Waiting Tips

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:34 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed waiting-tip plugin; its main behavior is low impact, with caution needed for optional chat-bot examples that use messaging APIs and store WhatsApp auth locally.

Installing the core skill is reasonable if you want automatic waiting tips. If you run the Telegram, Feishu, or WhatsApp bot examples, treat bot tokens, app secrets, and WhatsApp auth state as sensitive; keep ./auth out of source control and prefer pinned package versions for demos.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:15
• Finding: Mutable and Unverified Installation Sources Create Supply-Chain Risk## Vulnerability Details **File Location**: `README.md:15-27`; `examples/telegram-bot.js:4`; `examples/feishu-bot.js:4`; `examples/whatsapp-bot.js:4` **Vulnerability Type**: Unpinned and unverified software installation **Risk Level**: Medium ### Vulnerable Code `README.md:15-27`: ```bash ## Install | 安装 ### Method 1: ClawHub (recommended) clawhub install waiting-tips ### Method 2: Local install git clone https://github.com/dongsheng123132/openclaw-waiting-tips.git openclaw plugins install -l ./openclaw-waiting-tips ``` `examples/telegram-bot.js:4`: ```js * npm install node-telegram-bot-api ``` `examples/feishu-bot.js:4`: ```js * npm install @larksuiteoapi/node-sdk ``` `examples/whatsapp-bot.js:4`: ```js * npm install @whiskeysockets/baileys ``` ### Technical Analysis The documented installation procedures retrieve executable JavaScript from mutable package registry entries and the default branch of a remote Git repository. No exact package version, Git commit hash, lockfile, checksum, or signature verification is specified. The repository content is subsequently installed as an OpenClaw plugin, while the example packages execute inside bot processes. Node.js dependencies can execute code when imported and may also define installation lifecycle scripts. Consequently, compromise of a publisher account, package registry, repository, or future upstream release could change the code executed by users without changing the audited artifact. This finding does not establish that the current repository or named packages are malicious. It identifies the absence of controls that bind installation to the reviewed versions. ### Attack Path 1. An attacker compromises an upstream repository, package publisher account, registry entry, or dependency release process. 2. The attacker publishes or commits modified JavaScript under the same mutable package or repository identity. 3. A user follows t ...[truncated 979 chars]
• Remediation: ## Remediation Suggestions 1. Pin ClawHub installations to an immutable, reviewed version where supported. 2. Replace the unqualified Git clone procedure with checkout of a signed release tag or exact commit hash. 3. Publish expected SHA-256 checksums or signed release artifacts and require verification before installation. 4. Pin exact versions of all example dependencies instead of installing their latest releases implicitly. 5. Add and publish a lockfile generated by a supported package manager. 6. Use reproducible installation commands such as `npm ci` with lockfile integrity checks. 7. Enable automated dependency vulnerability scanning and review dependency updates before merging them. 8. Run OpenClaw and bot examples under dedicated, least-privileged operating-system accounts.

T09 · Insecure Skill Coding Practices

Warning

• Location: examples/whatsapp-bot.js:10
• Finding: WhatsApp Authentication State Is Persisted in an Unprotected Project-Relative Directory## Vulnerability Details **File Location**: `examples/whatsapp-bot.js:10-13` **Vulnerability Type**: Insecure storage of reusable authentication material **Risk Level**: Medium ### Vulnerable Code ```js async function start() { const { state, saveCreds } = await useMultiFileAuthState('./auth'); const sock = makeWASocket({ auth: state }); sock.ev.on('creds.update', saveCreds); ``` ### Technical Analysis The WhatsApp example uses Baileys `useMultiFileAuthState` with the project-relative `./auth` directory and automatically persists credential updates through `saveCreds`. This authentication state can contain reusable account and session material. The project structure contains no `.gitignore` entry protecting `auth/`, and the example does not create the directory with explicitly restrictive permissions, place it outside the repository, encrypt it, or warn users about its sensitivity. The actual filesystem permissions depend on the user's environment and `umask`, but the example does not enforce a secure configuration. Because the path is relative to the process working directory, users running the example from the repository root are likely to place the authentication files directly inside the project. This increases the likelihood of accidental source-control commits, inclusion in archives or backups, or access by other local users in shared environments. ### Attack Path 1. A user runs `examples/whatsapp-bot.js` and authenticates a WhatsApp account. 2. Baileys writes authentication state into the relative `./auth` directory. 3. The directory is accidentally committed, copied into a shared archive, exposed through a backup, or read by another account with filesystem access. 4. An attacker obtains the stored authentication material. 5. Where the captured state remains valid and is accepted by WhatsApp/Baileys, the attacker reuses it to establish or impersonate the authenticated session. ### Impact Assessment ...[truncated 492 chars]
• Remediation: ## Remediation Suggestions 1. Store authentication state outside the source tree in a dedicated application-data or secrets directory. 2. Create the credential directory with owner-only permissions, such as mode `0700`, and ensure credential files use mode `0600`. 3. Add `auth/` and any other credential-state paths to `.gitignore`. 4. Document that the generated state contains sensitive, reusable authentication material and must not be committed, shared, or included in public archives. 5. Prefer an operating-system secret store or encrypted storage where practical. 6. Run the bot under a dedicated operating-system account with exclusive access to its credential directory. 7. Provide a configurable absolute credential path rather than relying on the current working directory. 8. If authentication state is exposed, revoke the affected linked session, rotate relevant credentials, and create a new state directory.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill description claims broad, non-intrusive cross-platform behavior, but the finding indicates undeclared message-management and platform-specific actions beyond simply showing tips. When a skill's declared purpose does not match its actual behavior, users and reviewers cannot accurately assess privacy, spam, or message-manipulation risk, which creates a trust and consent problem.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: Automatically triggering before every AI response is overly broad and can cause the skill to run on essentially all user interactions without meaningful user intent. That creates spam, consent, and potential denial-of-service style nuisance risk, especially if each interaction sends extra messages or performs chat actions across conversations.

Memory Manipulation

High

• Category: Memory Poisoning

Content

发送图片让 OpenClaw 识别和分析 | Send images for OpenClaw to analyze
长文本可以分段发送，最后说"开始处理" | Split long text, then say "start processing"
用 /help 查看所有可用命令 | Use /help to see all available commands
用 /clear 清除对话历史重新开始 | Use /clear to reset conversation history
OpenClaw 可以翻译、写作、编程、分析数据 | OpenClaw can translate, write, code, analyze data
发送文件让 OpenClaw 解读内容 | Send files for OpenClaw to interpret
私聊和群聊中都可以 @OpenClaw | @OpenClaw works in both DM and group chats

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The README says tips appear every time users chat with OpenClaw on Telegram, Feishu, WhatsApp, Discord, or 'any platform,' which describes activation in very broad terms without clear scope limits or exclusion conditions. This could cause unintended invocation because readers are not told when the tool will or will not activate beyond general chatting.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The README states that OpenClaw may call the tool 'when users ask for tips directly,' but it does not define a constrained set of trigger phrases or negative examples. Because asking for tips is common conversational language, the lack of specificity increases the chance of accidental activation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Manual triggers like 'show me a tip' or 'give me a tip' are generic phrases that overlap with normal conversation and can invoke unintentionally. This can lead to accidental activation, unnecessary message generation, and degraded user experience, particularly in shared or high-volume chat environments.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code initializes multi-file auth state in a local './auth' directory and persists credentials via saveCreds, which is sensitive credential handling. There is no warning, comment, or user-facing notice that credentials will be written to disk, which is relevant for safety and privacy expectations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code handles inbound WhatsApp messages, extracts user message text, and passes it into the bot response pipeline, then sends a reply back over the network. While the file has a startup log, it does not disclose that user message content is being processed/transmitted, and there is no confirmation prompt, comment-level warning, or other user-facing notice about that data handling.

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: This plain-text guidance is written bilingually but repeatedly frames AI interaction practices in Chinese, and line 16 explicitly suggests constraining the AI's language without any opt-in or locale justification. Under the language/locale policy rule, content that effectively forces or defaults to a specific language should offer user choice or clearly document why that locale is required.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: Line L13 states that writing prompts in English usually works better. This is a natural-language locale preference that can steer users toward a specific language without opt-in, which may conflict with organizational language-choice policies.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The natural-language description hard-codes a Chinese trigger phrase ('来个tip') as an invocation example, which introduces a language-specific activation path without indicating user language choice or opt-in. This can be a locale/language policy concern because the skill behavior is partially tailored to one language by default.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The package description says the skill will 'Show bilingual learning tips,' which imposes a language/locale behavior in natural language. Because no user choice, opt-in, or justification for the bilingual requirement is stated here, this may violate the language/locale policy criterion.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The code explicitly splits tips into Chinese and English variants and renders both in the waiting card, which imposes a specific language/locale presentation on users. There is no user opt-in, language selection, or documented justification that this adapter is intended only for a bilingual or region-specific audience.

Vague Triggers

Low

• Confidence: 76% confidence
• Finding: This plain-text file lists many generic phrases such as asking AI to review code, write commit messages, or analyze logs without defining trigger boundaries, exclusions, or invocation context. Because the phrases overlap with common everyday requests, they could cause unintended activation if consumed as trigger text by a skill system.

Natural-Language Policy Violations

Low

• Confidence: 64% confidence
• Finding: The content consistently uses Chinese first with English alongside it, but does not state whether language presentation is user-selectable or intended for a specific audience. If organizational policy requires offering language choice rather than imposing a default locale, this may be a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: This text consistently presents content in Chinese first with English second, rather than explicitly offering the user a language or locale choice. Under the stated policy, forced or implicit language preferences can be a natural-language policy concern when no opt-in is provided.

Static analysis

No suspicious patterns detected.