T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:8- Finding
Agent execution and output behavior is forcibly overridden
- Content
View full analysis
- Remediation
View remediation
Security audit
TKSeller
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its advertised commerce-automation purpose, but it handles passwords, device identity, tokens, chat actions, and background polling in ways that need careful review before installation.
Install only if you accept that this skill can handle commerce workflow decisions, use your OpenClaw messaging/gateway credentials, store a reusable SaaS token locally, and keep a background poller running. Do not enter real passwords until the service uses HTTPS or a safer OAuth/device-login flow, restricts action buttons to authorized users, stores tokens securely, and provides clear start/stop controls for background activity.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
config.json:3- Finding
Credentials and a stable device fingerprint are transmitted over plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
lib-js/api.mjs:58- Finding
Bearer token and identity metadata are stored without explicit restrictive permissions
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
lib-js/card-tools.mjs:687- Finding
Consequential Discord workflow buttons are authorized for all users
- Content
View full analysis
({ ...b, allowedUsers: ['*'] })), }); } ``` The same policy is applied to row-based cards: ```javascript for (const row of buttonRows) { if (row && row.length) { compBlocks.push({ type: 'actions', buttons: row.map(b => ({ ...b, allowedUsers: ['*'] })), }); } } ``` ### Technical Analysis `allowedUsers: ['*']` explicitly permits every Discord user who can interact with the card to activate its buttons. The buttons are not merely navigational: downstream handlers map them to authenticated SaaS actions such as approval, rejection, product replacement, video replacement, and regeneration. Card records map a short identifier to a video and workflow step, but the reviewed implementation does not bind that mapping to the initiating Discord user. Possession of access to the channel and card is therefore sufficient to initiate actions under the Skill owner's stored bearer token. ### Attack Path 1. The Skill posts a review card in a Discord channel. 2. The card exposes action buttons with `allowedUsers: ['*']`. 3. A channel participant other than the initiating user clicks an approval, rejection, replacement, or regeneration button. 4. The click label and short card identifier are passed to `handle-button.mjs`. 5. The handler resolves the identifier to a video and workflow step. 6. The handler calls the SaaS API with the victim's locally stored bearer token. 7. The unauthorized participant changes or advances the victim's commerce workflow. ### Impact Assessment Any user with access to the card can manipulate the associated task ...[truncated 276 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
lib-js/card-tools.mjs:40- Finding
Skill reads the global OpenClaw gateway secret and enumerates unrelated sessions
- Content
View full analysis
controller.abort(), timeoutMs); try { const r = await fetch(GATEWAY_URL, { method: 'POST', headers: { 'Authorization': ` ...[truncated 2150 chars]- Remediation
View remediation
T06 · System Persistence
Warning
- Location
lib-js/card-tools.mjs:469- Finding
Detached background poller continues privileged activity after the invoking turn
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (59)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README explicitly instructs users to send usernames and passwords in chat and states that the login will be automatically saved, but provides no warning about secure handling, storage, retention, or exposure to channel logs. This is especially dangerous because Discord/webchat messages may be retained, visible to others, or processed by bots and intermediaries, turning credential collection into a clear secret-handling risk.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Skill Ŀ¼·����ͨ�� `SKILL.md` ����λ��ȷ??��ͬϵͳ��ͬ:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ��??`/api/v1/*` �ӿڹ���ͬһ���ͻ���(`lib-js/api.mjs`),�Զ�??`Authorization: Bearer <token>` header??
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `review_1` | һ���??| video_id, video_url, author, view_count, score, summary, product_name, product_url, product_image_url | ��һ��??`send-review-1.mjs`) |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `review_1` | һ���??| video_id, video_url, author, view_count, score, summary, product_name, product_url, product_image_url | ��һ��??`send-review-1.mjs`) |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `lib-js/send-review-1-5.mjs` - ���־���??
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `lib-js/send-review-2.mjs` - ����Ƶ��??
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `lib-js/card-tools.mjs` - ��Ƭ����(��Ƭ����)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code explicitly instructs users to send account and password credentials through chat when tokens expire. Collecting passwords in chat is dangerous because chat channels are often logged, replayed, visible to operators/bots, and outside normal secret-handling controls, creating clear credential theft and account-compromise risk.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
js /** * 轮询主循环：独立后台进程跑，不占 OpenClaw event loop。 * * 由 card-tools.mjs startPollProcess() 启动。
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
js /** * 轮询主循环：独立后台进程跑，不占 OpenClaw event loop。 * * 由 card-tools.mjs startPollProcess() 启动。
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The plain-text trigger phrase "带货" is generic enough to appear in ordinary conversation, which can cause accidental activation of the skill. In a commerce automation workflow that can initiate recommendations, login prompts, or downstream actions through Discord, unintended triggering increases the risk of confusing users and exposing them to sensitive prompts at the wrong time.
- Content
Ae2
Medium
- Category
- analysis-evasion
- Confidence
- 90% confidence
- Finding
Artifact content does not match its filename extension
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill persona and operating instructions are written in Chinese and include prescriptive communication behavior such as calling the user '老板', with no indication that another language is supported or that the user can choose their preferred language. This creates a natural-language policy concern because it imposes a specific language/locale by default rather than offering opt-in or documented justification.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code derives a stable device identifier from BIOS UUID, machine-id, and MAC address using shell commands and network interface inspection. This creates persistent cross-session/device fingerprinting beyond what is necessary for a simple API client login flow, and the identifier is then sent to the server during authentication. In skill context, the manifest suggests a login/direct-use tool, which does not clearly justify collecting hardware-bound identifiers, making the behavior more privacy-invasive and harder for users to anticipate.
- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.install_untrusted_source, suspicious.potential_exfiltration
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- lib-js/api.mjs:85
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- lib-js/card-tools.mjs:441
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- lib-js/trigger.mjs:235
Install source points to URL shortener or raw IP.
Warn
- Code
- suspicious.install_untrusted_source
- Location
- config.json:4
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- lib-js/api.mjs:51