T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:100- Finding
Excessive Collection and Correlation of Sensitive Workspace Data
- Content
View full analysis
- Remediation
View remediation
Security audit
成长伙伴 - Growth Partner
Security checks for vulnerabilities and agentic risk
Overview
This skill openly aims to act as a proactive work assistant, but it does so by repeatedly scanning private messages, group chats, documents, calendars, and historical records while retaining derived insights without enough scoping or retention controls.
Install only if the Feishu tenant owner and the monitored user explicitly approve this level of recurring access. Before use, replace hard-coded IDs with deployment-specific configuration, disable private-message and historical transcript searches by default, require per-source consent, and define how retained memory files can be reviewed and deleted.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:157- Finding
Unprotected Persistent Storage of Sensitive Inferences and Activity Records
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:57- Finding
Hard-Coded Personal and Internal Chat Identifiers
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly proposes continuous monitoring of all private chats, @mentions, whitelisted group chats, documents, and calendar events, but provides no clear user-facing consent flow, scope limitation, or privacy warning. This creates a substantial privacy and overcollection risk because sensitive communications and work artifacts may be accessed and processed beyond what is necessary for a specific task.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is designed to comprehensively collect and synthesize a user's private communications and work artifacts for ongoing proactive behavior, which is a classic overcollection/data-surveillance pattern. Even if intended to help the user, the breadth of access and continuous monitoring substantially increases the chance of exposing confidential business, personal, or third-party information.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The retrospective tracing step directs the agent to search across chat history, documents, meeting transcripts, and private messages, including broad cross-context correlation over extended periods. This semantic aggregation is dangerous because it can reveal sensitive relationships and conclusions that would not be exposed by any single source alone.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The natural-language instructions and operational content are entirely in Chinese, which can amount to forcing a specific language if users are not given an opt-in or alternative. The policy allows locale constraints when clearly documented and justified, but this file does not present the language choice as optional or explain a justified regional limitation.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
"sessionTarget": "isolated", "payload": { "kind": "agentTurn", "message": "请执行成长伙伴任务（参考~/.openclaw/workspace/skills/growth-partner/SKILL.md）" } }
text
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Persistently logging synthesized insights from monitored communications creates a secondary store of sensitive derived intelligence. Such derived summaries can be more concentrated and actionable than raw messages, increasing harm if disclosed or reused outside the original purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to persist activity and insight logs derived from monitored communications without warning the user that derived data will be retained. Persistent memory of sensitive summaries can outlive the original context and increase exposure if the memory files are later accessed, repurposed, or mishandled.
- Content