AI新闻早报（中文版）

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:37 AM UTC
• Version: 1.3.1

Overview

The skill is mostly a coherent AI news briefing generator, but it includes under-disclosed network routing and unsafe credential-handling guidance that users should review before installing.

Install only if you are comfortable giving the skill Tavily search access and, optionally, a SearXNG endpoint. Before using it, avoid the troubleshooting command that prints your API key, prefer HTTPS for any remote SearXNG instance, and remove or explicitly configure the hardcoded proxy in run_daily.sh unless you intentionally trust a service on 127.0.0.1:7897.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: INSTALL.md:123
• Finding: Tavily API Key Exposed by Troubleshooting Command<![CDATA[ ## Vulnerability Details **File Location**: `INSTALL.md`, line 123 **Vulnerability Type**: Credential disclosure through terminal output **Risk Level**: Medium ### Vulnerable Code ```bash cat ~/.openclaw/.env | grep TAVILY ``` ### Technical Analysis The troubleshooting command prints every line containing `TAVILY` from the OpenClaw environment file. In the documented configuration, this includes the complete `TAVILY_API_KEY` value. Although the command does not transmit the credential directly, it exposes the secret in plaintext through terminal output. The key may subsequently be captured by terminal session recording, command output logging, support screenshots, shared shells, CI logs, or other users with access to the active terminal. Reading the environment file is related to diagnosing configuration, but disclosing the complete value exceeds the minimum access necessary. Troubleshooting only needs to determine whether the variable is present and nonempty. ### Attack Path 1. A user experiences a search error and follows the documented troubleshooting instructions. 2. The command reads `~/.openclaw/.env`. 3. The full `TAVILY_API_KEY` assignment is printed to the terminal. 4. Terminal logging, a support screenshot, screen sharing, or another local observer captures the output. 5. An unauthorized party reuses the disclosed key to access Tavily under the victim's account. ### Impact Assessment An attacker who obtains the key can make Tavily API requests using the victim's account. This can consume the victim's quota, cause service disruption, and potentially incur charges according to the associated Tavily plan. The exposure does not by itself grant operating-system privileges or access to unrelated credentials. Its scope is primarily the Tavily account and resources authorized by the disclosed API key. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Replace the command with a presence check that never prints the secret value: ```bash if grep -q '^TAVILY_API_KEY=.\+' ~/.openclaw/.env; then echo "Tavily API key is configured." else echo "Tavily API key is missing or empty." fi ``` Additional hardening measures: 1. Recommend file permissions of `0600` for `~/.openclaw/.env`. 2. Prefer an operating-system secret store or OpenClaw-supported secret manager over a plaintext environment file. 3. Warn users not to include API keys in screenshots, logs, or support requests. 4. If diagnostic output must identify a key, display only a short masked suffix. 5. Rotate any API key that has already been exposed through logs or shared terminal output. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: INSTALL.md:110
• Finding: Remote SearXNG Configuration Uses Unencrypted HTTP<![CDATA[ ## Vulnerability Details **File Locations**: - `INSTALL.md`, line 110 - `SKILL.md`, lines 31–34 - `SKILL.md`, lines 236–239 **Vulnerability Type**: Plaintext transmission and missing server authentication **Risk Level**: Medium ### Vulnerable Code `INSTALL.md`: ```bash echo 'SEARXNG_BASE_URL="http://your-searxng-instance.com"' >> ~/.openclaw/.env ``` `SKILL.md`: ```env TAVILY_API_KEY="tvly-xxxxxxxxxxxxxxxxxxxx" SEARXNG_BASE_URL="http://your-searxng-instance.com" ``` ```bash export SEARXNG_BASE_URL="http://your-searxng-instance.com" ``` ### Technical Analysis The documentation recommends an `http://` URL for a potentially remote SearXNG instance. HTTP provides neither transport encryption nor authenticated server identity. Consequently, network intermediaries can observe search terms and returned content. An active attacker in a position to modify network traffic can alter SearXNG responses, inject attacker-selected URLs or summaries, redirect requests, or impersonate the configured endpoint. This risk is particularly relevant because search results are treated as source material for an AI-generated executive briefing. Manipulated results could influence the agent's conclusions even without obtaining code execution. Plaintext HTTP may be acceptable for a service bound exclusively to loopback on the same host, but the documented hostname represents a remote deployment and does not state such a restriction. ### Attack Path 1. An operator copies the documented SearXNG configuration and replaces the placeholder with a remote host while retaining the `http://` scheme. 2. The Skill submits news queries over an unencrypted network connection. 3. An attacker controlling a network gateway, wireless access point, DNS path, or other intermediary intercepts the connection. 4. The attacker observes the queries or modifies the SearXNG response. 5. The agent consumes manipulated search results and may include false, misleading, or attacker-selected infor ...[truncated 598 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Use HTTPS for every non-loopback SearXNG deployment: ```bash echo 'SEARXNG_BASE_URL="https://your-searxng-instance.example"' >> ~/.openclaw/.env ``` Apply the following controls: 1. Reject remote `http://` endpoints during configuration validation. 2. Permit plaintext HTTP only for explicitly documented loopback addresses such as `http://127.0.0.1`. 3. Require normal TLS certificate and hostname verification. 4. Do not provide an option that silently disables certificate verification. 5. Where practical, authenticate access to private SearXNG instances and store credentials in a secret manager. 6. Update every example in `INSTALL.md` and `SKILL.md` to use `https://`. 7. Consider validating response source domains and publication metadata before incorporating results into the briefing. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: run_daily.sh:6
• Finding: Scheduled Script Forces Outbound Traffic Through an Undeclared Local Proxy<![CDATA[ ## Vulnerability Details **File Location**: `run_daily.sh`, lines 6–7 **Vulnerability Type**: Unsafe hardcoded network proxy configuration **Risk Level**: Medium ### Vulnerable Code ```bash export HTTP_PROXY="http://127.0.0.1:7897" export HTTPS_PROXY="http://127.0.0.1:7897" ``` ### Technical Analysis The executable script unconditionally sets both HTTP and HTTPS proxy variables to a process listening on local TCP port 7897. The installation documentation does not declare this proxy as a required dependency, explain who controls it, or allow the operator to opt in. Proxying is not inherently necessary for the declared news-aggregation functionality. Hardcoding it changes the network trust boundary and forces proxy-aware subprocesses launched by the OpenClaw command to communicate through whichever local process owns that port. For HTTPS destinations, a conventional proxy can observe destination metadata and disrupt connections. It cannot ordinarily decrypt correctly verified TLS traffic without additional certificate trust or TLS compromise. For plaintext HTTP destinations—such as the documented SearXNG configuration—the proxy can inspect and modify complete requests and responses. The script is intended for recurring execution, increasing exposure duration if it is placed behind the documented scheduled-task workflow. ### Attack Path 1. The daily script is configured for recurring execution or is run manually. 2. A local process binds to `127.0.0.1:7897`, either legitimately or under an attacker's control. 3. The script overwrites the invocation's proxy environment variables. 4. Proxy-aware network operations performed by OpenClaw or its search tools connect through the process on port 7897. 5. The proxy records destination metadata, denies or redirects connections, and inspects or modifies any plaintext HTTP traffic. 6. Altered search responses may affect the content and conclusions of the generated briefing. Exploitation requires the attac ...[truncated 650 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Remove the unconditional proxy exports unless proxying is an explicit requirement: ```bash # Preserve proxy settings supplied by the operator. # Do not hardcode HTTP_PROXY or HTTPS_PROXY. ``` If optional proxy support is required: 1. Accept the proxy URL through an operator-controlled configuration variable. 2. Require explicit opt-in rather than enabling it by default. 3. Document the proxy dependency, trust assumptions, and affected traffic. 4. Validate that the proxy URL uses an allowed scheme and expected host. 5. Avoid logging proxy URLs if they may contain credentials. 6. Require HTTPS for remote API and SearXNG connections. 7. Preserve TLS certificate and hostname verification. 8. Fail with a clear error if an explicitly configured proxy is unavailable rather than silently changing behavior. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Credential Access

High

• Category: Privilege Escalation

Content

**方法一：环境变量（推荐）**

```bash
# 编辑 ~/.openclaw/.env 文件
echo 'TAVILY_API_KEY="tvly-your-api-key-here"' >> ~/.openclaw/.env

# 重启 Gateway

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**方法一：环境变量（推荐）**

```bash
# 编辑 ~/.openclaw/.env 文件
echo 'TAVILY_API_KEY="tvly-your-api-key-here"' >> ~/.openclaw/.env

# 重启 Gateway

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**方法一：环境变量（推荐）**

```bash
# 编辑 ~/.openclaw/.env 文件
echo 'TAVILY_API_KEY="tvly-your-api-key-here"' >> ~/.openclaw/.env

# 重启 Gateway

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**方法一：环境变量（推荐）**

```bash
# 编辑 ~/.openclaw/.env 文件
echo 'TAVILY_API_KEY="tvly-your-api-key-here"' >> ~/.openclaw/.env

# 重启 Gateway

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 存在描述与代码行为的不一致。描述声称该技能会使用 SearXNG 与 Tavily 两个引擎抓取情报，但脚本实际通过参数 `--searxng_enabled=false --tavily_enabled=true` 禁用了 SearXNG，因此与“多引擎（SearXNG 与 Tavily）”这一关键能力不符。此外，提供的代码片段只是一个外部调度脚本，主要作用是设置代理、生成日期、运行技能并记录日志；它并未直接体现去重、战略分级、洞察提炼和生成 5-9 条日报的实现。虽然这些功能可能存在于被调用的技能内部，但就该代码片段本身看，实际行为更接近“定时触发一个日报技能（且仅用 Tavily）”。因此应判定为不匹配。

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The entire document specifies output formatting rules exclusively in Chinese and provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The installation guide instructs users to place API keys into configuration files and environment storage but provides no warning about credential sensitivity, file permissions, shell history exposure, or secret management practices. This increases the likelihood of accidental disclosure through copied configs, backups, logs, screenshots, or overly permissive local file access.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The documented manual triggers are very broad natural-language phrases such as '生成今天的AI日报' and '帮我搜一下今天AI圈有什么大事', which overlap with ordinary user requests. In agent platforms that auto-route or auto-invoke skills based on conversational intent, this can cause unintended activation, external web queries, and unplanned data flow to third-party services.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill name and all output instructions are framed as a Chinese AI daily briefing generator, and the required output templates hard-code Chinese titles and labels. There is no indication that the user can choose another language or that this locale restriction is explicitly justified as a region-specific tool.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The output section requires fixed Chinese strings such as "AI新闻早报", "速览", "洞察", and "今日研判" and says the agent must strictly use those templates. This enforces a specific language/locale in generated output without offering a choice or documenting why the restriction is necessary.

Session Persistence

Medium

• Category: Rogue Agent

Content

DATE=$(date '+%Y-%m-%d')
LOG_DIR=~/.openclaw/logs
mkdir -p "$LOG_DIR"

# 调用 ai_daily_briefing_generator SKILL
cd ~/.openclaw/skills/ai_daily_briefing_generator

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: L13 的注释表明这里是在调用 ai_daily_briefing_generator 技能，而该技能清单描述其会调用多引擎（SearXNG 与 Tavily）抓取情报。但实际命令在 L19-L20 中将 searxng_enabled=false、tavily_enabled=true，运行行为与该技能所宣称的双引擎抓取意图不一致。

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The file presents the skill entirely in Chinese and the only example invocations are Chinese phrases, with no indication that other languages are supported or that Chinese is an optional locale. This can be a language/locale policy issue when a skill implicitly requires a specific language without user opt-in or justification.

Static analysis

No suspicious patterns detected.