other
Warning
- Location
monitor.py:21- Finding
Undisclosed Automatic Transmission to a Hard-Coded Feishu Recipient
- Content
View full analysis
- Remediation
View remediation
Security audit
Geekbench
Security checks for vulnerabilities and agentic risk
Overview
The skill is mainly a Geekbench lookup and monitoring tool, but it can automatically send reports to a hard-coded Feishu recipient and writes to fixed local paths without clear user control.
Review before installing. Use this only if you are comfortable with Geekbench data being fetched from the web, reports being stored locally, and the monitor script potentially sending reports through your OpenClaw Feishu messaging setup to the embedded recipient. Prefer a version that disables notifications by default, makes the recipient and output directory explicit, and sanitizes report filenames.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
tasks.py:220- Finding
Path Traversal and File Creation Outside the Intended Data Directory
- Content
View full analysis
- Remediation
View remediation
Path: base = Path(data_dir).resolve() safe_name = re.sub(r"[^A-Za-z0-9._ -]", "_", device_name).strip(" ._") if not safe_name: safe_name = str(uuid.uuid4()) safe_name = safe_name[:100] target = (base / f"{safe_name}{suffix}").resolve() try: target.relative_to(base) except ValueError: raise ValueError("Output path escapes the configured data directory") return target ``` Use it before opening the file: ```python target = safe_output_path(self.data_dir, device_name, "_raw.json") with target.open("x", encoding="utf-8") as f: json.dump(raw_data, f, ensure_ascii=False, indent=2) ``` Opening with mode `"x"` prevents silent replacement of an existing file. If updates are required, use atomic writes through a safely created temporary file inside the same validated directory, followed by `os.replace()`. ]]>
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (20)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module docstring and multiple user-facing print strings are written only in Chinese, indicating the skill operates in a fixed language without offering the user a choice. This is a natural-language locale policy concern because the file does not document a justified region-specific scope or provide opt-in language selection.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code writes output to a hard-coded absolute local path under a specific user's home directory without validation, configurability, or explicit consent. In an agent or shared execution environment, this can lead to unintended data persistence, overwrite existing files, leak scraped data into sensitive workspaces, or fail unpredictably depending on host layout and permissions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python file contains natural-language text in Chinese in the module docstring and later user-facing status messages/comments, but provides no indication that the language is configurable or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
With no manifest available, the only stated intent comes from the module docstring saying this is a "Geekbench monitoring script" with Feishu notification support. The code implements an additional capability to invoke an external CLI and send messages to a specific Feishu target, which is not inherently required for local benchmark monitoring and broadens the skill into external communication.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python '--target', 'ou_b5694469884a90935f9c9b5a687155a1', '--message', message ] result = subprocess.run(cmd, capture_output=True, text=True, timeout=30) if result.returncode == 0: print("Feishu message sent") return True
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file’s docstrings, status messages, usage text, and CLI prompts are written exclusively in Chinese, which imposes a specific language on users. There is no visible opt-in, fallback, or documentation indicating that the skill is intentionally limited to Chinese-speaking users for a justified regional purpose.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The instantiated GeekbenchCrawler is used throughout the file to search devices, fetch latest benchmarks, and retrieve benchmark details, implying external data collection capability. Because no manifest or purpose is available, this network/data-harvesting behavior is not justified by stated intent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The code hard-codes a user-specific writable path under /Users/ding/.openclaw/workspace/geekbench/data and writes files there automatically. This can expose local system structure, create unintended persistence, and overwrite or accumulate data in a location the caller did not explicitly approve, which is risky for a reusable skill running in unknown environments.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The JSON report string is written entirely in Chinese, including the title and section headings such as 'Geekbench 监控报告' and '新设备发现'. For a general monitoring artifact, this imposes a specific language/locale without any visible opt-in or explanation that the skill is intended only for Chinese-speaking users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file contains user-facing content only in Chinese, including the title and section labels, with no indication that the language is configurable or intended for a specific locale. The policy requires flagging language or locale constraints when they are imposed without user opt-in or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file contains a Chinese title at L01 and an English report heading at L03, but it does not explain the intended language policy or offer any language/locale choice. Under the policy rule, forcing or assuming a language without opt-in can be a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The title at L01 is in Chinese while the main report heading at L03 is in English, but the document provides no indication that the language choice was user-selected or intentionally locale-specific. This can violate language/locale policy expectations when a skill output imposes mixed-language content without opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The report title is in Chinese on L01 while the body heading on L03 is in English, but the file provides no explanation of intended locale, user language preference, or region-specific scope. This can violate language/locale policy expectations when a skill emits content in a specific language without user opt-in or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The natural-language content in the report is entirely presented in Chinese, including labels and headings, with no indication that the user selected this language or that the file is intended for a China-specific audience. This can violate a language or locale policy when a skill imposes a specific language without opt-in.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The docstring says this method 'quickly gets scores only' and 'does not include detail parsing', but the implementation still downloads the full benchmark detail page and parses its HTML with BeautifulSoup. While it extracts fewer fields than the full detail method, the documentation understates the actual behavior and side effects.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
The file not only monitors benchmark updates but also writes markdown and JSON archives and maintains long-lived state in local directories. For an unknown-purpose skill, this is a broader capability than transient monitoring alone and should be justified as part of the intended behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This plain-text report is entirely presented in Chinese, including headings and labels, with no indication that the language was selected by the user or that the report is intended only for a Chinese-speaking locale. That can conflict with language/locale policy requirements when a skill imposes a specific language without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The file presents all user-facing report text in Chinese, including headings and labels, with no indication that the user opted into this locale or that the skill is intended only for Chinese-speaking users. This can violate language/locale policy when a skill imposes a specific language without user choice or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This plain-text report presents all headings and status labels in Chinese, which imposes a specific language on readers. The file does not indicate that the report is intended only for a Chinese-speaking audience or provide any opt-in/alternative locale, which matches the language-policy concern for natural-language content.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The function signature for task_monitor_latest includes save_path: str = None, which implies the caller can control where results are saved. In practice, the implementation never uses save_path and instead unconditionally reads and writes last_check.json in the hard-coded data directory.
- Content
Static analysis
No suspicious patterns detected.