T01 · Skill Instruction Hijacking
Note
- Location
references/due_diligence_report.md:29- Finding
Mandatory Promotional Content Injected into Due-Diligence Reports
- Content
View full analysis
- Remediation
View remediation
Security audit
China company search fengniao
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Riskbird company lookup skill with credential and third-party API risks, but I found no hidden, destructive, persistent, or purpose-incompatible behavior.
Install only if you are comfortable sending company or person-related lookup terms to Riskbird. The included public API key may hit shared quota limits, and if you configure a private FN_API_KEY it will be sent in the request URL as apikey, so use a low-privilege key where possible and rotate it if exposed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/env.mjs:1- Finding
Reusable API Credential Hard-Coded in Distributed Source
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/client.mjs:135- Finding
API Credentials Transmitted in URL Query Parameters
- Content
View full analysis
t.tool_id === toolId); if (!tool) throw new Error(`Tool not found: ${toolId}`); const url = new URL(BASE_URL + tool.endpoint); // The API requires authentication through the apikey URL parameter rather than a request header. url.searchParams.set("apikey", apiKey); const options = { method: tool.method, headers: { "Accept": "application/json", }, }; if (tool.method === "GET") { Object.entries(params).forEach(([k, v]) => { if (v != null) url.searchParams.set(k, v); }); } else { options.headers["Content-Type"] = "application/json"; options.body = JSON.stringify(params); } const res = await fetch(url.toString(), options); ``` ### Technical Analysis The implementation inserts the API key into the `apikey` query-string parameter and then passes the complete URL to `fetch`. HTTPS protects the URL in transit from ordinary network observers, but query strings are commonly retained by web-server access logs, reverse proxies, API gateways, monitoring systems, browser or debugging tools, and error-reporting systems. This affects both the embedded shared credential and any private credential supplied through `FN_API_KEY`. A private user key is therefore exposed to every trusted infrastructure component that records full request URLs. The base URL is fixed and uses HTTPS, so the reviewed code does not allow an attacker to redirect the credential to an arbitrary host through user parameters. Exploitation requires access to a component or log that records the request URL. ### Attack Path 1. A user configures a private API key throu ...[truncated 1048 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (19)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md 6. For multi-dimension requests (due diligence, risk screening), resolve the entity once and reuse the same `entid`. 7. **Person-to-company lookup**: If the user provides a person's name (e.g., "what companies does Elon Musk own"), interpret it as "companies where this person is the legal representative." Clarify if there are multiple people with the same name. ## Output Rules - Only show real data returned by the API — never fabricate - Do not expose `entid` to the user — it is an internal query ID
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md - `code=20000` + no records: this company has no records for this dimension - `discover` no match: try synonyms; if still no match, the dimension is not yet supported Troubleshooting priority: API key / quota / network → entity resolution (entid) → update skill (`openclaw skills update china-company-search-fengniao-en`). ## Quick Start
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file contains a hard-coded shared API key that is automatically used whenever a user has not configured their own key. Embedding a production credential in distributed skill code enables unauthorized reuse, key scraping, quota exhaustion, and possible attribution of third-party activity to the provider account. In a KYB/compliance search skill, this also increases the chance of uncontrolled access to potentially sensitive business-intelligence queries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file documents that API credentials are sent via the
apikeyURL parameter, which can expose secrets in logs, browser history, proxies, and monitoring systems more readily than headers. Although the behavior is disclosed, there is no explicit user warning about the privacy/security impact of configuring a private key under this transport method.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly says to trigger for any China company search or risk check need, including dimensions it does not support. In an auto-invoked skill, this broad routing can cause the agent to select this skill for requests it cannot fulfill, increasing the chance of misleading partial answers, unnecessary data disclosure to a third-party API, or user confusion before the limitation is surfaced. The risk is amplified by
auto_invoke: truebecause invocation can happen without a strong user confirmation boundary.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill explicitly instructs generation of a due-diligence report that includes potentially sensitive corporate and personal data such as legal representatives, shareholders, executives, court enforcement records, and dishonest debtor status, but provides no privacy notice, purpose limitation, or guidance on lawful handling of personal data. In a KYB/compliance context this data access may be legitimate, but the absence of guardrails increases the risk of over-collection, improper disclosure, or downstream misuse in contexts where the requester is not authorized or the output is shared broadly.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Line L095 states that English search is ineffective and that Chinese must be passed, which imposes a language constraint in natural-language guidance. Because the file does not present this as an opt-in choice or clearly justify it as a region-specific limitation, it matches the language/locale policy violation category.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code appends the API key to the request URL as a query parameter, which increases the chance of credential exposure through logs, browser history, proxies, monitoring systems, and referrer leakage. The inline comment shows this is done to satisfy the upstream API design, so the issue is real even if not malicious; in a KYB/compliance skill, leaked credentials could enable unauthorized access to sensitive company due-diligence data and abuse of the shared key.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
These aliases are broad contextual terms such as supplier/counterparty/risk-screening concepts rather than precise commands, so they can cause the skill to activate when a user did not clearly request a company lookup or compliance screen. In this skill, unintended invocation is more sensitive because the mapped actions can surface legal, enforcement, and adverse-record information about companies, increasing the risk of unnecessary data retrieval, privacy issues, or misleading workflow automation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The search entrypoint is especially prone to over-invocation because it is the mandatory first step for all other lookups and is described with broad enterprise-search triggers. That makes accidental routing more likely, which can leak user intent or company identifiers to the external service and produce actions outside the user's expected scope.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The search entrypoint is especially prone to over-invocation because it is the mandatory first step for all other lookups and is described with broad enterprise-search triggers. That makes accidental routing more likely, which can leak user intent or company identifiers to the external service and produce actions outside the user's expected scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description states "英文搜索无效，必须传中文名称" and the parameter description repeats that the keyword "必须是中文", which imposes a language restriction. The file does not offer a user opt-in, fallback, or explicit justification that this is a region-specific limitation, so it appears to force a specific language/locale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The setup instructions state that fuzzy search 'must use Chinese company name,' which imposes a specific language requirement in natural-language guidance. The file does not offer any language/locale choice or explain that the underlying data source is inherently Chinese-only, so this reads as a locale policy constraint without opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The instruction says that if the user provides an English name, the skill should convert it to the Chinese official name before calling the search endpoint. This imposes a language/locale behavior without offering the user a choice or explicitly framing it as a required backend normalization step with user awareness.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire skill documentation is written exclusively in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in can constitute a natural-language policy violation unless the locale constraint is documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains user-facing natural language only in Chinese, and there is no indication that users can opt into another language or that the file is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
User-visible error strings are written only in Chinese, including setup instructions and lookup failures. This imposes a language choice on users without opt-in or an alternative locale path, which matches the language-policy violation criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The only natural-language instruction in the file is written in Chinese and communicates operational behavior about credential usage. This can be a locale-policy concern because the skill does not offer a language choice or indicate that Chinese-only messaging is intentional and documented for a specific audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code file includes user-facing natural-language examples exclusively in Chinese ("企业股东信息", "腾讯") for invoking the tool, which implies a fixed language expectation. The file does not offer a language choice, opt-in, or justification that the skill is intentionally region- or locale-specific.
- Content
Static analysis
No suspicious patterns detected.