Security audit

TKSeller

Security checks for vulnerabilities and agentic risk

Overview

This TKSeller automation skill is purpose-related, but it handles passwords, tokens, OpenClaw gateway access, and background message injection in ways users should review carefully before installing.

Install only if you fully trust the publisher and are comfortable giving it your TKSeller password, persistent local token storage, access to OpenClaw gateway/channel configuration, and a background polling process. Prefer not to use valuable account credentials until the skill supports HTTPS, a safer login flow, scoped gateway permissions, protected token storage, and explicit controls for starting and stopping background polling.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Agent Execution and Output Hijacking Through Mandatory Skill Instructions
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: lib-js/poll-loop.mjs:192
Finding: Remote SaaS Event Content Injected Into New Agent Turns
Content: View full analysis
30) { try { unlinkSync(PENDING_OUTPUT_PATH); } catch { /* */ } _log(`pending output expired (${ageMin.toFixed(0)}min old), discarded`); } else { backlog = readFileSync(PENDING_OUTPUT_PATH, 'utf-8').trim(); } } } catch { /* */ } const payload = [backlog, fresh] .filter(s => s && s.trim()) .join('\n\n'); if (payload) { let sent = false; const st = pollStateLoad(); const key = st.sessionKey || 'agent:main:main'; if (key) { try { const forwardMsg = '[tkseller_forward]\n---\n' + payload + '\n---'; const res = await fetch(GATEWAY_URL, { method: 'POST', headers: { 'Authorization': `Bearer ${_gatewayToken()}`, 'Content-Type': 'application/json' }, body: JSON.stringify({ tool: 'cron', args: { action: 'wake', text: forwardMsg, mode: 'now' } }), signal: AbortSignal.timeout(10000) }); ``` Backend-controlled fields are placed into this buffer without output sanitization. Examples from `lib-js/poll-events.mjs:45-132` include: ```javascript const payload = event.payload || data; const name = payload.name || '数字人'; const description = payload.description || ''; const text = `✅ **数字人生成完成！**\n\n` + `**名称：** ${name}\n` + `**描述：** ${description}`; ``` ```javascript const rawMsg = (data.message || data.error || '').trim(); const msg = rawMsg || '未知错误'; await ct.sendText(`⚠️ 流程异常（${etype}） ...[truncated 1919 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: config.json:2
Finding: Credentials, Bearer Tokens, and Persistent Device Identity Transmitted Over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: lib-js/api.mjs:58
Finding: Bearer Token and Identity Metadata Stored in a Plaintext File Without Restrictive Permissions
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: lib-js/card-tools.mjs:1015
Finding: Indefinite Detached Polling Process With Automatic Respawn
Content: View full analysis
startFingerprint) { _log( `code updated (fingerprint ${startFingerprint} -> ` + `${nowFingerprint}), restarting to load new version` ); try { _clearPid(); _releaseLock(); const child = spawn( process.execPath, [join(__dirname, 'poll-loop.mjs')], { cwd: dirname(__dirname), stdio: 'ignore', detached: true, windowsHide: tru ...[truncated 1954 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: lib-js/card-tools.mjs:59
Finding: Global OpenClaw Secrets and Session Metadata Access Exceeds Least Privilege
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (79)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The README instructs users to send usernames and passwords directly in chat, which is unsafe because chat channels, bots, logs, screenshots, and moderators may expose credentials. The documented flow normalizes credential collection through an insecure medium without any warning, making account compromise significantly more likely.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The README not only asks for credentials in plain chat but also says they are automatically saved for reuse, implying storage of highly sensitive secrets. In the context of a Discord/webchat-integrated skill, this is especially dangerous because credentials may be retained in message history, bot logs, backend storage, or operator-visible systems, magnifying compromise risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to execute immediately with no preamble, while the workflow performs sensitive operations including login processing, API requests, persistent token storage, and cron job registration. This removes transparency and informed consent at exactly the point where the user should be warned about side effects and data handling.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.
md
??skill ????Discord ��㷢�??tkseller"??��"(��Ҫб??,LLM ��ʶ��?skill ��??`trigger.mjs`��`trigger.mjs` �״��ʱ��Զ�� `register-discord.mjs` ??`/tkselle

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.
md
??skill ????Discord ��㷢�??tkseller"??��"(��Ҫб??,LLM ��ʶ��?skill ��??`trigger.mjs`��`trigger.mjs` �״��ʱ��Զ�� `register-discord.mjs` ??`/tkselle

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 266)May include surrounding context.
md
??skill ????Discord ��㷢�??tkseller"??��"(��Ҫб??,LLM ��ʶ��?skill ��??`trigger.mjs`��`trigger.mjs` �״��ʱ��Զ�� `register-discord.mjs` ??`/tkselle

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.
md
??skill ????Discord ��㷢�??tkseller"??��"(��Ҫб??,LLM ��ʶ��?skill ��??`trigger.mjs`��`trigger.mjs` �״��ʱ��Զ�� `register-discord.mjs` ??`/tkselle

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 390)May include surrounding context.
md
??skill ????Discord ��㷢�??tkseller"??��"(��Ҫб??,LLM ��ʶ��?skill ��??`trigger.mjs`��`trigger.mjs` �״��ʱ��Զ�� `register-discord.mjs` ??`/tkselle

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 492)May include surrounding context.
md
??skill ????Discord ��㷢�??tkseller"??��"(��Ҫб??,LLM ��ʶ��?skill ��??`trigger.mjs`��`trigger.mjs` �״��ʱ��Զ�� `register-discord.mjs` ??`/tkselle

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 493)May include surrounding context.
md
??skill ????Discord ��㷢�??tkseller"??��"(��Ҫб??,LLM ��ʶ��?skill ��??`trigger.mjs`��`trigger.mjs` �״��ʱ��Զ�� `register-discord.mjs` ??`/tkselle

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 512)May include surrounding context.
md
??skill ????Discord ��㷢�??tkseller"??��"(��Ҫб??,LLM ��ʶ��?skill ��??`trigger.mjs`��`trigger.mjs` �״��ʱ��Զ�� `register-discord.mjs` ??`/tkselle

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 647)May include surrounding context.
md
??skill ????Discord ��㷢�??tkseller"??��"(��Ҫб??,LLM ��ʶ��?skill ��??`trigger.mjs`��`trigger.mjs` �״��ʱ��Զ�� `register-discord.mjs` ??`/tkselle

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 648)May include surrounding context.
md
??skill ????Discord ��㷢�??tkseller"??��"(��Ҫб??,LLM ��ʶ��?skill ��??`trigger.mjs`��`trigger.mjs` �״��ʱ��Զ�� `register-discord.mjs` ??`/tkselle

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 275)May include surrounding context.
md
Skill Ŀ¼·��ͨ�� `SKILL.md` ��λ��ȷ??��ͬϵͳ��ͬ:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.
md
��??`/api/v1/*` �ӿڹ��ͬһ��ͻ��(`lib-js/api.mjs`),�Զ�??`Authorization: Bearer <token>` header??

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 346)May include surrounding context.
md
| `review_1` | һ��??| video_id, video_url, author, view_count, score, summary, product_name, product_url, product_image_url | ��һ��??`send-review-1.mjs`) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 378)May include surrounding context.
md
| `review_1` | һ��??| video_id, video_url, author, view_count, score, summary, product_name, product_url, product_image_url | ��һ��??`send-review-1.mjs`) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 363)May include surrounding context.
md
exec: node ./lib-js/poll-events.mjs

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 404)May include surrounding context.
md
exec: node ./lib-js/poll-events.mjs

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 426)May include surrounding context.
md
exec: node ./lib-js/poll-events.mjs

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 443)May include surrounding context.
md
exec: node ./lib-js/poll-events.mjs

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 551)May include surrounding context.
md
exec: node ./lib-js/poll-events.mjs

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 379)May include surrounding context.
md
- `lib-js/send-review-1-5.mjs` - ��־��??

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 380)May include surrounding context.
md
- `lib-js/send-review-2.mjs` - ��Ƶ��??

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 382)May include surrounding context.
md
- `lib-js/card-tools.mjs` - ��Ƭ��(��Ƭ��)

Static analysis

Detected: suspicious.dangerous_exec, suspicious.install_untrusted_source, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib-js/api.mjs:85

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib-js/card-tools.mjs:477

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib-js/poll-loop.mjs:153

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib-js/trigger.mjs:272

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: config.json:4

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: lib-js/api.mjs:51