File Super Assistant - 文件超级助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:01 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches a document-creation and text-rewrite purpose, but it has under-disclosed file writes to a hard-coded OneDrive/Desktop path and includes unsafe installation guidance in generated documents.

Review before installing. Use this only in a workspace where document creation is intended, verify output paths before running scripts, avoid sensitive content unless you are comfortable with local persistence, and do not follow generated sudo/npm registry installation commands without independently verifying package provenance and using least-privilege install methods.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/create_openclaw_guide_full.py:134
• Finding: Generated Guide Recommends Unpinned Package Installation with Elevated Privileges## Vulnerability Details **File Location**: `scripts/create_openclaw_guide_full.py:134-161` and `scripts/create_openclaw_guide.py:88-103` **Vulnerability Type**: Unsafe third-party dependency installation guidance **Risk Level**: Medium ### Evidence ```python doc.add_paragraph('Windows users:') add_code_block(doc, 'npm install -g openclaw') doc.add_paragraph('Mac/Linux users:') add_code_block(doc, 'sudo npm install -g openclaw') steps = [ 'Clone the repository: git clone https://github.com/openclaw/openclaw.git', 'Enter the directory: cd openclaw', 'Install dependencies: npm install', 'Create a global link: npm link', 'Verify: openclaw --version' ] add_code_block(doc, 'npm config set registry https://registry.npmmirror.com') add_code_block(doc, 'sudo npm install -g openclaw') ``` The equivalent unpinned global and elevated installation instructions also appear in the smaller generator: ```python doc.add_paragraph('npm install -g openclaw', style='No Spacing') doc.add_paragraph('sudo npm install -g openclaw', style='No Spacing') steps = [ 'Clone the repository: git clone https://github.com/openclaw/openclaw.git', 'Enter the directory: cd openclaw', 'Install dependencies: npm install', 'Create a global link: npm link', 'Verify: openclaw --version' ] ``` ### Technical Analysis These scripts do not execute the commands directly; they embed them into generated Word guides. However, the guides recommend installing an unpinned npm package globally and, on macOS or Linux, running npm with `sudo`. No exact version, lockfile, integrity hash, verified publisher identity, or package provenance check is specified. npm packages may execute lifecycle scripts during installation. Running such scripts through `sudo npm install -g` can give package code root-level execution. Changing the npm registry to a third-party mirror also changes the trust boundary without ...[truncated 1599 chars]
• Remediation: ## Remediation Suggestions - Do not recommend running npm as root. Document a user-scoped installation method, a version manager, or a correctly permissioned npm prefix. - Pin the package to a reviewed exact version, for example `openclaw@X.Y.Z`, instead of resolving the latest release dynamically. - Require verification against an official package name, publisher, release signature, checksum, and authoritative project documentation. - For source installations, pin a reviewed commit or signed release and use the lockfile-preserving command appropriate to the project, such as `npm ci`. - Avoid recommending a third-party registry by default. If a mirror is necessary, explain its trust implications and provide a command to restore the official registry. - Warn users that npm lifecycle scripts execute code during installation. Where supported, inspect packages before installation and initially install with lifecycle scripts disabled. - Apply the same corrections to both guide generators so the shorter document cannot reintroduce the unsafe instructions.

T09 · Insecure Skill Coding Practices

Note

• Location: file_assistant.py:14
• Finding: Importing the Main Module Creates a Hard-Coded Directory Outside the Project Workspace## Vulnerability Details **File Location**: `file_assistant.py:14-15` **Vulnerability Type**: Uncontrolled import-time filesystem side effect **Risk Level**: Low ### Evidence ```python DATA_DIR = Path(__file__).parent FILES_FILE = DATA_DIR / "files.json" OUTPUT_DIR = Path("D:/OneDrive/Desktop/公众号文章") OUTPUT_DIR.mkdir(parents=True, exist_ok=True) ``` ### Technical Analysis Directory creation occurs at module scope. Consequently, merely importing `file_assistant` performs a filesystem write before a caller selects an operation, supplies an output location, or grants explicit consent. The destination is a hard-coded personal desktop/OneDrive path rather than a caller-provided workspace. On Windows, this targets drive `D:`. On other platforms, path interpretation may differ and can create an unexpected project-relative hierarchy named `D:`. The behavior violates least-surprise and workspace-confinement principles. The path is fixed rather than attacker-controlled, so this is not an arbitrary-path-write vulnerability by itself. No privilege escalation, network transmission, or credential access was found in this code path. ### Attack Path 1. Another application, test runner, plugin loader, or agent imports `file_assistant`. 2. Python immediately evaluates the module-level statements. 3. `mkdir` creates the hard-coded directory hierarchy using the importing process's privileges. 4. Later document operations may write files into that external location. Exploitation does not provide an attacker with a selectable destination, but importing an otherwise reusable module is sufficient to trigger an unauthorized filesystem side effect. ### Impact Assessment The effect is limited to directory creation and subsequent application-generated files in a fixed location writable by the current process. It can pollute a user's desktop or synchronized OneDrive directory, expose generated content to cloud synchronization, fail appl ...[truncated 169 chars]
• Remediation: ## Remediation Suggestions - Remove `mkdir` from module scope and perform initialization only inside an explicitly invoked function. - Accept the output directory through a command-line argument or API parameter. - Default to a clearly documented application workspace or platform-specific user-data directory. - Resolve and validate the destination before writing, and optionally enforce containment within an approved workspace. - Ask for confirmation before writing to desktop, synchronized, removable, or otherwise external locations. - Handle directory-creation failures without causing module imports to fail.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/remove_ai_flavor.py:227
• Finding: Empty Input Causes Division by Zero After the Output File Is Written## Vulnerability Details **File Location**: `scripts/remove_ai_flavor.py:227-236` **Vulnerability Type**: Unhandled empty-input condition causing application failure **Risk Level**: Low ### Evidence ```python try: with open(args.output, 'w', encoding='utf-8') as f: f.write(processed) print(f"[OK] Processing complete; saved to: {args.output}") original_len = len(content) processed_len = len(processed) change_rate = abs(processed_len - original_len) / original_len * 100 print(f" Original: {original_len} characters") print(f" Processed: {processed_len} characters") print(f" Change: {change_rate:.1f}%") ``` ### Technical Analysis When the input file is empty, `len(content)` is zero. The change-rate calculation divides by `original_len` without checking for zero, raising `ZeroDivisionError`. The calculation occurs after the output file is opened in write mode and written. As a result, the command partially completes and creates or truncates the requested output before reporting a generic error. This can leave automation in an ambiguous state: the output exists, but the process did not complete its reporting path successfully. The input and output paths are explicit command-line parameters, so the file access itself is part of the tool's declared operation. The flaw is the missing empty-input validation and non-transactional output behavior. ### Attack Path 1. A user or automated workflow supplies a valid but empty UTF-8 input file. 2. The script reads an empty string and processes it successfully. 3. The script opens the output path in write mode, truncating any existing file, and writes empty content. 4. `original_len` is set to zero. 5. The change-rate calculation divides by zero. 6. The exception is caught by the broad surrounding handler, but the output has already been created or truncated and the operation ends in an inconsistent state. ### Impact Assess ...[truncated 383 chars]
• Remediation: ## Remediation Suggestions - Handle zero-length input explicitly: ```python if original_len == 0: change_rate = 0.0 else: change_rate = abs(processed_len - original_len) / original_len * 100 ``` - Validate empty input before opening the output file and either reject it with a nonzero exit status or document that empty output is valid. - Write to a temporary file in the destination directory and atomically replace the final output only after all processing and statistics complete successfully. - Return explicit process exit codes for input, processing, and output failures. - Narrow exception handlers so programming errors such as `ZeroDivisionError` are not presented as generic file-write errors. - Add regression tests covering empty input, identical input and output paths, and pre-existing output files.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The finding indicates the skill may only perform ordinary text file I/O while claiming richer office-document functionality. Misrepresenting processing depth and file handling is a security concern because users may expose local files or expect structured document handling that does not actually occur, increasing the chance of accidental disclosure, corruption, or misuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The finding indicates the skill may only perform ordinary text file I/O while claiming richer office-document functionality. Misrepresenting processing depth and file handling is a security concern because users may expose local files or expect structured document handling that does not actually occur, increasing the chance of accidental disclosure, corruption, or misuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The finding indicates the skill may only perform ordinary text file I/O while claiming richer office-document functionality. Misrepresenting processing depth and file handling is a security concern because users may expose local files or expect structured document handling that does not actually occur, increasing the chance of accidental disclosure, corruption, or misuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The finding indicates the skill may only perform ordinary text file I/O while claiming richer office-document functionality. Misrepresenting processing depth and file handling is a security concern because users may expose local files or expect structured document handling that does not actually occur, increasing the chance of accidental disclosure, corruption, or misuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The finding indicates the skill may only perform ordinary text file I/O while claiming richer office-document functionality. Misrepresenting processing depth and file handling is a security concern because users may expose local files or expect structured document handling that does not actually occur, increasing the chance of accidental disclosure, corruption, or misuse.

Self-Modification

High

• Category: Rogue Agent

Content

p.paragraph_format.space_after = Pt(4)
    
    doc.add_heading('更新技能', level=2)
    add_code_block(doc, '# 更新单个技能\nclawhub update skill-name\n\n# 更新所有技能\nclawhub update')
    
    doc.add_heading('删除技能', level=2)
    add_code_block(doc, 'clawhub uninstall skill-name')

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README advertises file creation, editing, conversion, and AI rewriting capabilities without warning users that these actions may modify files, generate new outputs, or transform sensitive content. Lack of safety messaging can lead users to invoke data-affecting operations without understanding overwrite risks, privacy implications, or the need to verify outputs, especially in a skill that handles documents and content rewriting.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The example trigger phrases are short, generic natural-language commands like creating a Word document or converting a file to PDF. In an agent environment, broad triggers can activate the skill during ordinary conversation or ambiguous requests, causing unintended file operations or content processing without clear user intent. The file-editing context makes this more dangerous because accidental activation can create, modify, or transform user data.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents file creation and content processing workflows that inherently read and write local files, but it does not declare any tool scope such as permissions or allowed-tools. This weakens reviewability and can cause the skill to be granted broader-than-expected filesystem access or to operate without clear user-visible boundaries.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documented workflows show output-file creation but do not clearly warn that running the scripts may create or overwrite files. That omission can lead to accidental data loss or silent modification of local files, especially when output names collide with existing documents.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Broad invocation examples like ordinary conversational requests can cause the skill to trigger in contexts where the user did not intend filesystem actions. In a file-writing skill, ambiguous triggers increase the risk of accidental document creation, unintended content processing, or invocation on sensitive inputs.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The notes prescribe Chinese-specific encoding and font usage, including '中文文件使用 UTF-8 编码' and 'Windows 使用中文字体（宋体、微软雅黑）', without presenting this as an optional or context-specific setting. This reads as a locale constraint rather than a user-selectable preference, which can violate language/locale choice expectations.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest promises creation and editing of Office/PDF documents, but create_docx/create_xlsx/create_ppt only write simple text data to files named with .docx/.xlsx/.pptx extensions, and convert_to_pdf only returns a path without producing a PDF. This is a semantic mismatch between the advertised file-format capabilities and the actual code behavior.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The function writes persistent files to a fixed desktop path and records metadata without any explicit consent, disclosure, or preview of what will be stored. In an agent setting, silent local writes can expose sensitive user content to other local users, backup/sync services like OneDrive, or later unintended reuse.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code silently creates spreadsheet files and updates tracking metadata on disk, again using persistent storage without prior disclosure. Spreadsheet content often contains structured personal or business data, so unexpected writes can increase confidentiality and retention risk, especially in synced folders.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Presentation files are written to disk and cataloged without advance notice, creating the same silent-persistence issue as the other creation functions. In a skill context, users may assume a draft or preview response, not a durable artifact on local storage and in a tracking file.

Ssd 3

Medium

• Confidence: 82% confidence
• Finding: The skill explicitly invites users to submit arbitrary article content for processing in a tool that persists generated files and file records locally. In context, this raises a real data-handling risk because users may provide sensitive drafts, proprietary text, or personal information without being warned that content may be stored on disk or synced externally.

Ssd 3

Medium

• Confidence: 80% confidence
• Finding: Requesting full article text for 'humanization' encourages users to hand over complete source material that may contain confidential or regulated information. The surrounding skill context makes this more dangerous because the tool also performs persistent local writes and file tracking, increasing the chance of unintended retention or exposure.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: Lines L083-L087 instruct users to make text more colloquial by adding specific Chinese particles and replacing more formal pronouns with informal ones, such as using "你" instead of "您". This is a language/register policy issue because it imposes a particular locale/tone preference rather than offering it as an optional style choice.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code file contains natural-language usage guidance and runtime messages that force a specific language/locale for all users. Under the policy, language constraints should be optional or explicitly justified as region-specific; neither is present here.

Unbounded Output

Medium

• Category: Output Handling

Content

# 自动调整列宽
        for column in ws.columns:
            max_length = 0
            column_letter = column[0].column_letter
            for cell in column:
                try:

• Confidence: 75% confidence
• Finding: Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code forces a specific language/locale context by setting Chinese font preferences and generating all document content in Chinese. Under the policy, locale-specific behavior should offer user choice or be clearly justified as region-specific; neither is present in this file.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

doc.add_paragraph('npm install -g openclaw', style='No Spacing')
    
    doc.add_paragraph('Mac/Linux 用户：')
    doc.add_paragraph('sudo npm install -g openclaw', style='No Spacing')
    
    doc.add_paragraph('验证安装：')
    doc.add_paragraph('openclaw --version', style='No Spacing')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

doc.add_paragraph('npm install -g openclaw', style='No Spacing')
    
    doc.add_paragraph('Mac/Linux 用户：')
    doc.add_paragraph('sudo npm install -g openclaw', style='No Spacing')
    
    doc.add_paragraph('验证安装：')
    doc.add_paragraph('openclaw --version', style='No Spacing')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

doc.add_paragraph('npm install -g openclaw', style='No Spacing')
    
    doc.add_paragraph('Mac/Linux 用户：')
    doc.add_paragraph('sudo npm install -g openclaw', style='No Spacing')
    
    doc.add_paragraph('验证安装：')
    doc.add_paragraph('openclaw --version', style='No Spacing')

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.