T01 · Skill Instruction Hijacking
Error
- Location
hooks/openclaw/handler.js:6- Finding
Session-Wide Agent Instruction Hijacking Through Bootstrap Hook
- Content
View full analysis
- Remediation
View remediation
Security audit
soyoung-clinic-tools
Security checks for vulnerabilities and agentic risk
Overview
This skill mainly matches its clinic booking purpose, but it uses overbroad agent-startup instructions and has credential-handling weaknesses that deserve review before installation.
Review before installing. Only enable the bootstrap hook if you are comfortable with it influencing future agent sessions for Soyoung-related messages. Configure API keys only in private chat, avoid custom API URLs unless you fully trust the destination, and be aware that workspace isolation is weakened by default-key fallback and that non-key local state may contain identity, location, and appointment metadata.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
lib/soyoung_runtime.py:188- Finding
Cross-Workspace API Credential Fallback Breaks Workspace Isolation
- Content
View full analysis
Optional[str]: if input_api_key: return input_api_key.strip() if paths.api_key_file.exists(): value = paths.api_key_file.read_text(encoding="utf-8").strip() return value or None # 当前 workspace 未配置 key 时，尝试从 default workspace 兜底读取， # 避免平台注入的 workspace key 与用户实际配置 key 所在 workspace 不一致时报错。 if paths.workspace_key != "default": default_key_file = STATE_ROOT / "default" / "api_key.txt" if default_key_file.exists(): value = default_key_file.read_text(encoding="utf-8").strip() if value: return value env_key = os.environ.get("SOYOUNG_CLINIC_API_KEY") return env_key.strip() if env_key else None ``` A similar cross-workspace fallback is used for debug configuration: ```python def read_debug_mode(paths: "StatePaths") -> bool: debug_file = paths.workspace_dir / "debug_mode" if debug_file.exists(): return debug_file.read_text().strip().lower() in ("1", "true", "yes") if paths.workspace_key != "default": default_debug_file = STATE_ROOT / "default" / "debug_mode" if default_debug_file.exists(): return default_debug_file.read_text().strip().lower() in ("1", "true", "yes") return os.environ.get("SOYOUNG_DEBUG", "false").lower() in ("1", "true", "yes") ``` ### Technical Analysis When a non-default workspace has no local API key, `load_api_key()` silently reads the credential stored in the `default` workspace. This contradicts the documented security model stating that API keys and state are isolated by workspace. The fallback allows an operation initiated under one workspace identity to be authenticated with a credential belonging to ...[truncated 1541 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
setup/apikey/scripts/main.py:301- Finding
Arbitrary HTTPS API Endpoint Can Receive Credentials and Sensitive Request Data
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
lib/soyoung_runtime.py:172- Finding
Sensitive Workspace State and Cache Files Lack Explicit Restrictive Permissions
- Content
View full analysis
None: path.parent.mkdir(parents=True, exist_ok=True) path.write_text(json.dumps(payload, ensure_ascii=False, indent=2), encoding="utf-8") ``` Owner location information is written through that helper: ```python location = { "version": 1, "city": city, "district": district or None, "street": street or None, "updatedAt": iso_now(), "updatedByOpenId": updated_by_open_id, "updatedByName": updated_by_name, } write_json(paths.location_file, location) ``` Approval records containing identity and appointment parameters are also written through it: ```python pending = { "version": 1, "requestId": request_id, "workspaceKey": paths.workspace_key, "platform": "feishu", "tenantKey": ctx.tenant_key, "chatId": ctx.chat_id, "chatType": "group", "action": action, "requestedByOpenId": ctx.sender_open_id, "requestedByName": ctx.sender_name, "ownerOpenId": binding.get("ownerOpenId"), "ownerName": binding.get("ownerName"), "createdAt": now.replace(microsecond=0).isoformat().replace("+00:00", "Z"), "expiresAt": (now + timedelta(minutes=expires_in_minutes)) .replace(microsecond=0) .isoformat() .replace("+00:00", "Z"), "status": "pending", "params": params, "paramsDigest": make_params_digest(action, params), "previewText": build_request_preview(action, params), } write_json(paths.pending_dir / f"{request_id}.json", pending) ``` Appointment-related cache data is similarly written without an explicit mode: ```pyth ...[truncated 2018 chars]- Remediation
View remediation
Vulnerability Patterns
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (51)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared clinic-service purpose does not fully match the documented setup and delegated execution behavior, including account binding, location persistence, and external script-based setup. When a skill's stated function omits these behaviors, users may not realize it stores identity- and location-linked data or invokes additional implementation components outside the apparent feature set.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared clinic-service purpose does not fully match the documented setup and delegated execution behavior, including account binding, location persistence, and external script-based setup. When a skill's stated function omits these behaviors, users may not realize it stores identity- and location-linked data or invokes additional implementation components outside the apparent feature set.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: soyoung-clinic-tools slug: soyoung-clinic-tools version: 2.2.2 description: > 新氧青春诊所工具集，包含预约、项目查询百科、医生信息及医生排班查询等能力 | Soyoung clinic tools OpenClaw skill for the Soyoung (soyoung) clinic chain: appointment booking, store lookup, doctor info, schedules, project knowledge and pricing. Keywords: Soyoung, soyoung, clinic, appointment, doctor, schedule, medical aesthetic. tags: [Soyoung, soyoung, clinic, appointment, doctor, schedule, medical, beauty, healthcare, 新氧, 诊所, 预约, 医生, 排班, 医美, 整形, hospital] license: MIT --- # 新氧青春诊所工具集 Soyoung
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md # 2. 禁用并移除 bootstrap hook openclaw hooks disable soyoung-clinic-tools rm -rf ~/.openclaw/hooks/soyoung-clinic-tools/ # 3. 删除 skill 目录 rm -rf ~/.openclaw/skills/soyoung-clinic-tools/
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md # 2. 禁用并移除 bootstrap hook openclaw hooks disable soyoung-clinic-tools rm -rf ~/.openclaw/hooks/soyoung-clinic-tools/ # 3. 删除 skill 目录 rm -rf ~/.openclaw/skills/soyoung-clinic-tools/
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md # 2. 禁用并移除 bootstrap hook openclaw hooks disable soyoung-clinic-tools rm -rf ~/.openclaw/hooks/soyoung-clinic-tools/ # 3. 删除 skill 目录 rm -rf ~/.openclaw/skills/soyoung-clinic-tools/
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md # 2. 禁用并移除 bootstrap hook openclaw hooks disable soyoung-clinic-tools rm -rf ~/.openclaw/hooks/soyoung-clinic-tools/ # 3. 删除 skill 目录 rm -rf ~/.openclaw/skills/soyoung-clinic-tools/
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md # 2. 禁用并移除 bootstrap hook openclaw hooks disable soyoung-clinic-tools rm -rf ~/.openclaw/hooks/soyoung-clinic-tools/ # 3. 删除 skill 目录 rm -rf ~/.openclaw/skills/soyoung-clinic-tools/
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md # 2. 禁用并移除 bootstrap hook openclaw hooks disable soyoung-clinic-tools rm -rf ~/.openclaw/hooks/soyoung-clinic-tools/ # 3. 删除 skill 目录 rm -rf ~/.openclaw/skills/soyoung-clinic-tools/
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
rm -rf ~/.openclaw/hooks/soyoung-clinic-tools/
3. 删除 skill 目录
rm -rf ~/.openclaw/skills/soyoung-clinic-tools/
text ## Documentation
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
rm -rf ~/.openclaw/hooks/soyoung-clinic-tools/
3. 删除 skill 目录
rm -rf ~/.openclaw/skills/soyoung-clinic-tools/
text ## Documentation
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: doctor description: > 新氧青春诊所医生与排班技能：按医生姓名、门店、城市关键词检索医生信息与排班。 | Soyoung clinic doctor & schedule OpenClaw sub-skill for Soyoung (soyoung) clinic: doctor_search, doctor info, weekly schedule. Keywords: Soyoung, soyoung, clinic, doctor, schedule, medical aesthetic. 新氧青春诊所医生与排班查询技能。支持按医生姓名、门店、城市关键词检索医生信息与排班信息。 需要先通过 setup/apikey 在当前 workspace 完成 API Key 配置。 工具限定：必须调用脚本，禁止改�
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
python body = {"content": content} if city_name: body["city_name"] = city_name return make_request("/project/skill/clinic_doctor/search", body=body, api_key=api_key) def format_doctor_info(result): if not result.get("success"): return f"❌ **查询失败**：{result.get('error', '未知错误')}" doctors = result.get("data", []) if not doctors: return "👨⚕️ **未找到相关医生**" lines = ["👨⚕️ **医生信息**\n"] for i, d in enumerate(doctors, 1): name = d.get("医生名称") or d.get("name", "未知医生") lines.append(f"**{i}. {name}**") if d.get("医生职称"): lines.append(f"职称：{d.get('医生职称')}") if d.get("医生所在城市"): lines.append(f"城市：{d.get('医生所在城市')}") if d.get("医生常驻门店"): lines.append(f"常驻门店：{d.get('医生常驻门店')}") if d.get("医生认证信息"):
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
These highly generic procedure and symptom terms have no brand or scope constraint, so the skill could trigger on common medical-aesthetic or symptom queries unrelated to Soyoung. Because the skill returns clinic/project information and pricing, this creates a stronger risk of unsafe commercialization, incorrect routing, or misleading responses in health-related interactions.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
python lines.append("\n✨ **产品特点**") for k, label in [("features", "特点"), ("suitable_people", "适合人群"), ("maintain_duration", "维持时间")]: if p.get(k): lines.append(f"• {label}：{p.get(k)}") if any(p.get(k) for k in ["anesthesia", "pain_level", "operation_method", "treatment_duration", "treatment_steps"]): lines += ["", "👨⚕️ **医学操作**"] for k, label in [ ("anesthesia", "麻醉方式"), ("pain_level", "疼痛度"), ("operation_method", "操作方式"), ("can_combine", "能否一起做"), ("treatment_duration", "治疗时长"), ("treatment_steps", "治疗步骤"), ("treatment_notes", "治疗备注"), ]: if p.get(k): lines.append(f"• {label}：{p.get(k)}") indications = p.get("indications", []) if indications: lines += ["", "🎯 **适应症 / 功效**"] for ind in (indica
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The primary title and most operational examples and instructions are presented in Chinese, while the skill is described as an OpenClaw skill that may be used in broader contexts. There is no statement that users may interact in other languages or choose their preferred locale, which creates a natural-language policy concern under the language/locale rule.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The manifest describes capabilities that imply access to environment data, filesystem state, network APIs, and shell execution, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can cause the skill to run with broader privileges than users or reviewers expect, increasing the chance of unintended data access or destructive actions.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md ## 功能总览 ### 📅 预约与门店（appointment） - 配置文件：`skills/appointment/SKILL.md` - 能力：门店查询、预约切片、预约创建/修改/取消/查询、审批流 ### 💉 项目与商品（project）
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md ## 功能总览 ### 📅 预约与门店（appointment） - 配置文件：`skills/appointment/SKILL.md` - 能力：门店查询、预约切片、预约创建/修改/取消/查询、审批流 ### 💉 项目与商品（project）
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md ## 功能总览 ### 📅 预约与门店（appointment） - 配置文件：`skills/appointment/SKILL.md` - 能力：门店查询、预约切片、预约创建/修改/取消/查询、审批流 ### 💉 项目与商品（project）
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - 能力：门店查询、预约切片、预约创建/修改/取消/查询、审批流 ### 💉 项目与商品（project） - 配置文件：`skills/project/SKILL.md` - 能力：项目知识检索、商品价格检索 ### 👨⚕️ 医生与排班（doctor）
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - 能力：门店查询、预约切片、预约创建/修改/取消/查询、审批流 ### 💉 项目与商品（project） - 配置文件：`skills/project/SKILL.md` - 能力：项目知识检索、商品价格检索 ### 👨⚕️ 医生与排班（doctor）
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - 能力：门店查询、预约切片、预约创建/修改/取消/查询、审批流 ### 💉 项目与商品（project） - 配置文件：`skills/project/SKILL.md` - 能力：项目知识检索、商品价格检索 ### 👨⚕️ 医生与排班（doctor）
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - 能力：项目知识检索、商品价格检索 ### 👨⚕️ 医生与排班（doctor） - 配置文件：`skills/doctor/SKILL.md` - 能力：医生信息检索、门店医生检索、排班查询 ## 共享配置（Setup）
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - 能力：项目知识检索、商品价格检索 ### 👨⚕️ 医生与排班（doctor） - 配置文件：`skills/doctor/SKILL.md` - 能力：医生信息检索、门店医生检索、排班查询 ## 共享配置（Setup）
Static analysis
Detected: suspicious.destructive_delete_command
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- SKILL.md:83
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- 使用说明.md:184