T09 · Insecure Skill Coding Practices
Warning
- Location
references/weekly-review-guide.md:61- Finding
Hard-Coded Feishu Recipient May Cause Unauthorized Disclosure of Private Activity
- Content
View full analysis
- Remediation
View remediation
Security audit
Learning System
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches a personal learning workflow, but its weekly review can automatically summarize private work activity and send it through Feishu to a named recipient without a clear confirmation step.
Review this carefully before installing. It is suitable only if you want a Chinese-language personal learning workflow that can read OpenClaw memory logs, notes, and work activity. Disable or remove the Feishu send step and any scheduled cron use unless every outgoing weekly summary is previewed and the recipient is explicitly confirmed each time.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
2. 初始化笔记目录
bash mkdir -p ~/.openclaw/workspace/notes/areas/{deep-dives,weekly-reviews}3. 运行
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This is a markdown file, so SQP-2 applies to user-facing descriptions that omit warnings about behaviors affecting user data. The README states that a cron job will automatically trigger the weekly review, and elsewhere describes updating the knowledge map and generating reports, but it does not warn users that scheduled runs may modify note files automatically.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill clearly instructs the agent to read local files such as memory logs, PR-related notes, templates, and knowledge-map documents, but the manifest does not declare any tool scope or permissions. This creates a capability/visibility mismatch: operators and users cannot accurately assess what the skill needs, and an agent runtime may overgrant access or invoke the skill without adequate review.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list contains broad everyday phrases like '总结一下', '复盘', 'deep dive', and 'recap', which can match normal conversation and invoke the skill unintentionally. In this skill, accidental activation matters because the workflow may read logs, inspect code/PR history, write notes, and potentially send summaries externally.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documented behavior exceeds the declared interface: it describes sending Feishu messages and running a separate mastery-scoring mode that are not reflected in the manifest or argument hint. Hidden or undocumented capabilities are dangerous because they bypass expectation-setting, reduce reviewability, and can enable data handling or outbound actions that users did not knowingly authorize.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The weekly review mode instructs the agent to collect recent memory logs, deep-dive notes, PRs, and code changes, synthesize them, and then send a summary externally. This creates a natural-language exfiltration path where sensitive code, internal activity, or personal notes can be disclosed without explicit scope limitation or data classification checks.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The workflow includes sending summaries through Feishu, an external messaging channel, even though the skill's stated purpose is local learning and knowledge management. Because the skill aggregates notes, logs, and code activity, adding external transmission expands the trust boundary and creates a realistic path for unintended exfiltration of sensitive project or personal information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill says it will send a summary via Feishu but provides no warning, consent checkpoint, or preview before external transmission. This is especially dangerous because the summary is derived from aggregated memory logs, notes, and code activity, so users may not realize sensitive content is leaving the local environment.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all instructions and policy guidance exclusively in Chinese, which can impose a language choice on users without opt-in. Under the natural-language policy rule, forcing a specific language without offering an alternative or documenting a justified locale restriction is a policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file contains user-facing natural-language instructions only in Chinese, which can amount to a language/locale policy violation when no opt-in, alternative language, or justification is provided. The stated policy requires flagging files that force a specific language without user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire guide is written in Chinese and instructs communication in Chinese-specific tooling/context without offering any language choice or opt-in. Under the policy rule for natural-language constraints, this is a locale/language requirement that is not documented as optional or region-justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This Python file contains user-facing docstrings and report output entirely in Chinese, including the generated report headings and recommendations. Because the script does not offer any language selection or document a justified region-specific requirement, it appears to enforce a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python file contains multiple hard-coded Chinese user-facing strings, beginning with the level labels/comments and continuing in printed report content. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the skill clearly documents a justified regional constraint, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The generated report includes Chinese-only phrases such as upgrade/downgrade suggestions, warning text, and table headers. Because these are the primary user-visible outputs of the skill and no language selection mechanism exists, the file violates the language-choice policy.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This skill description forces a single language for instructions and usage details, with no opt-in, alternative language, or justification that the skill is intended only for a Chinese-speaking context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown template is written entirely in Chinese, including the title and instructional text, with no indication that language selection is optional. Under the policy rule for language or locale constraints, this can be considered a natural-language policy violation because it implicitly enforces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The entire template and its required headings are written in Chinese, which implicitly enforces a specific language for users filling it out. The file does not offer an alternative language choice or explain why a Chinese-only format is required, which matches the language/locale policy violation criteria.
- Content
Static analysis
No suspicious patterns detected.