and runtime messages that force a specific language/locale for all users. Under the policy, language constraints should be optional or explicitly justified as region-specific; neither is present here.
Content: No source excerpt is available for this finding.

Unbounded Output

Medium

Category: Output Handling
Confidence: 75% confidence
Finding: Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
Content: Scanner excerpt · scripts/create_doc.py (reported line 99)May include surrounding context.
python
# 自动调整列宽 for column in ws.columns: max_length = 0 column_letter = column[0].column_letter for cell in column: try:

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code forces a specific language/locale context by setting Chinese font preferences and generating all document content in Chinese. Under the policy, locale-specific behavior should offer user choice or be clearly justified as region-specific; neither is present in this file.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/create_openclaw_guide.py (reported line 93)May include surrounding context.
python
doc.add_paragraph('npm install -g openclaw', style='No Spacing') doc.add_paragraph('Mac/Linux 用户：') doc.add_paragraph('sudo npm install -g openclaw', style='No Spacing') doc.add_paragraph('验证安装：') doc.add_paragraph('openclaw --version', style='No Spacing')

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/create_openclaw_guide_full.py (reported line 139)May include surrounding context.
python
doc.add_paragraph('npm install -g openclaw', style='No Spacing') doc.add_paragraph('Mac/Linux 用户：') doc.add_paragraph('sudo npm install -g openclaw', style='No Spacing') doc.add_paragraph('验证安装：') doc.add_paragraph('openclaw --version', style='No Spacing')

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/create_openclaw_guide_full.py (reported line 161)May include surrounding context.
python
doc.add_paragraph('npm install -g openclaw', style='No Spacing') doc.add_paragraph('Mac/Linux 用户：') doc.add_paragraph('sudo npm install -g openclaw', style='No Spacing') doc.add_paragraph('验证安装：') doc.add_paragraph('openclaw --version', style='No Spacing')

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Evidence

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Evidence

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Evidence

Technical Analysis

Attack Path

Impact Assess

Remediation Suggestions

SkillSpector

Tp4

Tp4

Tp4

Tp4

Tp4

Self-Modification

Missing User Warnings

Vague Triggers

Undeclared Tool Scope

Missing User Warnings

Vague Triggers

Natural-Language Policy Violations

Description-Behavior Mismatch

Missing User Warnings

Missing User Warnings

Missing User Warnings

Ssd 3

Ssd 3

Natural-Language Policy Violations

Natural-Language Policy Violations

Unbounded Output

Natural-Language Policy Violations

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution