T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_and_digest.py:35- Finding
Untrusted URLs Can Be Misclassified as High-Credibility Sources
- Content
View full analysis
- Remediation
View remediation
Security audit
News Evening Digest - 新闻晚报
Security checks for vulnerabilities and agentic risk
Overview
This skill is a scheduled news digest, but its documented Feishu/QQ delivery does not match the code, which can post to an undocumented WeCom webhook and notify everyone there.
Review before installing. Only use this if you are comfortable with an automatic scheduled script posting digests externally, and verify the actual destination variable WECOM_WEBHOOK_URL before running it. Treat webhook URLs as secrets, remove the default @all behavior unless wanted, and do not rely on the documented Feishu/QQ delivery claims without fixing the implementation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/fetch_and_digest.py:302- Finding
Notification Configuration Mismatch Can Cause Unexpected WeCom Delivery
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)
Tainted flow: 'payload' from os.environ.get (line 70, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python "max_results": num_results } response = requests.post(TAVILY_API_URL, json=payload, timeout=20) if response.status_code == 200: data = response.json()
Tainted flow: 'webhook_url' from os.environ.get (line 286, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
The webhook destination is taken directly from an environment variable and used as the outbound URL without validation or allowlisting. If an attacker can influence environment configuration, they can redirect the full digest to an arbitrary endpoint, causing unintended data exfiltration and possible SSRF into internal network services.
- Content
python } } response = requests.post(webhook_url, json=payload, timeout=10) if response.status_code == 200: result = response.json()
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
1. 配置飞书 Webhook
bash # 编辑 .env 文件 notepad "$env:USERPROFILE\.openclaw\.env" # 添加以下内容（替换为你的飞书机器人 Webhook）
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # 编辑 .env 文件 notepad "$env:USERPROFILE\.openclaw\.env" # 添加以下内容（替换为你的飞书机器人 Webhook） FEISHU_WEBHOOK_URL="https://open.feishu.cn/open-apis/bot/v2/hook/xxxxxx"
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A description-behavior mismatch is security-relevant because users may approve the skill based on the stated behavior while the implementation actually sends to different services, gathers broader content, and relies on different sources than claimed. That breaks informed consent and can hide unexpected data flows or operational behavior behind misleading documentation.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest says this skill sends the evening digest to QQ and Feishu, but the only real outbound delivery implemented here is
send_to_wecom, which posts to an Enterprise WeChat webhook.send_to_qqis only a placeholder that logs a message and returns success, and there is no Feishu sender at all, so the runtime behavior materially diverges from the stated delivery targets.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The guide instructs users to place a Feishu webhook URL into a shared environment file but does not clearly label it as a secret or warn against exposing it in logs, screenshots, backups, or source control. Feishu bot webhooks often function as bearer-style credentials, so disclosure can let an attacker send arbitrary messages to the configured channel and abuse the bot integration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README states that the skill automatically pushes news digests to QQ and Feishu but does not clearly warn users that content will be sent to external messaging platforms. This creates a consent and data-sharing risk because users may trigger or configure the skill without understanding that information leaves the local agent context and is delivered through third-party services.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documents network access and environment-variable use but does not declare any explicit tool scope or permissions boundary. That weakens reviewability and least-privilege enforcement, making it easier for a skill that can send outbound messages and read secrets to do more than users expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is designed to automatically transmit generated content to external messaging platforms on a schedule, but the user-facing description does not prominently warn about that external disclosure. Automatic scheduled exfiltration to third-party services increases privacy and operational risk, especially if future prompts or generated summaries include unintended sensitive content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Documenting a webhook variable without an explicit warning obscures that all included message content will be posted to the configured Feishu bot endpoint, which is an external service boundary. Users may paste internal or sensitive content into a system that forwards it off-platform without realizing the privacy and retention implications.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The top-level docstring states the script uses a Multi-Source-Research skill and integrates Tavily API, multi-source search, and social media monitoring. In practice,
multi_source_searchonly makes a single Tavily API call, and there is no separate implementation for social media monitoring, academic-source retrieval, or other claimed integrations.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description says the digest references the World Monitor data source, but this file's actual retrieval logic uses Tavily search requests and fallback inline article data. World Monitor only appears as a formatted footer link/string, not as an actual upstream source in the implemented data collection path.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python # Tavily API configuration TAVILY_API_KEY = os.environ.get('TAVILYAPIKEY', '') TAVILY_API_URL = 'https://api.tavily.com/search' # Multi-Source-Research configuration MULTI_SOURCE_ENABLED = os.environ.get('MULTI_SOURCE_ENABLED', 'true').lower() == 'true'
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This function's docstring explicitly lists social media monitoring, academic sources, and news aggregators as integrated inputs. However, the body only constructs one Tavily search request and processes its results, so the documentation overstates and contradicts the implemented behavior.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python "max_results": num_results } response = requests.post(TAVILY_API_URL, json=payload, timeout=20) if response.status_code == 200: data = response.json()
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script forces Chinese-language queries, Chinese formatted digest text, and Shenzhen-specific weather content throughout the generated output. There is no opt-in, configuration, or documented justification for restricting language/locale, which matches the policy concern for forced language or locale behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code sends the full generated digest to a WeCom webhook via HTTP, which is a network transmission of collected content to an external service. While the module docstring says it "pushes to QQ and Feishu," there is no explicit user warning near the sending logic about outbound transmission, recipient scope, or that message contents will leave the local system.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
This code posts the full digest to a destination URL entirely controlled by environment configuration, with no validation of scheme, host, or network location. In a compromised or misconfigured deployment, that allows silent redirection of outbound content to attacker infrastructure or internal services.
- Content
python } } response = requests.post(webhook_url, json=payload, timeout=10) if response.status_code == 200: result = response.json()
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The natural-language instructions and usage examples are presented exclusively in Chinese, with no indication that other languages are supported or that the user can choose their preferred language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The name, description, title, and sample behavior all indicate a Chinese-language evening digest, but the document does not state that language is configurable or optional. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly justified.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The script reads WECOM_WEBHOOK_URL from the environment and uses it as a credential-bearing destination for message delivery. Although missing configuration is logged, there is no warning or comment explaining that this value is sensitive and controls external message delivery.
- Content