Security audit

Daily Biotech Briefing

Security checks for vulnerabilities and agentic risk

Overview

The skill has a clear daily briefing purpose, but it overreaches by loading all OpenClaw environment secrets and reading recent mailbox entries just to verify an email was sent.

Install only if you are comfortable with a scheduled workflow that scrapes WeChat/Sogou, sends mail through your QQ credentials, and currently performs overbroad verification. Before using it, narrow the .env loading to only QQMAIL_USER and QQMAIL_AUTH_CODE, avoid listing unrelated inbox messages, and resolve the conflicting Sogou versus mp.weixin.qq.com link instructions.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:278
Finding: Overbroad Secret Loading and Unnecessary Mailbox Access
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The instruction to export all variables from ~/.openclaw/.env is a credential-access pattern because it loads potentially sensitive secrets into the active environment for a non-minimal operation. If the environment is inspected, logged, inherited by child processes, or reused by other tools, mail credentials and other secrets may be exposed or abused.
Content: Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.
发送后必须验证邮件已到达收件箱：

bash
export $(grep -v '^#' ~/.openclaw/.env | xargs) python3 ~/.openclaw/workspace/skills/qqmail/scripts/qqmail.py inbox --limit 5

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file describes a workflow that sends content to a user's email and relies on QQMAIL_USER and QQMAIL_AUTH_CODE, which affects user data/privacy and involves credential-backed transmission. Under the markdown criteria for SQP-2, the description should explicitly warn users about this behavior and the use of configured mail credentials.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions require writing repository introductions in Chinese, and other sections also prescribe Chinese content, but the skill does not present this as a user-selectable option. This is a natural-language policy issue because it forces a specific language/locale without opt-in or a clearly justified regional constraint.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill gives mutually contradictory instructions about which article URLs to include: one section says to use unresolved Sogou redirect links, while later sections require resolved mp.weixin.qq.com links and reject non-WeChat URLs. This inconsistency can cause the agent to bypass its own validation, send broken or misleading links, or leak users into Sogou redirect/CAPTCHA flows instead of the intended destination.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.
⚠️ Sogou redirect links CANNOT be resolved to mp.weixin.qq.com URLs. The sogou redirect service also triggers anti-spider. Use the search result summaries as the content source.

For each filtered article, compose a 2-3 sentence summary in Chinese based on the title + summary fields from the JSON output. The search summaries are detailed enough to create informative briefs.

For the article link, use the sogou redirect URL from the search results (users can open it in a browser where the CAPTCHA is manually solvable). Format as:

text

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The post-send verification step instructs exporting all variables from ~/.openclaw/.env, which expands credential exposure far beyond the earlier narrowly scoped recipient requirement. Broadly loading secrets into the shell environment increases the chance of accidental disclosure, misuse by subsequent commands, or unintended dependence on hidden state.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The subject and body template are explicitly fixed in Chinese, and the file does not indicate that language selection is optional or limited to a region-specific use case. This creates a natural-language policy concern because the skill enforces a specific locale without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The instructions explicitly target removal of articles using Chinese-language patterns such as 科普/标题党, which implies the skill is designed around a specific language/locale. Because the file does not state that this is a China-specific or Chinese-content-only workflow, nor offer user opt-in or choice, it creates a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly instructs use of a curl-based anti-spider bypass workflow, repeated web scraping with delay-based rate-limit evasion, and writes multiple files under /tmp without any user-facing disclosure or consent. In an agent setting, this creates risk of unauthorized network activity, terms-of-service violations, and unexpected local artifact creation, especially because the instructions are operational rather than merely descriptive.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The merge step writes consolidated JSON files into predictable /tmp paths and silently overwrites or creates files, with broad exception suppression that hides failures. While lower severity than the scraping behavior, this can still cause unintended file clobbering, information exposure through shared temporary directories, and reduced auditability in multi-tenant or agent-executed environments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.