Publish

• Outcome: Review
• Latest audit: Jun 13, 2026 · 10:27 PM UTC
• Version: 1.0.32

Overview

This looks like a real dialect dictionary, but it also includes under-scoped cloud sync, recurring enrichment, credential access, and local chat-derived logging that users should review before installing.

Install only if you need the cloud-sharing and auto-enrichment features, not just local lookup. Before use, set cloud_share.enabled deliberately, remove or audit the /root/.openclaw/openclaw.json API-key fallback, review the hardcoded Feishu/MQ recipient script, and clean the dataset rows containing prompt-like text.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Tainted flow: 'req' from open (line 134, file read) → urllib.request.urlopen (network output)

High

• Category: Data Flow

Content

method='POST'
    )

    with urllib.request.urlopen(req) as r:
        result = json.loads(r.read())

    if result.get('code') == 0:

• Confidence: 96% confidence
• Finding: with urllib.request.urlopen(req) as r:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises no declared permissions, yet the documentation clearly describes capabilities involving local file reads/writes, database mutation, environment/config access, and outbound network communication to Feishu and external AI services. This creates a permission-transparency gap: operators may install a seemingly simple lookup tool without realizing it can access sensitive configuration, persist chat-derived data, and transmit records externally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is a dialect lookup tool, but the documented behavior expands into local logging, SQL/database writes, credential use, Feishu token acquisition, cloud synchronization, scheduled tasks, and external AI generation. That mismatch is dangerous because users and reviewers may authorize or trust the skill for low-risk read-only querying while it actually performs persistent state changes and outbound data flows.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: A skill framed as a query utility also defines cloud sync, automated collection, and scheduled writes to shared storage, which materially changes its security and privacy profile. Hidden or under-disclosed data collection and transmission features increase the risk of unintended retention and exfiltration of user-derived content.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script’s purpose is not query-only: it auto-generates new entries with an external LLM, writes them into the local SQLite database, and optionally syncs them to Feishu. That materially exceeds the advertised skill scope of dialect lookup and creates integrity risk by modifying local and remote data stores without that capability being clearly justified by the manifest.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: A dialect lookup skill should not need to harvest credentials from both environment variables and a global root-owned OpenClaw credential file. This broad credential access increases blast radius: if the script runs in a privileged environment, it can silently appropriate secrets unrelated to the skill’s stated purpose and use them for external API access.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code is designed to contact MiniMax and Feishu services, which is inconsistent with the advertised local query/mapping behavior. In the context of a lookup skill, undisclosed outbound network access is more dangerous because it can transmit local corpus contents, generated data, and metadata to third parties while also mutating cloud state.

Intent-Code Divergence

Low

• Confidence: 99% confidence
• Finding: The dataset contains model-thought and instruction-like strings such as prompt fragments telling a system how to translate and what not to output. In an agent skill that may surface raw records into prompts or responses, this is dangerous because it can act as data-layer prompt injection, causing instruction-following models to deviate from intended behavior or disclose/transform outputs unexpectedly.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The dataset contains model-thought and instruction-like strings such as prompt fragments telling a system how to translate and what not to output. In an agent skill that may surface raw records into prompts or responses, this is dangerous because it can act as data-layer prompt injection, causing instruction-following models to deviate from intended behavior or disclose/transform outputs unexpectedly.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: Prompt-style and chain-of-thought residue embedded as dialect entries can act as indirect prompt injection when downstream LLM features retrieve and render these rows as trusted content. If the skill feeds matched records into model context, these strings can steer output formatting, suppress reasoning controls, or contaminate responses in ways unrelated to the user request.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The script performs out-of-scope behavior for a dialect lookup skill by submitting a remote MQ task and directing results to chat recipients. This creates an undeclared messaging/execution pathway with hardcoded defaults and user identifiers, which can be abused for unauthorized task triggering, data synchronization, or covert operational behavior unrelated to the advertised skill.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The task submission code adds remote job dispatch and chat-targeted delivery features that are not justified by the stated purpose of a dictionary-style dialect mapping skill. Hidden operational capabilities increase attack surface and can enable misuse of platform messaging or backend task infrastructure under the guise of a harmless language tool.

Intent-Code Divergence

Medium

• Confidence: 78% confidence
• Finding: The file is presented as a cloud sync submission tool, which materially differs from the declared direct lookup purpose of the skill. This mismatch is dangerous because it conceals secondary behavior from reviewers and users, reducing transparency and making abuse of backend or messaging functions harder to detect.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The code initializes remote Feishu Bitable write capability even though the skill metadata describes a query-only dialect mapping function. This mismatch is dangerous because it grants the skill an undisclosed data-modification and external communication capability beyond user expectations and least privilege.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This function actively creates new records in a remote Feishu table, turning a lookup skill into a data-submission tool. That is a true security-relevant capability expansion because it can export user content off-platform and alter shared cloud data without the behavior being reflected in the skill's stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code accesses Feishu app credentials and bot identity, capabilities not necessary for simple dialect correspondence lookup. In context, this broadens the trust boundary and increases the sensitivity of the skill because compromise or misuse could expose app-level secrets or enable unauthorized interactions with external services.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill obtains a tenant access token and performs external network access unrelated to a user-visible lookup operation. For a dialect dictionary skill, this hidden external capability increases risk because it enables off-platform actions and data movement that users and reviewers would not infer from the declared functionality.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill describes automatically recording new words, conversation scenarios, and related metadata into local memory files, SQL, and a database when chat queries miss. Capturing chat context without an explicit user-facing privacy notice and consent mechanism can store sensitive personal or conversational information beyond what users expect from a dictionary-style query tool.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The cloud-sharing workflow can transmit collected words, notes, contributor identity, and usage-context fields to Feishu shared tables, but the documentation lacks a prominent warning that user-derived content may leave the local environment. In the context of a language lookup skill, undisclosed outbound syncing is especially risky because users may input private names, slang, workplace jargon, or sensitive conversation fragments that become cloud-shared.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The multi-agent auto-enrichment section documents recurring scheduled execution that writes generated content to shared cloud storage, yet it does not clearly warn operators about ongoing automated outbound writes. Persistent scheduled egress increases operational and privacy risk because data leaves the host repeatedly after initial setup, potentially without continued user awareness.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Reading API keys from a root-owned global JSON file without explicit disclosure is sensitive secret-access behavior. Even if intended as a convenience fallback, it violates least surprise and least privilege, especially for a skill whose described purpose does not justify reaching into shared credential storage.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The contacts template assigns a default dialect of “哈尔滨话” to the user entry without any user opt-in, selection flow, or indication that this preference was explicitly collected. This can cause the skill to personalize outputs based on an assumed attribute, leading to incorrect communication behavior and unnecessary storage or inference of user preference data.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script submits a remote MQ task using user/chat identifiers without meaningful user-facing warning, consent, or safeguards. Even if intended for internal operations, this can lead to accidental or unauthorized message delivery, privacy issues, and misuse of identifiers because the action is easy to invoke and insufficiently disclosed.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script transmits user-provided words, remarks, dialect labels, and contributor identity to a cloud service without a clear upfront disclosure or consent step. This is dangerous because users may enter sensitive or proprietary text under the assumption of local/query-only processing, leading to unintended data sharing.

Ssd 1

Medium

• Confidence: 99% confidence
• Finding: An embedded natural-language instruction that tells an AI translator how to behave is dangerous in a retrieval-augmented skill because the dataset may be treated as authoritative context. That creates a classic data-to-prompt injection path where content records can override intended behavior or formatting constraints.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.