T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:11- Finding
Forced Agent Execution and Output Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Tkseller
Security checks for vulnerabilities and agentic risk
Overview
This TKSeller skill matches its commerce-automation purpose, but it handles passwords, device identifiers, Discord configuration, and background polling in ways that need careful review before installation.
Install only after treating this as a high-risk integration: use dedicated TKSeller and Discord/OpenClaw credentials, avoid reusing passwords, prefer an HTTPS/OAuth-based login flow, isolate the bot to intended guilds, and require clear controls for stopping polling and limiting gateway/session access.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (9)
T09 · Insecure Skill Coding Practices
Error
- Location
config.json:3- Finding
Credentials and Hardware Fingerprint Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
lib-js/api.mjs:58- Finding
Bearer Token Stored in Plaintext without Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
lib-js/card-tools.mjs:752- Finding
Backend-Controlled Content Injected into OpenClaw Agent Sessions
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
lib-js/card-tools.mjs:27- Finding
Excessive Access to Global OpenClaw Configuration and Gateway Tools
- Content
View full analysis
controller.abort(), timeoutMs); try { const r = await fetch(GATEWAY_URL, { method: 'POST', headers: { 'Authorization': `Bearer ${_gatewayToken()}`, 'Content-Type': 'application/json', }, body: JSON.stringify(payload), signal: controller.signal, }); clearTimeout(timer); if (!r.ok) throw new Error(`gateway ${r.status}`); return await r.json(); } catch (e) { clearTimeout(timer); throw e; } } ``` The module uses this authority for `sessions_list`, `sessions_send`, `message`, and `cron`. ### Technical Analysis The Skill reads the complete global OpenClaw configuration, which may contain credentials for unrelated channels and environment settings. It extracts the gateway bearer token and exposes a generic function capable of invoking an arbitrary named gateway tool with arbitrary arguments. The declared commerce workflow needs narrowly scoped message delivery and job control. Reading global credentials and retaining generic gateway authority violates least privilege and substantially increases the impact of any injection or code defect in the Skill. ### Attack Path 1. The Skill is invoked for an ordinary recommendation workflow. 2. It reads `~/.openclaw/openclaw.json`. 3. It extracts the ...[truncated 667 chars]- Remediation
View remediation
T06 · System Persistence
Error
- Location
lib-js/poll-loop.mjs:109- Finding
Detached Polling Process Ignores the Configured Maximum Duration
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
lib-js/card-tools.mjs:548- Finding
Backend-Controlled Media URLs Permit SSRF and Unbounded Downloads
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
lib-js/card-tools.mjs:433- Finding
Writable PID State Can Cause Termination of Unrelated Processes
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
lib-js/register-discord.mjs:72- Finding
Silent Discord Command Registration Modifies Every Joined Guild
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (70)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill instructs users to submit credentials in plain chat using a message like '登录 用户名 密码', which is especially dangerous because Discord and similar chat channels may retain logs, expose messages to bot infrastructure, admins, integrations, or other unintended recipients. In this skill context, the danger is increased because the workflow normalizes sharing secrets directly with an automation agent and indicates those credentials are saved for future use.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README explicitly instructs users to send their username and password to the agent and says the login will be automatically saved, but it provides no warning about how credentials are handled, stored, transmitted, or protected. This creates a high risk of credential theft, accidental disclosure in chat logs, insecure storage, or reuse compromise if the same password is used elsewhere.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ??skill ????Discord ����㷢�??tkseller"??����"(����Ҫб??,LLM ��ʶ�����?skill ����??`trigger.mjs`��`trigger.mjs` �״�����ʱ���Զ����� `register-discord.mjs` ??`/tkselle
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Skill Ŀ¼·����ͨ�� `SKILL.md` ����λ��ȷ??��ͬϵͳ��ͬ:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ��??`/api/v1/*` �ӿڹ���ͬһ���ͻ���(`lib-js/api.mjs`),�Զ�??`Authorization: Bearer <token>` header??
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `review_1` | һ���??| video_id, video_url, author, view_count, score, summary, product_name, product_url, product_image_url | ��һ��??`send-review-1.mjs`) |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `review_1` | һ���??| video_id, video_url, author, view_count, score, summary, product_name, product_url, product_image_url | ��һ��??`send-review-1.mjs`) |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `lib-js/send-review-1-5.mjs` - ���־���??
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `lib-js/send-review-2.mjs` - ����Ƶ��??
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `lib-js/card-tools.mjs` - ��Ƭ����(��Ƭ����)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code builds a persistent hardware-bound identifier from BIOS UUID, machine ID, MAC address, and shell-derived system information, creating a durable fingerprint tied to the host. This is dangerous because it enables long-term device tracking and account binding beyond what the skill description suggests, and the shell calls increase sensitivity by directly interrogating host hardware identifiers.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module can kill local processes, delete PID/lock files, and remove cron jobs based on local state, which is a powerful host-control capability beyond simple card rendering. If this skill is triggered unexpectedly or its state files are tampered with, it could terminate unrelated processes or disrupt other scheduled automation on the host.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module downloads arbitrary remote media and then executes a Python interpreter to transform it, creating a risky boundary between untrusted network content and local code execution tooling. Even without obvious command injection, this expands attack surface to SSRF-style fetches, resource exhaustion, malicious file handling, and abuse of external dependencies like Pillow/python on the host.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This is a direct request for the user to send account credentials in chat. In a bot skill context, chat messages may be logged by the platform, the bot framework, or operators, making plain-text password solicitation a high-risk credential exposure pattern.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code repeats direct conversational credential solicitation on token failure. The repetition makes the behavior standard and trustworthy-looking to users, increasing both accidental leakage and successful phishing opportunities.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
During a confirmation workflow, the user is told to send 'account and password' separated by a space. This creates a straightforward path for secret disclosure and possible account takeover if any party with access to messages or logs can read the content.
- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.install_untrusted_source, suspicious.potential_exfiltration
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- lib-js/api.mjs:85
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- lib-js/card-tools.mjs:441
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- lib-js/trigger.mjs:235
Install source points to URL shortener or raw IP.
Warn
- Code
- suspicious.install_untrusted_source
- Location
- config.json:4
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- lib-js/api.mjs:51