ClawHub
Back to skill

Security audit

Sketch Illustration

Security checks for vulnerabilities and agentic risk

Overview

The skill can generate illustrations, but it also sends files to Feishu using local app credentials and includes a hard-coded default recipient.

Review this skill before installing. Use it only if you intend generated images and prompts to leave your environment, verify the Feishu recipient every time, remove the hard-coded default open_id, and avoid giving it broad OpenClaw app credentials unless the delegated Feishu sender is trusted and integrity-controlled.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/send_to_feishu.sh:14
Finding

Feishu Credentials Are Exposed to an External Script Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send_to_feishu.sh:8
Finding

Hard-Coded Default Feishu Recipient Can Cause Unintended Data Disclosure

Content
View full analysis
Remediation
View remediation
" >&2 exit 1 fi OPEN_ID="$2" ``` 2. Validate the supplied recipient against an administrator-managed allowlist where messaging is restricted to approved accounts. 3. Display the destination and request explicit confirmation before transmitting potentially sensitive content in interactive workflows. 4. Separate generation from delivery so producing an image does not automatically imply external transmission. 5. Avoid embedding personal account identifiers in source code or documentation. Store approved destination configuration in a protected, environment-specific policy file. 6. Record destination, initiating user, file identifier, and transmission result in a security audit log without recording credentials or sensitive image contents. 7. Add automated tests confirming that omission of the recipient causes a safe failure rather than delivery to a fallback account. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (55)

Tainted flow: 'req' from os.environ.get (line 37, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_sketch.py (reported line 49)May include surrounding context.

python
print(f"Generating image with model: {model}")
    try:
        with urllib.request.urlopen(req) as resp:
            status = resp.status
            body = resp.read().decode("utf-8")
    except urllib.error.HTTPError as e:

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill description centers on illustration generation, but the documented workflow includes external delivery to Feishu and the static finding indicates undeclared credential/config access for that purpose. Hidden credential reads and outbound delivery materially expand the trust boundary and could expose generated or user-provided content to external systems without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description centers on illustration generation, but the documented workflow includes external delivery to Feishu and the static finding indicates undeclared credential/config access for that purpose. Hidden credential reads and outbound delivery materially expand the trust boundary and could expose generated or user-provided content to external systems without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill advertises automatic upload and sending to Feishu but does not warn users that content will leave the local environment and be shared with an external service. This is dangerous because prompts, embedded text, or generated images may contain sensitive business or personal information that users did not intend to disclose.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The operational instructions directly invoke a script to send generated files to Feishu, yet no consent, approval, or data-sharing notice is required at the point of transfer. Hardwiring external delivery into the workflow can leak sensitive content and makes accidental or unauthorized sharing more likely.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill uses capabilities implying file access and network transmission but does not declare any explicit tool scope or permissions. That creates a transparency and containment gap: a user or platform may not realize the skill can read local files and send data externally, increasing the risk of unintended data access or exfiltration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger conditions are very broad and can activate on common image-related requests, increasing the chance the skill runs in contexts the user did not intend. Because the skill can also transmit outputs externally, overbroad triggering raises the risk of accidental invocation and unintended data handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The note says all text labels default to Chinese, which imposes a language preference without indicating that the user can choose another language. This is a natural-language policy concern because it forces a locale choice rather than making it configurable or user-directed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file presents all user-facing instructions exclusively in Chinese, which can amount to a language/locale policy violation when no user opt-in or documented regional scope is provided. The file does not indicate that the skill is China-specific or that users may choose another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The entire skill file is written as mandatory Chinese-language instructions and does not provide any opt-in, alternative language option, or justification that the skill is region- or locale-specific. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly directs the agent to proceed with batch API execution after a single user choice, without a final confirmation at the point of network action. Because this causes external transmission and possible billable API usage, the lack of a clear warning and execution checkpoint increases the risk of unintended data disclosure or unwanted charges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This section includes concrete commands for performing live batch requests to an external API, but it does not prominently warn that executing them sends user content off-platform and may create financial cost. In a skill that auto-generates and uploads images, this omission can lead users or agents to trigger external actions without fully informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

Line L11 explicitly centers iteration guidance on Chinese readability ('中文不清楚') and prescribes Chinese-specific presentation constraints, while the document does not indicate that language selection is optional or limited to a justified Chinese-only context. This can constitute a language/locale policy issue because it implicitly assumes a fixed language rather than offering user choice.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-config.md (reported line 7)May include surrounding context.

ZenMux（主用）

text
API_URL: https://api.zenmux.ai/v1/images/generations
MODEL: google/gemini-3-pro-image-preview
TOKEN: <从 openclaw.json 读取>
SIZE: 16:9

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-config.md (reported line 48)May include surrounding context.

md
}

# Submit task
response = requests.post(url, json=payload, headers=headers)
data = response.json()
task_id = data["data"][0]["task_id"]

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file includes natural-language instructions that require Chinese text in generated outputs, such as 'Chinese labels' and a 'clear Chinese title'. Under the policy, forcing a specific language without user opt-in is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The example explicitly requires a Chinese title and short Chinese labels, reinforcing a fixed-language constraint in the skill content. Because no opt-in or alternative language path is provided, this is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The prompt template explicitly requires 'Chinese labels' and a Chinese title, which imposes a specific language by default. Under the policy, forcing a language without user opt-in is a natural-language policy violation unless a justified locale constraint is documented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The example continues the same language constraint by requiring a Chinese title and short Chinese labels. Because the file does not state that this skill is limited to Chinese-language contexts, this reads as a forced locale choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Line L15 states '强制：中文清晰可读', which mandates a specific language for the skill output. The policy allows language constraints only when the user is offered a choice or the locale restriction is clearly justified, neither of which appears in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction "强制：中文清晰可读" requires a specific language unconditionally. This is a natural-language locale policy issue because the file does not provide user opt-in, alternatives, or context showing that the template is explicitly limited to a Chinese-only use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The line explicitly requires content to be in Chinese ("中文清晰可读、无乱码"). Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which this template does not provide.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file’s user-facing instructions and warning text are presented exclusively in Chinese, which imposes a specific language on users without indicating any option to choose another language. The policy explicitly flags language or locale constraints when they are forced without user opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-config.md (reported line 17)May include surrounding context.

建议：把真实 TOKEN 放在 scripts/apimart.env（本地文件），不要写进文档/仓库或聊天记录。

text
API_URL: https://api.apimart.ai/v1/images/generations
MODEL: gemini-3-pro-image-preview
TOKEN: <YOUR_TOKEN>
RESOLUTION: 2K

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-config.md (reported line 31)May include surrounding context.

建议：把真实 TOKEN 放在 scripts/apimart.env（本地文件），不要写进文档/仓库或聊天记录。

text
API_URL: https://api.apimart.ai/v1/images/generations
MODEL: gemini-3-pro-image-preview
TOKEN: <YOUR_TOKEN>
RESOLUTION: 2K

Static analysis

No suspicious patterns detected.