Learning System

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:27 PM UTC
• Version: 0.1.0

Overview

The skill mostly matches a personal learning workflow, but its weekly review can automatically summarize private work activity and send it through Feishu to a named recipient without a clear confirmation step.

Review this carefully before installing. It is suitable only if you want a Chinese-language personal learning workflow that can read OpenClaw memory logs, notes, and work activity. Disable or remove the Feishu send step and any scheduled cron use unless every outgoing weekly summary is previewed and the recipient is explicitly confirmed each time.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/weekly-review-guide.md:61
• Finding: Hard-Coded Feishu Recipient May Cause Unauthorized Disclosure of Private Activity<![CDATA[ ## Vulnerability Details **File Location**: `references/weekly-review-guide.md`, lines 61-66 **Vulnerability Type**: Hard-coded external message recipient **Risk Level**: Medium ### Vulnerable Documentation Snippet The following is an English translation of the complete affected source segment: ```markdown ### 5. Send Summary Send via Feishu to the hard-coded recipient, including: - Weekly learning highlights (2-3 sentences) - Number of knowledge-map changes - Key focus for next week ``` The recipient named in the original source is fixed rather than dynamically resolved from the current user. ### Technical Analysis The weekly-review workflow collects information from daily memory logs, code changes, pull requests, research activity, documents, and technical problems. It then instructs the agent to transmit a summary through Feishu to a specifically named recipient. This conflicts with `SKILL.md:113-114`, which describes the intended recipient as the current user. The guide does not require the agent to: - Verify that the hard-coded recipient is the requesting user. - Obtain consent immediately before transmission. - Preview the information that will be disclosed. - Redact confidential project, pull-request, or research details. - Skip external transmission when the recipient cannot be verified. The repository does not include code that directly performs the Feishu transmission, so exploitation depends on an agent environment that provides a messaging tool and follows documentation as executable instructions. Nevertheless, in such an environment the fixed-recipient instruction creates a concrete unintended-disclosure path and exceeds the minimum privileges needed to generate a local weekly review. ### Attack Path 1. A user or scheduled workflow invokes weekly-review mode. 2. The Skill reads up to seven days of memory logs and examines recent notes, pull requests, code changes, research, and technical problems. 3. The Skill generates a wee ...[truncated 1098 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the hard-coded recipient from `references/weekly-review-guide.md`. 2. Default weekly-review mode to generating and storing the report locally without external transmission. 3. Require the user to explicitly select or confirm the Feishu recipient immediately before every send operation. 4. Display a complete preview of the outgoing message and require confirmation before invoking the messaging tool. 5. Verify that the selected recipient corresponds to the requesting user or an explicitly authorized destination. 6. Redact secrets, private repository names, unpublished pull-request details, personal data, and confidential technical information. 7. Treat `--quick` as permission to skip workflow confirmations only; it must not bypass confirmation for external data transmission. 8. Add an explicit configuration option such as `send_weekly_summary: false`, disabled by default. 9. Record the destination and user authorization decision in a local audit log without storing sensitive message contents. 10. Update the instruction to state that sending must be skipped if recipient identity, authorization, or messaging scope cannot be verified. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Session Persistence

Medium

• Category: Rogue Agent

Content

### 2. 初始化笔记目录

```bash
mkdir -p ~/.openclaw/workspace/notes/areas/{deep-dives,weekly-reviews}
```

### 3. 运行

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This is a markdown file, so SQP-2 applies to user-facing descriptions that omit warnings about behaviors affecting user data. The README states that a cron job will automatically trigger the weekly review, and elsewhere describes updating the knowledge map and generating reports, but it does not warn users that scheduled runs may modify note files automatically.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly instructs the agent to read local files such as memory logs, PR-related notes, templates, and knowledge-map documents, but the manifest does not declare any tool scope or permissions. This creates a capability/visibility mismatch: operators and users cannot accurately assess what the skill needs, and an agent runtime may overgrant access or invoke the skill without adequate review.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list contains broad everyday phrases like '总结一下', '复盘', 'deep dive', and 'recap', which can match normal conversation and invoke the skill unintentionally. In this skill, accidental activation matters because the workflow may read logs, inspect code/PR history, write notes, and potentially send summaries externally.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The documented behavior exceeds the declared interface: it describes sending Feishu messages and running a separate mastery-scoring mode that are not reflected in the manifest or argument hint. Hidden or undocumented capabilities are dangerous because they bypass expectation-setting, reduce reviewability, and can enable data handling or outbound actions that users did not knowingly authorize.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The weekly review mode instructs the agent to collect recent memory logs, deep-dive notes, PRs, and code changes, synthesize them, and then send a summary externally. This creates a natural-language exfiltration path where sensitive code, internal activity, or personal notes can be disclosed without explicit scope limitation or data classification checks.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The workflow includes sending summaries through Feishu, an external messaging channel, even though the skill's stated purpose is local learning and knowledge management. Because the skill aggregates notes, logs, and code activity, adding external transmission expands the trust boundary and creates a realistic path for unintended exfiltration of sensitive project or personal information.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill says it will send a summary via Feishu but provides no warning, consent checkpoint, or preview before external transmission. This is especially dangerous because the summary is derived from aggregated memory logs, notes, and code activity, so users may not realize sensitive content is leaving the local environment.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file presents all instructions and policy guidance exclusively in Chinese, which can impose a language choice on users without opt-in. Under the natural-language policy rule, forcing a specific language without offering an alternative or documenting a justified locale restriction is a policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This markdown file contains user-facing natural-language instructions only in Chinese, which can amount to a language/locale policy violation when no opt-in, alternative language, or justification is provided. The stated policy requires flagging files that force a specific language without user choice.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire guide is written in Chinese and instructs communication in Chinese-specific tooling/context without offering any language choice or opt-in. Under the policy rule for natural-language constraints, this is a locale/language requirement that is not documented as optional or region-justified.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This Python file contains user-facing docstrings and report output entirely in Chinese, including the generated report headings and recommendations. Because the script does not offer any language selection or document a justified region-specific requirement, it appears to enforce a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This Python file contains multiple hard-coded Chinese user-facing strings, beginning with the level labels/comments and continuing in printed report content. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the skill clearly documents a justified regional constraint, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The generated report includes Chinese-only phrases such as upgrade/downgrade suggestions, warning text, and table headers. Because these are the primary user-visible outputs of the skill and no language selection mechanism exists, the file violates the language-choice policy.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy violations. This skill description forces a single language for instructions and usage details, with no opt-in, alternative language, or justification that the skill is intended only for a Chinese-speaking context.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: This markdown template is written entirely in Chinese, including the title and instructional text, with no indication that language selection is optional. Under the policy rule for language or locale constraints, this can be considered a natural-language policy violation because it implicitly enforces a specific language without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The entire template and its required headings are written in Chinese, which implicitly enforces a specific language for users filling it out. The file does not offer an alternative language choice or explain why a Chinese-only format is required, which matches the language/locale policy violation criteria.

Static analysis

No suspicious patterns detected.