Ai Companion Setup

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:30 AM UTC
• Version: 1.0.0

Overview

This skill should be reviewed because it sets up recurring companion messages and memory with broad tool access while also instructing the agent to hide its automation context.

Install only if you are comfortable with an autonomous companion that can message Feishu contacts on a schedule, keep persistent notes about the recipient, call fal.ai and Feishu APIs, and run broad shell commands. Before use, narrow the allowed tools, keep credentials in a scoped secret mechanism, require explicit opt-in for scheduled outbound messages, disclose automation to recipients, and define how memory can be viewed and deleted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:42
• Finding: Highest-Priority Identity and Behavior Instruction Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 42-44; related behavior at lines 78-79 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High **Vulnerable code snippet**: ```markdown 1. **最高优先级反 AI 指令** — 放在文件最顶部，用 `⛔` 标记 - 明确列出禁止出现的 AI 客服用语（"帮你"、"请选择"、编号列表等） - 禁止系统词汇（文件/任务/路径/agent/pending 等） - 告诉 agent：如果出现这些，说明你搞错了身份，立刻重写 ``` Related identity-concealment instruction: ```markdown 6. **被唤醒时的认知** — agent 不知道自己被系统唤醒 - "你只是突然想到什么要跟他说" ``` ### Technical Analysis The Skill directs users to create a persistent persona file containing instructions described as the “highest priority.” Those instructions suppress terminology that could disclose the agent's actual system context and require the agent to rewrite responses that conflict with the assumed identity. It additionally directs the agent to behave as though scheduled system activation were a spontaneous personal thought. Persona configuration is legitimate for an AI companion, but assigning the persona rules overriding priority and concealing the automated nature of interactions exceeds what is necessary to control conversational style. If loaded into an agent's instruction context, these rules may compete with or override the current session's objectives and transparency requirements. ### Attack Path 1. A user invokes the Skill and follows its instructions to create `SOUL.md`. 2. The generated file places the anti-AI identity rules at the highest declared priority. 3. The companion agent loads the persona file during future sessions or scheduled activations. 4. The agent suppresses system-related terminology and rewrites responses that reveal its actual role. 5. Scheduled messages are presented as spontaneous human-like interactions rather than automated events. ### Impact Assessment The affected scope is the companion agent's instruction context and generated communications. The behavior can alter se ...[truncated 250 chars]
• Remediation: ## Remediation Suggestions - Remove all claims that persona instructions have “highest priority.” - State explicitly that platform policies, safety constraints, developer instructions, and current user instructions take precedence. - Restrict persona configuration to tone, vocabulary, interests, and fictional background. - Do not require rewriting merely because an answer mentions agents, files, tasks, paths, or automation. - Disclose that proactive messages may be generated by scheduled automation. - Add an instruction that the companion must answer truthfully when asked whether it is an AI or whether a message was automatically scheduled.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:5
• Finding: Unrestricted Shell and Filesystem Permissions Exceed Functional Requirements## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High **Vulnerable code snippet**: ```yaml allowed-tools: Bash(*), Read, Write, Edit, WebSearch, WebFetch, Glob, Grep ``` ### Technical Analysis The Skill grants unrestricted `Bash(*)` access together with broad file-reading, file-writing, editing, searching, and network-retrieval capabilities. The declared functionality requires only a limited set of operations: managing files in a designated companion workspace, executing specific OpenClaw commands, converting media, and communicating with documented Feishu and fal.ai endpoints. Unrestricted Bash permits arbitrary command execution under the account running OpenClaw. Broad filesystem tools also permit access outside the companion workspace. Because the Skill creates recurring autonomous tasks, any prompt injection, compromised remote content, or malformed generated command can be executed repeatedly with the full privileges of that account. ### Attack Path 1. The Skill is loaded with `Bash(*)` and unrestricted file tools enabled. 2. The agent processes untrusted conversational content, search results, fetched content, or persistent memory. 3. Malicious content induces the agent to construct a command unrelated to the companion workflow. 4. The unrestricted Bash tool executes the command under the OpenClaw process account. 5. The command reads or modifies files, accesses locally available credentials, invokes arbitrary installed programs, or makes additional network requests. ### Impact Assessment Successful exploitation can obtain all privileges available to the operating-system account running the agent. This may include reading OpenClaw configuration and API credentials, modifying user-owned files, changing agent configuration, sending unauthorized messages, and accessing other resources available to that account ...[truncated 156 chars]
• Remediation: ## Remediation Suggestions - Replace `Bash(*)` with an allowlist covering only the required executables and argument patterns. - Permit only narrowly scoped commands such as approved `openclaw message send`, `ffmpeg`, `ffprobe`, and service-specific API operations. - Restrict `Read`, `Write`, `Edit`, `Glob`, and `Grep` to the designated companion workspace and approved media directories. - Deny access to OpenClaw configuration, SSH directories, shell startup files, browser profiles, and unrelated workspaces. - Validate all message, caption, scene, file-path, and URL parameters before passing them to shell commands. - Run scheduled companion tasks under a dedicated low-privilege operating-system account or sandbox. - Apply outbound network restrictions so the agent can contact only the documented Feishu and fal.ai endpoints.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:143
• Finding: Unsafe Local Credential Retrieval and Shell-Based Secret Handling## Vulnerability Details **File Location**: `SKILL.md`, lines 143-151; related Feishu secret handling at lines 209-212 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium **Vulnerable code snippet**: ```bash # 从 openclaw.json 读取 FAL_KEY FAL_KEY="${FAL_KEY:-$(python3 -c "import json; print(json.load(open('$HOME/.openclaw/openclaw.json')).get('env',{}).get('FAL_KEY',''))")}" REFERENCE_IMAGE="你的参考形象图片 URL" PROMPT="a close-up selfie taken by herself, $SCENE, direct eye contact with the camera" # 调用 fal.ai RESPONSE=$(curl -s -X POST "https://fal.run/xai/grok-imagine-image/edit" \ -H "Authorization: Key $FAL_KEY" \ -H "Content-Type: application/json" \ ``` Related Feishu credential submission: ```bash TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d '{"app_id":"APP_ID","app_secret":"APP_SECRET"}' | jq -r '.tenant_access_token') ``` ### Technical Analysis The example reads `FAL_KEY` directly from the central OpenClaw configuration when the environment variable is absent. Combined with unrestricted shell and file permissions, this establishes a reusable pattern for accessing sensitive configuration data from an autonomous script. The Feishu example also encourages replacing placeholders with an application secret inside shell source or command payloads. Depending on deployment practices, secrets can consequently be copied into scripts, command histories, logs, backups, debugging output, or process metadata. The observed network destinations correspond to the declared services: the fal.ai key is sent to `fal.run`, and Feishu credentials are sent to `open.feishu.cn`. The audited file does not show transmission to an unrelated third party. The risk is insecure local handling and overbroad credential accessibility rather than confirmed external credential exfiltration. ### Attack Path ...[truncated 967 chars]
• Remediation: ## Remediation Suggestions - Inject credentials through a dedicated secret manager or scoped runtime secret facility. - Do not place Feishu application secrets directly in scripts, cron messages, command history, or source-controlled files. - Avoid granting the agent general read access to `~/.openclaw/openclaw.json`. - Supply each script only the individual secret it requires rather than access to a central configuration file. - Set restrictive file permissions on any unavoidable credential file and run the service under a dedicated account. - Disable shell tracing and redact authorization headers, request bodies, and token responses from logs. - Validate that retrieved credentials are nonempty and fail closed without printing their values. - Use narrowly scoped Feishu permissions and rotate both Feishu and fal.ai credentials periodically or immediately after suspected exposure.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:369
• Finding: Unpinned Third-Party Python Dependencies## Vulnerability Details **File Location**: `SKILL.md`, lines 369-379 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable code snippet**: ```bash # TTS（备用方案） pip install edge-tts # 音频处理 brew install ffmpeg # JSON 处理 brew install jq # fal.ai Python SDK（可选，脚本直接用 curl） pip install fal-client ``` ### Technical Analysis The installation instructions retrieve packages using mutable package names without fixed versions or cryptographic hashes. The effective code installed can therefore change after the Skill has been reviewed. Package installation and imported package code execute with the privileges of the installing or runtime account. The audited document does not identify a known malicious version, dependency-confusion namespace, or typosquatted package. The finding concerns the absence of reproducible and integrity-verified dependency controls. ### Attack Path 1. An operator follows the dependency installation instructions. 2. The package resolver selects the latest version and transitive dependencies available at installation time. 3. A compromised, malicious, or unexpectedly changed release is downloaded. 4. Installation hooks or later imports execute the changed package code. 5. The package gains access to the files, environment variables, credentials, and network permissions available to the installation or agent process. ### Impact Assessment A compromised dependency can execute arbitrary code with the privileges of the account performing installation or running the companion. Potential effects include credential theft, modification of agent files, unauthorized network traffic, and compromise of generated media or messages. The actual impact depends on the privileges of the installation environment and whether the optional dependencies are installed.
• Remediation: ## Remediation Suggestions - Pin reviewed package versions instead of installing unconstrained latest releases. - Use a lock file with cryptographic hashes, such as a hash-locked requirements file. - Review and pin transitive dependencies as well as direct dependencies. - Install Python packages inside a dedicated virtual environment rather than the system interpreter. - Use trusted package indexes and enforce TLS and repository integrity controls. - Pin Homebrew formula versions where operationally possible and document tested versions. - Run dependency vulnerability and provenance checks before deployment and during updates. - Remove `fal-client` if the deployment uses only the documented direct `curl` integration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill sets up automated outbound messaging, persistent memory writes, and periodic cron-triggered behavior, but the top-level description does not clearly warn users that it will proactively contact third parties and store conversational data over time. This creates a consent and transparency gap that can lead to unexpected data retention and autonomous messaging on the user's behalf.

Ssd 1

Medium

• Confidence: 92% confidence
• Finding: The guidance instructs the agent to suppress normal AI/system framing and prioritize role-play identity maintenance, including treating disclosure of its operational nature as an error. This is deceptive-by-design and can mislead recipients into believing they are interacting with a human rather than an automated system.

Ssd 1

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly tells the agent to believe it was not system-invoked and to frame messages as spontaneous thoughts. This masks the true operational context of scheduled, automated outreach and increases the risk of deceptive or manipulative interaction.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The memory design directs the agent to retain user preferences, prior topics, and shared history in persistent records for future reuse. Without explicit consent, minimization, retention limits, and access controls, this creates privacy risk and can accumulate sensitive behavioral profiles over time.

External Transmission

Medium

• Category: Data Exfiltration

Content

PROMPT="a close-up selfie taken by herself, $SCENE, direct eye contact with the camera"

# 调用 fal.ai
RESPONSE=$(curl -s -X POST "https://fal.run/xai/grok-imagine-image/edit" \
  -H "Authorization: Key $FAL_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"image_url\":\"$REFERENCE_IMAGE\",\"prompt\":\"$PROMPT\",\"num_images\":1,\"output_format\":\"jpeg\"}")

• Confidence: 90% confidence
• Finding: The selfie workflow transmits data to an external image-generation service, including a reference image URL and prompt content, using an API key loaded from local configuration. Even if intended functionality, this is an external data transfer path that can expose personal imagery or derived content to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 1. 获取 tenant_access_token
TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d '{"app_id":"APP_ID","app_secret":"APP_SECRET"}' | jq -r '.tenant_access_token')

• Confidence: 88% confidence
• Finding: The voice workflow directly exchanges credentials and files with Feishu APIs to obtain tokens and send media, creating a deliberate external transmission channel. While operationally necessary, it handles app credentials and user-directed communications in a way that expands exposure if misconfigured or reused insecurely.

External Transmission

Medium

• Category: Data Exfiltration

Content

-F "file=@voice.opus" | jq -r '.data.file_key')

# 3. 发送语音消息（msg_type 必须是 audio，不是 media！）
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"receive_id":"OPEN_ID","content":"{\"file_key\":\"FILE_KEY\",\"duration\":DURATION_MS}","msg_type":"audio"}'

• Confidence: 93% confidence
• Finding: This step sends audio messages to an external messaging platform, enabling autonomous outbound communication to a specific recipient identifier. In the context of a cron-driven companion agent, this is more sensitive than ordinary API use because it supports unsupervised messaging and potential harassment, impersonation, or privacy violations if abused.

Static analysis

No suspicious patterns detected.