Security audit

WIPO 小分子药物专利周报

Security checks for vulnerabilities and agentic risk

Overview

The skill’s patent-reporting purpose is mostly coherent, but it relies on unbundled workspace scripts and can automatically scrape and upload reports with broad triggers.

Review this skill before installing. Only use it where the workspace scripts are trusted and access-controlled, rclone is configured for the intended Google Drive destination, and scheduled execution is explicitly desired. Narrowing the triggers and bundling or verifying the Python scripts would materially reduce risk.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

Location: SKILL.md:58
Finding: Execution of Unbundled Scripts from a Mutable Shared Workspace
Content: View full analysis
``` ```bash cd ~/.openclaw/workspace python3 scripts/wipo_search.py ``` ```bash cd ~/.openclaw/workspace python3 scripts/wipo_generate_report.py wipo_reports/wipo_patent_weekly_.json ``` ### Technical Analysis The Skill instructs the agent to change into `~/.openclaw/workspace` and execute `scripts/wipo_search.py` and `scripts/wipo_generate_report.py` using relative paths. Neither script is included in the audited project, which contains only `SKILL.md` and `references/target-rules.md`. The origin, contents, ownership, permissions, version, and integrity of the invoked scripts are therefore not controlled or validated by this Skill. Any user or process capable of writing to the shared workspace could create or replace these files. The resulting commands would then execute the substituted code under the identity and privileges of the agent running the Skill. This is a tool-hijacking risk because legitimate-looking Skill operations are delegated to mutable, unaudited implementations outside the reviewed package. ### Attack Path 1. An attacker obtains write access to `~/.openclaw/workspace/scripts/`, directly or through another compromised process or Skill. 2. The attacker creates or replaces `wipo_search.py` or `wipo_generate_report.py` with malicious Python code. 3. A user invokes the patent-report Skill, or an external scheduler invokes it according to the documented weekly workflow. 4. The agent changes into the shared workspace and executes the attacker-controlled script without checking its integrity. 5. The malicious script performs arbitrary actions available to the agent before optionally producing expected output to conceal the compromi ...[truncated 988 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly uploads generated reports to Google Drive, but the description and workflow do not require a clear user-facing notice or confirmation before external transmission. Even if the content is patent data, automatic outbound transfer to a third-party service creates data handling and consent risks, especially when the skill may be triggered by cron or broad user phrases.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases include broad terms such as “专利检索” and “小分子专利”, which can match many ordinary user requests outside the intended weekly WIPO-report workflow. This can cause unintended execution of web scraping, report generation, and upload actions without the user clearly asking for this specific automated process.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire skill reference is written in Chinese, beginning with the title at L01 and continuing throughout the file, with no indication that other languages are supported or that Chinese is a required locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.