Baoyu Skills Wrapper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:20 AM UTC
• Version: 1.0.0

Overview

This wrapper is coherent, but it tells users to run unaudited external skill code that can use credentials, browser sessions, and real social-media publishing accounts.

Install only if you trust the separate baoyu-skills source and have reviewed the exact code or revision you will run. Use restricted API keys and dedicated social accounts where possible, protect ~/.baoyu-skills/.env with owner-only permissions, never commit it, and manually confirm any action that could post or modify live account content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:124

Finding

Unpinned Global Dependency and Unverifiable External Skill Execution

Content

View full analysis

/main.ts [options] ``` ### Technical Analysis The instructions install Bun globally through npm without specifying an exact version or validating package integrity. Dependency resolution can therefore produce a different package version over time. A global installation also has a broader effect on the user's environment than a project-local, locked dependency. The instructions subsequently execute TypeScript from `~/.openclaw/skills/baoyu-skills`, but that implementation is not included in the audited artifact. Consequently, the behavior, integrity, and provenance of the code users are directed to execute cannot be verified from this project. The artifact does not itself retrieve or install the external skill source, so remote payload retrieval is not confirmed. The identified risk is the unsafe, unpinned dependency and unverifiable execution boundary. ### Attack Path 1. A user follows the documented setup instructions. 2. `npm install -g bun` resolves the package without a pinned version or recorded integrity value. 3. npm installs the currently resolved package globally and may execute package installation logic with the invoking user's permissions. 4. The user changes to a separately installed skill directory that was not part of this audit. 5. Bun executes the selected TypeScript entry point with the user's filesystem, network, environment-variable, and process privileges. 6. If either dependency or the external skill installation has been compromised or replaced, its code can act with ...[truncated 530 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:138

Finding

Plaintext Credential File Created Without Explicit Access Controls

Content

View full analysis

~/.baoyu-skills/.env << 'EOF' # OpenAI OPENAI_API_KEY= # Google GOOGLE_API_KEY= # Other providers... EOF ``` The key placeholders above are rendered in English for reporting purposes; the source instructs users to replace them with their actual provider credentials. ### Technical Analysis The documented command stores API credentials in a plaintext `.env` file under the user's home directory. It does not explicitly assign restrictive permissions to either the directory or the file. Effective access therefore depends on pre-existing directory permissions and the user's shell `umask`, which the instructions do not validate. The `>` redirection also truncates and replaces an existing `.env` file without warning. This can destroy previously configured secrets or settings. Credential access is relevant to the advertised AI-provider functionality, but broadly readable plaintext storage and unconditional replacement are not necessary. The wrapper should apply least-privilege permissions and avoid destructive updates. ### Attack Path 1. A user follows the environment-configuration instructions and enters real API credentials. 2. The shell creates or replaces `~/.baoyu-skills/.env`. 3. File permissions are inherited from the user's current `umask` rather than being explicitly restricted. 4. If the resulting permissions permit access by another local account or process, that principal can read the provider keys. 5. The exposed keys can then be used against the corresponding provider APIs within the permissions and quotas assigned to those keys. A separate availability path exists when a user already has this configuration file: executing the documented ...[truncated 553 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

bash

mkdir -p ~/.baoyu-skills
cat > ~/.baoyu-skills/.env << 'EOF'
# OpenAI
OPENAI_API_KEY=你的OpenAI密钥

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises social-media posting and browser automation, including use of a real Chrome browser to bypass anti-automation checks, but the wrapper does not clearly warn that invoking these capabilities can publish content to real external accounts. This increases the risk of accidental or unauthorized posting, account misuse, and policy-violating automation by users who may treat the skill as a harmless content tool.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

部分技能需要API密钥，创建配置文件：

bash

mkdir -p ~/.baoyu-skills
cat > ~/.baoyu-skills/.env << 'EOF'
# OpenAI
OPENAI_API_KEY=你的OpenAI密钥

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

部分技能需要API密钥,创建配置文件:

bash

mkdir -p ~/.baoyu-skills
cat > ~/.baoyu-skills/.env << 'EOF'
# OpenAI
OPENAI_API_KEY=你的OpenAI密钥

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

Natural-language policy issues include forcing a specific language without user opt-in. This file presents all primary instructions in Chinese and only points to an English README later, without explicitly offering a language choice at the start.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation instructs users to create a local .env file containing API keys but does not warn that these are sensitive credentials requiring secure handling. Users may copy the pattern into insecure environments, commit the file to source control, or use weak filesystem permissions, increasing the chance of credential leakage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.