Security audit

FBS-BookWriter

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local long-form writing toolkit, but it should be reviewed before installation because some shipped shell workflows create avoidable command-execution and supply-chain risk.

Install only if you trust the publisher and your environment. Prefer pinned versions and a lockfile, use simple trusted book-root paths, avoid running the publishing script with untrusted environment variables, and understand that the skill will keep local project and WorkBuddy recovery memory for future sessions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/check-and-init-artifacts.mjs:75
Finding: Shell Command Injection Through User-Controlled Project Paths
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/publish-clawhub.mjs:43
Finding: Shell Command Injection Through ClawHub Publishing Environment Variables
Content: View full analysis
`"${String(s).replace(/"/g, '\\"')}"`; const cmd = [ 'npx', 'clawhub@latest', 'publish', quote(pathArg), '--slug', 'fbs-bookwriter', '--name', quote('FBS-BookWriter'), '--version', quote(version), '--changelog', quote(changelog), '--tags', quote(tags), ].join(' '); execSync(cmd, { stdio: 'inherit', cwd: ROOT, shell: true }); ``` The command is exposed through `package.json`: ```json "publish:clawhub": "node scripts/publish-clawhub.mjs" ``` ### Technical Analysis The publishing script combines values from environment variables and package metadata into a single command string and executes it with `shell: true`. The custom `quote()` function only replaces double quotes with backslash-escaped quotes. This is not a portable or complete shell-escaping algorithm. On POSIX shells, constructs such as command substitution may still be interpreted inside double quotes. Windows command parsing also follows different escaping rules, making the helper unsuitable as a cross-platform security boundary. The affected workflow is especially sensitive because it is intended to run in an environment already authenticated to ClawHub. A compromised CI variable, poisoned developer environment, or manipulated package metadata can therefore turn a release operation into arbitrary local command execution. ...[truncated 1361 chars]
Remediation: View remediation
', 'publish', pathArg, '--slug', 'fbs-bookwriter', '--name', 'FBS-BookWriter', '--version', version, '--changelog', changelog, '--tags', tags ], { stdio: 'inherit', cwd: ROOT, shell: false } ); ``` Further controls should include: 1. Pin the ClawHub CLI to a reviewed version instead of `@latest`. 2. Validate `version` against a strict semantic-version expression. 3. Restrict tags to an allowlisted character set and enforce length limits. 4. Treat changelog text as data only and impose a reasonable maximum length. 5. Use a clean, protected release environment with restricted environment-variable modification rights. 6. Require explicit approval before publication. 7. Ensure release credentials are scoped only to the necessary package and operation. 8. Add tests proving that shell metacharacters remain literal argument content. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:25
Finding: Mutable and Unlocked Third-Party Installation Chain
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (579)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
md
> **适配目标**：[OpenClaw](https://docs.openclaw.ai/tools/creating-skills) 技能模型：`SKILL.md` + `metadata.openclaw`（`name` 蛇形命名、`skillKey` 用于 `openclaw.json` 中 `skills.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
md
> **适配目标**：[OpenClaw](https://docs.openclaw.ai/tools/creating-skills) 技能模型：`SKILL.md` + `metadata.openclaw`（`name` 蛇形命名、`skillKey` 用于 `openclaw.json` 中 `skills.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
md
.codebuddy-plugin/`），仍保留完整 `references/`、`scripts/`、`scene-packs/`、`assets/` 与 `package.json`，便于在 Gateway 内用 **shell/exec** 调用同一套 Node 工具链。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
.codebuddy-plugin/`），仍保留完整 `references/`、`scripts/`、`scene-packs/`、`assets/` 与 `package.json`，便于在 Gateway 内用 **shell/exec** 调用同一套 Node 工具链。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
.codebuddy-plugin/`），仍保留完整 `references/`、`scripts/`、`scene-packs/`、`assets/` 与 `package.json`，便于在 Gateway 内用 **shell/exec** 调用同一套 Node 工具链。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
md
**认知资产与商业口径（与主仓一致）**：价值表述统一为「可进化、可分发、可增值」；能力分层统一为「场景包 + 乐包 + 离线/在线会员」。机读见根目录 `fbs-runtime-hints.json` → `cognitiveAsset`；首响 JSON 见 `firstResponseContext.cogniti

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
md
cognitiveAsset`；首响 JSON 见 `firstResponseContext.cognitiveAssetSnapshot`。详细说明见 [`references/05-ops/cognitive-asset-threeization.md`](./references/05-ops/cognitiv

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
node scripts/intake-router.mjs --book-root "<bookRoot>" --intent auto --json --enforce-required

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
node scripts/fbs-cli-bridge.mjs exit -- --book-root "<bookRoot>" --json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
md
node scripts/fbs-cli-bridge.mjs exit -- --book-root "<bookRoot>" --json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
md
推进阶段前读 `.fbs/esm-state.md`；S3.5 扩写须先有用户确认的 `.fbs/expansion-plan.md`，扩写字数以 `node scripts/expansion-word-verify.mjs` 或 `expansion-gate.mjs` 实测为准（禁止纯模型估算）。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
md
户确认的 `.fbs/expansion-plan.md`，扩写字数以 `node scripts/expansion-word-verify.mjs` 或 `expansion-gate.mjs` 实测为准（禁止纯模型估算）。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
推进 S0→S1 前可运行 `node scripts/s0-exit-gate.mjs --book-root "<bookRoot>" --json --confirm-advance` 做强制门禁检查。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
5. **写作约束**：串行优先；每轮默认最多改 **2** 个文件；详见 [`references/05-ops/agent-task-strategy.md`](./references/05-ops/agent-task-strategy.md)。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
扩写/精修前先做源文件备份：`node scripts/source-write-backup.mjs --book-root "<bookRoot>" --scope expansion --json`（`expansion-gate` 默认已自动备份）。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
md
进入 S3.7 精修时优先执行 `node scripts/polish-gate.mjs --book-root "<bookRoot>"`（先备份再质检），避免绕过门禁直接改稿。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
交付收口前执行 `node scripts/release-governor.mjs --book-root "<bookRoot>"`，自动保持唯一终稿并归档旧版本。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
md
对外交付前执行 `node scripts/material-marker-governor.mjs --book-root "<bookRoot>" --fix`，清理 `待核实-MAT` 与 `[DISCARDED-*]` 标注。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
全稿/终稿/终审稿发布前必须执行 `node scripts/final-manuscript-clean-gate.mjs --book-root "<bookRoot>"`，若检测到过程标注则不得交付。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
md
完整表见仓库根目录随包分发的 **WorkBuddy 版 `SKILL.md` 镜像**或 [`references/01-core/intake-and-routing.md`](./references/01-core/intake-and-routing.md)。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
md
完整表见仓库根目录随包分发的 **WorkBuddy 版 `SKILL.md` 镜像**或 [`references/01-core/intake-and-routing.md`](./references/01-core/intake-and-routing.md)。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
| 初始化书房 | `node scripts/init-fbs-multiagent-artifacts.mjs --book-root "<bookRoot>"` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
md
| 环境预检 | `node scripts/env-preflight.mjs`（参数见脚本 `--help`；含 `glob`/`iconv-lite` 依赖检查） |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
md
| 章节合并 / 健康快照 / 一致性审计 | `merge-chapters.mjs`、`book-health-snapshot.mjs`、`consistency-audit.mjs` 等（`--book-root` / `--skill-root` 指向对应根） |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
md
| 章节合并 / 健康快照 / 一致性审计 | `merge-chapters.mjs`、`book-health-snapshot.mjs`、`consistency-audit.mjs` 等（`--book-root` / `--skill-root` 指向对应根） |

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/agents/audit-agent.mjs:83

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/agents/audit-query-optimization.mjs:10

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/agents/audit-temporal-accuracy.mjs:10

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/agents/audit-term-consistency.mjs:10

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/agents/deploy-agent.mjs:584

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/agents/research-agent.mjs:109

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/agents/validation-agent.mjs:75

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/agents/writing-agent.mjs:234

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/audit-entry-performance.mjs:37

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/book-health-snapshot.mjs:52

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/delivery-chain.mjs:27

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/env-preflight.mjs:57

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/evolution-gate.mjs:29

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/fbs-cli-bridge.mjs:27

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/fbs-doctor.mjs:25

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/init-project-memory.mjs:55

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/intake-router.mjs:118

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/launch-presentation-preview.mjs:187

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/lib/channel-pack.mjs:283

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/lib/git-workspace-changes.mjs:24

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/lib/pack-skill-gates.mjs:150

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/lib/workbuddy-host-runtime.mjs:61

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/midterm-execution-chain.mjs:61

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/polish-gate.mjs:259

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/publish-clawhub.mjs:65

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/quality-audit-incremental.mjs:123

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/quality-panorama-orchestrator.mjs:198

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/run-p0-audits.mjs:82

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/s3-guard.mjs:84

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/s3-start-gate.mjs:142

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/smoke-pack-verify.mjs:14

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/standard-execution-chain.mjs:109

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/wecom/wecom-client.mjs:97