T01 · Skill Instruction Hijacking
Error
- Location
references/chat-task.md:1- Finding
Untrusted Execution Instructions Are Injected Directly into Agent System Prompts
- Content
View full analysis
- Remediation
View remediation
Security audit
Comind
Security checks for vulnerabilities and agentic risk
Overview
The skill matches a CoMind automation workflow, but it grants broad always-on authority to use API tokens, modify shared records, and silently sync workspace Markdown without enough scoping or confirmation.
Install only for a trusted CoMind workspace. Use a narrowly scoped, revocable token; configure COMIND_BASE_URL to a trusted HTTPS or loopback endpoint; avoid binding broad workspaces; and disable or review heartbeat document sync unless every Markdown file in scope is safe to publish. Treat remote execution_instructions and token/member-management actions as admin-sensitive and require confirmation before writes or credential operations.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/render-template.py:60- Finding
Bearer Token Can Be Sent to an Arbitrary or Plaintext Endpoint
- Content
View full analysis
dict: """从 CoMind API 获取系统上下文（成员、项目等）""" # 通过 MCP external API 批量获取数据 url = f"{base_url.rstrip('/')}/api/mcp/external" headers = { "Content-Type": "application/json", "Authorization": f"Bearer {token}", } # 获取项目列表（通过 search_documents 或直接查询） # 由于 V2 的 external API 沿用 V1 的工具体系，我们可以调用多个工具 results = {} # 尝试通过 get_template 获取（如果 V2 仍有此工具） try: payload = json.dumps({"tool": "get_template", "parameters": {"template_name": "system-info"}}).encode() req = urllib.request.Request(url, data=payload, headers=headers, method="POST") with urllib.request.urlopen(req, timeout=10) as resp: data = json.loads(resp.read().decode()) if data.get("result"): results["system_info"] = data["result"] ``` The endpoint and token can be supplied through command-line options or environment variables: ```python parser.add_argument("--base-url", default=os.environ.get("COMIND_BASE_URL", ""), help="CoMind instance address") parser.add_argument("--token", default=os.environ.get("COMIND_API_TOKEN", ""), help="API Token") ``` The request is made whenever both values are present: ```python if args.base_url and args.token: api_data = fetch_system_context(args.base_url, args.token) ``` ### Technical Analysis The network operation is related to the declared real-time template-rendering functionality and sends a fixed `get_template` request rather than arbitrary local files. However, the script unconditionally attaches the bearer token to a URL derived from an unvalidated `base_url` ...[truncated 1837 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/heartbeat-sync-to-comind.md:151- Finding
Recurring Heartbeat Can Upload Arbitrary Markdown Files from Bound Workspaces
- Content
View full analysis
{"tool": "update_document", "parameters": { "document_id": "abc123", "content": "（从本地文件读取的最新内容）" }} ``` > 从 `.comind-index` 直接获取 `document_id`，比调用 `search_documents` 更快且更准确。 5. **冲突检测**：如果远端 version 与 `.comind-index` 中记录的 version 不匹配，标记冲突但不覆盖 6. **新文件**（不在 index 中）：通过 `create_document` 创建，CoMind 同步后会更新 `.comind-index` ``` ### Technical Analysis The heartbeat workflow instructs the Agent to scan Markdown files in every bound workspace and upload changed files using `update_document`. Files absent from the synchronization index are automatically created remotely. No path allowlist, private-file exclusion, maximum file size, secret scanning, content classification, or per-file approval is specified. The workflow can therefore synchronize Markdown files that were never intentionally designated for publication. Potential examples include private notes, internal operational documentation, Agent instruction files, or Markdown containing credentials. Workspace document synchronization is related to the Skill's declared functionality, but coupling it to a recurring status heartbeat exceeds the minimum privileges needed to update Agent status and queue information. The recurring trigger increases the likelihood and duration of unintended disclosure. ### Attack Path 1. A workspace is bound to th ...[truncated 1436 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (24)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
描述声称这是一个供 AI 成员在多种 CoMind 平台触发场景下使用的“操作手册”，定义了完整工作流程；而代码并不是工作流执行器、任务处理器或协作控制逻辑，而是单一用途的模板渲染脚本。它的核心行为是读取 Markdown 模板、替换变量、处理简单段落循环/条件，并可选地访问一个 API 拉取 system-info 内容。这与声明中的主要用途存在明显偏差：代码没有实现任务执行、对话协作、状态面板管理、定时巡检处理等能力，也没有体现任何平台触发后的标准化操作流程。因此属于描述与实际行为的实质性不匹配。
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The skill instructs storing
COMIND_API_TOKENin environment variables or.env/service files and then using it broadly throughout automated workflows. This creates a clear credential-access path for any agent or tool with env/file-read capability, making the context more dangerous because the same skill also documents network exfiltration and token-management operations.- Content
在 OpenClaw 的 systemd 服务文件或环境变量中配置：
bash # /etc/systemd/system/openclaw.service 或 .env COMIND_BASE_URL=http://localhost:3000 COMIND_API_TOKEN=your_api_token_here
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill requires environment access, file reads, and network access, but it does not declare any explicit tool scope or least-privilege boundary. In a skill that instructs an agent to read tokens from environment/config files and call external APIs, missing scope declarations increases the chance of overbroad execution and unintended secret exposure or outbound requests.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description and opening instructions are entirely in Chinese and direct the AI member to follow this manual for all operations, but they do not offer any user language preference or opt-in. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation unless the restriction is explicitly justified.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The skill includes direct API examples for listing members and setting
openclawApiToken, which are credential/administrative operations transmitted over HTTP and shown withhttp://localhost:3000. Even on localhost, this normalizes unsafe handling of sensitive admin actions and can leak or overwrite tokens if copied into non-local or proxied environments.- Content
curl http://localhost:3000/api/members | jq '.[] | select(.type=="ai")'
为成员生成 Token
curl -X PUT http://localhost:3000/api/members/{member_id}
-H "Content-Type: application/json"
-d '{"openclawApiToken": "your-new-token"}'text
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly supports obtaining an MCP API token via
get_mcp_token, which is a credential acquisition capability unrelated to a normal operational handbook. Embedding token-retrieval instructions inside a generally applicable skill makes secret access easier to trigger and broadens the blast radius if the agent is prompt-injected or misused.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Documenting
register_memberexpands the skill into identity/provisioning operations beyond its stated task-execution role. If exposed to an agent without strict authorization checks, this can enable unauthorized member creation, persistence, or privilege footholds in the CoMind environment.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
The MCP call wrapper sends bearer tokens in outbound HTTP requests, which is expected for API access but still security-sensitive in a broadly reusable skill. Because the skill encourages routine network calls using environment-stored credentials, any prompt injection, logging leak, or misconfigured endpoint could cause token disclosure or unauthorized actions.
- Content
md local tool="$1" local params="$2" curl -s -X POST "${COMIND_BASE_URL}/api/mcp/external" \ -H "Authorization: Bearer ${COMIND_API_TOKEN}" \ -H "Content-Type: application/json" \ -d "{\"tool\": \"${tool}\", \"parameters\": ${params}}"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The title, description, and core instruction text are written entirely in Chinese and direct the assistant's behavior in that locale, without offering the user a language choice or documenting that the skill is intended only for Chinese-speaking contexts. This can violate language/locale policy when applied broadly to users who may expect interaction in their preferred language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The title, description, and core instruction text are written entirely in Chinese and instruct the assistant how to respond in that locale, but the file does not offer any language choice or indicate that the skill is intentionally region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The title and core instruction text are written only in Chinese, and the template does not indicate that language selection is configurable or user-driven. This can violate language/locale policy because it implicitly constrains interactions to a specific language without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file’s title, description, headings, and operational instructions are all presented in Chinese, which effectively forces a specific language for users of the skill. The policy allows locale constraints only when users are given a choice or when the constraint is clearly documented and justified, neither of which appears here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to update a shared status panel and task queue that are visible to other team members, but it does not require an explicit user confirmation or a warning that these actions have external visibility and may disclose task or delivery metadata. In a heartbeat-triggered workflow, this can cause unintended publication of sensitive work status, task titles, or review/remediation details to a broader audience than intended.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description and workflow instruct the agent to create or update wiki documents and optionally submit them to a delivery center via external API calls, but do not require a user-facing warning or confirmation before modifying persistent data. In an agent environment, this increases the risk of silent data changes, duplicate reports, and unintended publication triggered by automation rather than informed operator intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is activated by a generic heartbeat trigger and then performs stateful actions such as document search, creation, update, delivery, and status changes. Because the trigger is not narrowly scoped to explicit user confirmation or a tightly constrained scheduler context, unintended or repeated invocations could cause unauthorized or duplicate writes to external systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the agent to run in silent mode and automatically synchronize status, task metadata, workspace inventory, and potentially full Markdown file contents to an external MCP API without a per-run user-facing notice or confirmation. Because the workflow includes scanning bound workspaces and uploading changed documents, it can exfiltrate sensitive project data or internal task information in the background, especially when triggered by cron/heartbeat rather than an interactive user action.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire template, including the title, section headings, syntax notes, and validation instructions, is written only in Chinese. This creates a language/locale constraint in the skill content without any visible option for users to choose another language or any justification that the skill is region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The template explicitly encourages the AI to call
create_documentorupdate_documentto perform batch task creation or updates, but it does not require confirmation, authorization checks, scope restrictions, or any warning that project/task data will be modified. In a collaborative platform, this creates a real risk of unintended or over-broad state changes if a task push or embedded context is malformed, ambiguous, or adversarial.- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
While the manifest mentions responding to scheduled dispatches, the documented code also includes creating, updating, listing, and deleting schedules. Managing scheduler configuration is a broader administrative capability than merely executing tasks received from the platform, and that expansion is not clearly justified by the manifest description.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown template uses Chinese section headings and examples throughout, which effectively forces a specific language for users of the skill artifact. The file does not indicate that the language is optional or that the template is intended only for a Chinese-speaking or region-specific context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The title, description, instructions, report template, and output expectations are all specified in Chinese, including fixed output strings such as the inspection report format and
巡检完成. There is no indication that the user may choose another language or that this locale restriction is required for a region-specific compliance reason.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language content of the template is entirely in Chinese and directs the AI's behavior in that language, with no indication that the user can choose another language. This may violate a language or locale policy when user language preference is not explicitly obtained or documented.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring, usage text, template descriptions, and later CLI-facing help strings are all presented exclusively in Chinese. This imposes a specific language on users without offering a locale choice or documenting that the tool is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The argparse description, option help text, and parser error message are all hardcoded in Chinese. For a general-purpose script, this is a language policy concern because users are not given an opt-in or alternative locale.
- Content
Static analysis
Detected: suspicious.generated_source_template_injection
User-controlled placeholder is embedded directly into generated source code.
Critical
- Code
- suspicious.generated_source_template_injection
- Location
- SKILL.md:317