T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:39- Finding
Hard-Coded Messaging Account and Recipient in Executable Cron Examples
- Content
View full analysis
- Remediation
View remediation
Security audit
Anti 996 Reminder
Security checks for vulnerabilities and agentic risk
Overview
This Chinese wellness reminder skill is mostly purpose-aligned, but its copy-paste cron examples include persistent scheduled messaging to a fixed account and WeChat recipient, which could send reminders or reports to the wrong person.
Review the cron commands before installing. Replace the account and recipient values with your own, confirm the channel target, and know how to list or remove the scheduled tasks. Treat this as a Chinese-language reminder skill whose points/check-in behavior may require additional OpenClaw handling beyond the included files.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a complete reminder/push skill with timed delivery, channel support, and gamified check-in features. The supplied code only loads a local JSON file, picks a random entry, and prints it. While this could be a supporting content-selection component for such a skill, by itself it does not implement the core declared behavior. Therefore the description materially overstates what this code chunk actually does.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The query trigger words are broad enough that normal conversation can accidentally activate points/status responses, causing unintended behavior and noisy or misleading bot interactions. In a chat channel context, overbroad matching can also be abused to spam stateful responses or interfere with expected conversational flow, though the impact here is limited because no sensitive action is described.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language content in this file exclusively uses Chinese phrases and assumes a Chinese-speaking user. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the restriction is explicitly documented and justified, which is not present in this file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file contains only Chinese-language user-facing text and provides no indication that the skill is intended specifically for Chinese-speaking users or that language selection is optional. Per the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Static analysis
No suspicious patterns detected.