Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its document-checking purpose, but it needs Review because an optional secret provider can run local commands while exposing the full process environment.
Install only if you trust the publisher and can control configuration. Prefer env or file SecretRef providers, avoid exec providers unless the command is administrator-approved and receives an explicit minimal passEnv allowlist, use private or local AI/OCR endpoints for sensitive documents, and treat visual results as advisory when targets contain unusual instructions.
src/compliance_checker/infrastructure/config/secret_ref.py:217Exec SecretRef Providers Inherit the Entire Process Environment by Default
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
复制示例配置并修改：
cp .env.example .env
必需配置：
If the actual core behavior involves text or filename semantic matching backed by external embedding/LLM APIs, but the skill is marketed as document compliance review, users may unknowingly exfiltrate sensitive names or contents while receiving weaker assurance than expected. This is both a privacy and integrity risk in regulated workflows.
If the actual core behavior involves text or filename semantic matching backed by external embedding/LLM APIs, but the skill is marketed as document compliance review, users may unknowingly exfiltrate sensitive names or contents while receiving weaker assurance than expected. This is both a privacy and integrity risk in regulated workflows.
If the actual core behavior involves text or filename semantic matching backed by external embedding/LLM APIs, but the skill is marketed as document compliance review, users may unknowingly exfiltrate sensitive names or contents while receiving weaker assurance than expected. This is both a privacy and integrity risk in regulated workflows.
If the actual core behavior involves text or filename semantic matching backed by external embedding/LLM APIs, but the skill is marketed as document compliance review, users may unknowingly exfiltrate sensitive names or contents while receiving weaker assurance than expected. This is both a privacy and integrity risk in regulated workflows.
If the actual core behavior involves text or filename semantic matching backed by external embedding/LLM APIs, but the skill is marketed as document compliance review, users may unknowingly exfiltrate sensitive names or contents while receiving weaker assurance than expected. This is both a privacy and integrity risk in regulated workflows.
If the actual core behavior involves text or filename semantic matching backed by external embedding/LLM APIs, but the skill is marketed as document compliance review, users may unknowingly exfiltrate sensitive names or contents while receiving weaker assurance than expected. This is both a privacy and integrity risk in regulated workflows.
If the actual core behavior involves text or filename semantic matching backed by external embedding/LLM APIs, but the skill is marketed as document compliance review, users may unknowingly exfiltrate sensitive names or contents while receiving weaker assurance than expected. This is both a privacy and integrity risk in regulated workflows.
If the actual core behavior involves text or filename semantic matching backed by external embedding/LLM APIs, but the skill is marketed as document compliance review, users may unknowingly exfiltrate sensitive names or contents while receiving weaker assurance than expected. This is both a privacy and integrity risk in regulated workflows.
If the actual core behavior involves text or filename semantic matching backed by external embedding/LLM APIs, but the skill is marketed as document compliance review, users may unknowingly exfiltrate sensitive names or contents while receiving weaker assurance than expected. This is both a privacy and integrity risk in regulated workflows.
If the actual core behavior involves text or filename semantic matching backed by external embedding/LLM APIs, but the skill is marketed as document compliance review, users may unknowingly exfiltrate sensitive names or contents while receiving weaker assurance than expected. This is both a privacy and integrity risk in regulated workflows.
If the actual core behavior involves text or filename semantic matching backed by external embedding/LLM APIs, but the skill is marketed as document compliance review, users may unknowingly exfiltrate sensitive names or contents while receiving weaker assurance than expected. This is both a privacy and integrity risk in regulated workflows.
If the actual core behavior involves text or filename semantic matching backed by external embedding/LLM APIs, but the skill is marketed as document compliance review, users may unknowingly exfiltrate sensitive names or contents while receiving weaker assurance than expected. This is both a privacy and integrity risk in regulated workflows.
If the actual core behavior involves text or filename semantic matching backed by external embedding/LLM APIs, but the skill is marketed as document compliance review, users may unknowingly exfiltrate sensitive names or contents while receiving weaker assurance than expected. This is both a privacy and integrity risk in regulated workflows.
If the actual core behavior involves text or filename semantic matching backed by external embedding/LLM APIs, but the skill is marketed as document compliance review, users may unknowingly exfiltrate sensitive names or contents while receiving weaker assurance than expected. This is both a privacy and integrity risk in regulated workflows.
If the actual core behavior involves text or filename semantic matching backed by external embedding/LLM APIs, but the skill is marketed as document compliance review, users may unknowingly exfiltrate sensitive names or contents while receiving weaker assurance than expected. This is both a privacy and integrity risk in regulated workflows.
If the actual core behavior involves text or filename semantic matching backed by external embedding/LLM APIs, but the skill is marketed as document compliance review, users may unknowingly exfiltrate sensitive names or contents while receiving weaker assurance than expected. This is both a privacy and integrity risk in regulated workflows.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
此函数保留用于向后兼容，但不再执行任何操作。
环境变量现在由调用方（如 OpenClaw 框架）在进程启动时注入，
而非从 .env 文件加载。
这样设计的好处：
1. 敏感信息（API Key）不会落地到硬盘
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
此函数保留用于向后兼容，但不再执行任何操作。
环境变量现在由调用方（如 OpenClaw 框架）在进程启动时注入，
而非从 .env 文件加载。
这样设计的好处：
1. 敏感信息（API Key）不会落地到硬盘
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
此函数保留用于向后兼容，但不再执行任何操作。
环境变量现在由调用方（如 OpenClaw 框架）在进程启动时注入，
而非从 .env 文件加载。
这样设计的好处：
1. 敏感信息（API Key）不会落地到硬盘
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
此函数保留用于向后兼容，但不再执行任何操作。
环境变量现在由调用方（如 OpenClaw 框架）在进程启动时注入，
而非从 .env 文件加载。
这样设计的好处：
1. 敏感信息（API Key）不会落地到硬盘
User-controlled target text is interpolated directly into the multimodal prompt, so an attacker can supply natural-language instructions disguised as a target and influence the model's behavior instead of merely specifying an object to detect. In this compliance context, that can cause false attestations such as claiming a seal/signature exists, skipping scrutiny, or returning manipulated reasoning, undermining document-review integrity.
The prompt builders accept unrestricted natural-language target phrases and embed them into imperative prompts, allowing paraphrased attack text to be smuggled in as a supposed detection target. Because the skill is used for compliance checks on potentially important legal/financial documents, prompt injection can directly corrupt trust decisions and produce unsafe false positives or false negatives.
The module supports external command execution for secret retrieval, which is not justified by the advertised document-compliance functionality and materially expands the skill's power. In skill ecosystems, unnecessary execution features are dangerous because they can be repurposed for host inspection, persistence, or secret exfiltration if configuration is influenced by a malicious package, operator mistake, or downstream prompt/tool chain.
The code copies the full process environment before optionally filtering it, which means all ambient secrets are loaded into memory for the exec path and may be forwarded if passEnv is absent or misconfigured. In combination with external command execution, this increases the blast radius because helper processes can inherit sensitive credentials unrelated to this skill’s purpose.
timeout = provider_config.get("timeout", 30)
# 构建环境变量
env = os.environ.copy()
if pass_env:
env = {k: v for k, v in env.items() if k in pass_env}
No suspicious patterns detected.