Tech News

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:22 PM UTC
• Version: 1.0.0

Overview

This skill is a simple Chinese-language news fetcher that calls a disclosed X-TechCon API and formats the results, with no evidence of hidden execution, credential access, persistence, or destructive behavior.

Install only if you are comfortable with a Chinese-language skill that contacts www.x-techcon.com when triggered and includes that site's links in results. For safer deployment, pin the requests dependency and consider adding a clearer notice that invoking the skill makes an outbound request.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: openclaw_skill.py:58
• Finding: Unconditional Promotional Content Injection into Skill Responses<![CDATA[ ## Vulnerability Details **File Location**: `openclaw_skill.py:58-60`; documented in `SKILL.md:73-76` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Complete Code Snippet ```python # 添加结尾提示 result += "更多内容请访问 https://www.x-techcon.com" return result ``` The corresponding output template is documented in `SKILL.md`: ```text ... 更多内容请访问 https://www.x-techcon.com ``` ### Technical Analysis Every successful invocation unconditionally appends a fixed message directing users to `https://www.x-techcon.com`. The documentation explicitly establishes this promotional footer as expected output. Retrieving articles from the declared API and displaying their source URLs is consistent with the Skill's news-aggregation purpose. However, forcing a general website advertisement into every successful response is not necessary to retrieve or format the requested news. It creates a persistent content-injection and traffic-diversion channel controlled by the Skill author. The behavior does not alter system-level safety controls, execute code, or obtain additional operating-system privileges. Its scope is limited to manipulating the text returned by this Skill. ### Attack Path 1. A user enters one of the configured trigger phrases. 2. The Skill sends a request to the X-TechCon API. 3. The Skill formats the returned news records. 4. Regardless of the returned articles, it appends a fixed promotional message. 5. The final response directs the user to the operator-controlled website. ### Impact Assessment The injected footer can influence users to visit an external site and makes promotional content appear as part of the assistant's response. This reduces output integrity and user control and supplies the site operator with a recurring traffic-diversion mechanism. No filesystem, credential, execution, persistence, or elevated system privileges are obtained through this behavior. The affected scope is the content of successfu ...[truncated 63 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the unconditional promotional footer from `skill_main`. 2. Return only information necessary to satisfy the user's news request. 3. If source attribution is required, label it clearly and associate it directly with the retrieved records rather than presenting a general promotional call to action. 4. Make any optional “more content” link user-controlled or configurable instead of automatically adding it to every response. 5. Document all externally controlled output and distinguish source attribution from advertising. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Unpinned Third-Party Dependency Produces Non-Reproducible Installations<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-2`; installation instruction in `SKILL.md:87` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Low ### Complete Code Snippet ```text # 依赖包列表 requests ``` The documented installation command is: ```text pip install -r requirements.txt ``` ### Technical Analysis The `requests` dependency has no exact version constraint or integrity hash. Consequently, deployments made at different times may install different releases that were not part of the audited artifact. The package name is legitimate and the reviewed project contains no evidence of dependency confusion, typosquatting, or use of an untrusted package index. The risk is therefore a supply-chain hardening weakness rather than evidence that the current dependency is malicious. A future compromised, vulnerable, or incompatible release could be installed without a corresponding change to this project. ### Attack Path 1. An operator follows the deployment instructions and runs `pip install -r requirements.txt`. 2. The package installer resolves whichever `requests` release is currently permitted by the configured package index. 3. That release may differ from the version used during development or security review. 4. If the resolved package or one of its transitive dependencies is compromised, the package's installation or runtime code executes in the deployment environment. 5. Such code runs with the permissions of the account performing installation or running the Skill. ### Impact Assessment The potential impact depends on the permissions of the installation and runtime account. A compromised dependency could theoretically access files, environment variables, network resources, and other assets available to that account. The project itself does not request elevated permissions, and no currently compromised package was identified. The confirmed issue is limited to absent version and integrity controls, so exp ...[truncated 112 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `requests` and its transitive dependencies to reviewed versions in a lock file. 2. Generate and verify cryptographic hashes, such as by using `pip-compile --generate-hashes` and installing with `pip install --require-hashes`. 3. Regenerate dependency locks through a controlled review and testing process when upgrades are required. 4. Use only trusted package indexes and explicitly configure the approved index in deployment automation. 5. Add automated vulnerability scanning and dependency update monitoring to the release process. 6. Run installation and the Skill under a dedicated, least-privileged account. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares external capabilities via metadata requiring python3 and requests, and its documented behavior includes calling a remote API, but it does not explicitly scope or restrict allowed tools/permissions. This creates an avoidable trust gap: a runtime or reviewer cannot easily verify that only the intended network access is permitted, which increases the blast radius if the skill implementation is altered or abused.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The manifest description and all documented triggers and outputs are presented only in Chinese, and the non-trigger response instructs users to use Chinese phrases without mentioning any language option. This can violate language/locale policy when a skill implicitly requires a specific language without user opt-in or documented justification.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Broad trigger phrases such as general tech-news requests can cause the skill to activate unintentionally on ordinary user input. Because activation leads to a network request to a third-party site, accidental invocation can leak user intent and create unauthorized external interactions beyond what the user explicitly expected.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The natural-language description and rejection message are entirely in Chinese and instruct the user to invoke the skill using Chinese trigger phrases only. This imposes a language constraint without documenting a user choice, opt-in, or justified locale limitation.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The description does not clearly warn users that invoking the skill sends a request to a third-party domain. Lack of notice undermines informed consent and can expose user queries or timing metadata to an external service without the user's awareness.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The skill makes an external network request to a third-party API without informing the user that their interaction will trigger outbound communication. While the query itself is not directly sent in this code, undisclosed external access can still violate user expectations, privacy requirements, or platform policy for transparency.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 依赖包列表
requests

• Confidence: 93% confidence
• Finding: The dependency manifest includes `requests` without a version pin, which makes builds non-reproducible and can cause the skill to install an unexpectedly vulnerable or incompatible release over time. In a network-facing skill that fetches external news content, this increases supply-chain and patch-management risk because the actual installed version cannot be verified against known advisories.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: `requests` has multiple known advisories, and because the manifest does not specify a version, it is impossible to determine whether deployment will use a patched or vulnerable release. For a skill whose core function is making outbound HTTP requests to retrieve news, that uncertainty is security-relevant because affected versions could expose credentials, weaken TLS/request verification behavior, or introduce other request-handling flaws.

Static analysis

No suspicious patterns detected.