ClawHub
Back to skill

Security audit

花粉过敏指数权威发布

Security checks across malware telemetry and agentic risk

Overview

The skill mostly does what it says, but one helper script can forcibly close unrelated Chrome browser processes on the machine.

Install only if you want scheduled WeCom pollen alerts. Use a dedicated low-impact WeCom bot key, keep ~/.openclaw/config/wecom.env private with owner-only permissions, and avoid running the v3/v4 push helpers on a shared or active machine unless the browser cleanup is narrowed to processes started by this skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The cleanup logic uses broad process-kill patterns, including `pkill -9 -f 'chrome'`, which can terminate unrelated Chrome/browser processes on the host. In an agent skill that should only fetch weather/pollen data, indiscriminately killing user or system browser processes is overbroad and can disrupt other sessions, cause data loss, and create denial-of-service conditions for unrelated workloads.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The scheduled push workflow persistently writes a local log containing execution times, delivery status, weather data, pollen data, and exception details, but the skill does not prominently warn that this creates an accumulating local activity record. Such logs can reveal user routines, target identifiers, operational metadata, and possibly sensitive failure details if accessed by other local processes or users.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The script forcibly kills all matching browser processes without any warning or consent, which is unsafe for multi-tenant or user-interactive environments. Even if intended as cleanup, this behavior can interrupt unrelated work and compound the denial-of-service risk because the target pattern is broader than the skill's operational need.

Credential Access

High
Category
Privilege Escalation
Content
export AGENT_BROWSER_SESSION="pollen-push-$(date +%Y%m%d)"

# ============ 配置加载 ============
CONFIG_FILE="$HOME/.openclaw/config/wecom.env"
if [ -f "$CONFIG_FILE" ]; then
    source "$CONFIG_FILE"
else
Confidence
90% confidence
Finding
The script executes `source "$HOME/.openclaw/config/wecom.env"`, which treats the config file as shell code rather than inert data. If an attacker can modify that file or influence its contents, arbitrary commands will run with the script's privileges, making this a real code-execution risk rather than mere credential loading.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.