ClawHub
Back to skill

Security audit

Ai Daily Report

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its AI daily report purpose, but it automatically sends reports to Feishu and processes unescaped internet content before upload, so users should review it carefully before installing.

Install only if you intend the skill to send generated report images to Feishu, and configure FEISHU_CHAT_ID and GITHUB_TOKEN with least privilege. Avoid enabling scheduled runs until you have reviewed the destination chat, and consider fixing SVG escaping and disabling or documenting googletrans before use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_report.py:44
Finding

Unescaped Remote Content Injection into Generated SVG Reports

Content
View full analysis
• {{n.title}} {{n.source}} | {{n.date[:10]}} {% endfor %} Open-source AI project selection {% for p in projects %} • {{p.name}} ({{p.stars}}★) {{p.description}} {% endfor %} ``` ### Technical Analysis The report generator creates a Jinja2 `Template` directly without configuring XML or HTML autoescaping. Consequently, values obtained from remote RSS feeds and GitHub repository metadata are inserted into the SVG document as raw markup. The affected values include: - RSS article titles - RSS source names - RSS publication dates - GitHub repository names - GitHub repository descriptions - GitHub star values An attacker who controls a selected RSS entry or qualifying GitHub repository can place XML metacharacters and SVG elements in one of these fields. For example, a malicious title could close the current `` element and introduce additional SVG elements. This allows the attacker to alter the generated document structure rather than being limited to displayed text. The generated SVG is subsequently processed by Cair ...[truncated 2109 chars]
Remediation
View remediation
`, quotes, closing `` tags, and injected SVG elements. Verify that the generated SVG contains escaped text and remains valid XML. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (24)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

声明描述的是一个完整的“AI 资讯日报生成并发送”能力，但提供的代码片段实际只实现了其中的新闻抓取步骤：读取 RSS、按时间过滤、排序并输出 JSON。它没有生成日报正文、没有摘要整理、没有发送/通知行为，也没有触发器或调度相关实现。因此该代码与声明的整体能力存在实质性不匹配。抓取 AI 新闻本身与声明主题相关，但仅覆盖了支持性子功能，而非所宣称的主要完整功能。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

声明描述的是一个会自动生成并发送 AI 资讯日报的技能，覆盖较广的 AI 新闻/报告场景；但代码实际只是一个辅助抓取脚本，从 GitHub 搜索最近24小时活跃的高星 AI 仓库，输出少量项目元数据。它没有生成日报正文、没有发送动作、没有定时逻辑，也没有从更广泛的资讯源抓取 AI 新闻。因此其主要功能与声明相比明显更窄且缺少关键能力，属于实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

声明的核心用途是“自动生成 AI 资讯日报并发送”。该代码确实实现了日报生成的一部分：读取新闻与项目数据并输出 Markdown 和 SVG 报告，内容也符合 AI 资讯/开源 AI 项目日报主题。但它没有实现“发送”功能，例如邮件、消息推送或其他分发行为，因此与声明存在重要缺口。另外，代码会尝试使用 googletrans 翻译项目描述，这属于可能的外部服务/网络访问能力，声明中未体现。最后，代码的实际入口是命令行参数指定的两个 JSON 文件，不包含用户口令触发或定时任务逻辑，不过这点可视为片段范围限制；真正构成主要不匹配的是“只生成、不发送”以及额外的翻译能力未声明。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

声明的核心用途是“每日自动生成 AI 资讯日报并发送”。但该代码片段只负责发送阶段：读取本地 report.png，调用 feishu_doc 上传文件，再调用 message 工具向飞书聊天发送附件消息。它没有体现“生成 AI 资讯日报”所需的资讯获取、内容整理、报告生成等逻辑，因此与声明的主要功能存在实质性偏差。另外，代码使用了飞书聊天 ID、文件上传和消息发送等外部通信能力，而声明中未体现这些资源访问/发送能力。虽然“并发送”与发送行为方向一致，但当前代码块的实际主功能更准确地说是“将已有报告发送到飞书”，而不是“自动生成 AI 资讯日报并发送”。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

声明的核心用途是“生成 AI 日报并发送”，而代码块只实现了本地文件转换：检查传入的 SVG 文件是否存在，并调用 cairosvg 或系统命令 rsvg-convert 生成同名 PNG 文件。它不包含资讯抓取、内容汇总、日报生成、定时任务、消息发送等与声明直接相关的逻辑。因此这不是仅仅的辅助实现细节，而是与声明明显不同的主要功能，属于实质性不匹配。

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
OpenClaw 读取 `description`，匹配成功 → 加载 `SKILL.md`，按上述步骤执行。最终在聊天中返回一条包含 PNG 报告的消息，例如：

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares broad operational behavior including network access, shell execution, environment-variable use, and file reads/writes, but does not constrain these capabilities with an explicit tool scope. That increases the blast radius if the skill is invoked unexpectedly or later modified, because callers and reviewers cannot tell from the manifest what powerful actions are permitted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill automatically uploads generated content to Feishu, an external service, but does not present this as a clear user-facing warning in the main description. That can cause unintentional data exfiltration of collected content, generated summaries, or embedded metadata to a third party when users may assume the output stays local or in-chat.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The scheduled execution path can automatically send reports to a preset Feishu chat without an interactive confirmation step. In context, unattended outbound delivery increases the risk of silent data disclosure, accidental spam, or delivery to the wrong recipient if FEISHU_CHAT_ID is misconfigured or inherited from another environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The report content is entirely presented in Chinese, including the title and section descriptions, with no indication that the user can choose another language or locale. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The top-level documentation says the script 'falls back to simple string replace if Jinja2 not installed'. In practice, render_svg imports Template from jinja2 directly without any fallback handling, so a missing Jinja2 dependency will cause failure instead of degraded rendering.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The report headings are hard-coded in Chinese and project descriptions are translated to zh-cn, which imposes a specific language/locale. There is no opt-in, configuration, or documented justification indicating that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script sends project descriptions to an external translation service via googletrans during report generation, which creates an undisclosed outbound data flow beyond simple local formatting. Even if the text is "just project descriptions," this behavior can leak third-party or user-supplied content, introduce compliance/privacy issues, and expand the attack surface through dependency and network use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Project descriptions may be transmitted to an external translation provider without notice or consent, which is a genuine privacy and data-handling issue. In this skill context, the report generator appears intended to compile daily AI news locally, so hidden third-party disclosure is more dangerous because operators may not expect outbound transfer of content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script's human-readable comments are written only in Chinese, which imposes a single language for operator-facing instructions. There is no indication of user opt-in, alternative locale support, or documentation that the skill is intended solely for a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

Line L17 invokes a report-sending script, and the surrounding comments indicate it uses FEISHU_CHAT_ID, implying network transmission to an external chat destination. While the file has an inline dependency note, it does not provide a clear user-facing warning, confirmation step, or disclosure about sending data externally.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send_report.py (reported line 32)May include surrounding context.

python
# The OpenClaw CLI provides a subcommand `openclaw tool feishu_doc`? 
    # We can invoke via `openclaw tool feishu_doc` passing JSON via stdin.
    cmd = ['openclaw', 'tool', 'feishu_doc']
    proc = subprocess.run(cmd, input=json.dumps(payload).encode(), stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    if proc.returncode != 0:
        sys.stderr.write(f'feishu_doc error: {proc.stderr.decode()}\n')
        sys.exit(1)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends a fixed Chinese message string to users in Feishu, which enforces a specific language choice in user-facing output. There is no indication that the user can choose the language or that the skill is limited to a Chinese-language or region-specific context.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send_report.py (reported line 53)May include surrounding context.

python
}
# Using the generic message tool
cmd = ['openclaw', 'tool', 'message']
proc = subprocess.run(cmd, input=json.dumps(msg_payload).encode(), stdout=subprocess.PIPE, stderr=subprocess.PIPE)
if proc.returncode != 0:
    sys.stderr.write(f'message send error: {proc.stderr.decode()}\n')
    sys.exit(1)

Tainted flow: 'msg_payload' from os.getenv (line 45, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/send_report.py (reported line 53)May include surrounding context.

python
}
# Using the generic message tool
cmd = ['openclaw', 'tool', 'message']
proc = subprocess.run(cmd, input=json.dumps(msg_payload).encode(), stdout=subprocess.PIPE, stderr=subprocess.PIPE)
if proc.returncode != 0:
    sys.stderr.write(f'message send error: {proc.stderr.decode()}\n')
    sys.exit(1)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/svg_to_png.py (reported line 24)May include surrounding context.

python
# rsvg-convert is part of librsvg (common on Linux)
    cmd = ["rsvg-convert", "-o", str(png_path), str(svg_path)]
    try:
        subprocess.run(cmd, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE)
        return True
    except Exception as e:
        sys.stderr.write(f"rsvg-convert failed: {e}\n")

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This SVG template includes user-visible text in Chinese such as "AI 每日报告", "新闻摘要", and "开源 AI 项目精选". The file does not indicate any user opt-in, locale selection, or justification for forcing a specific language, which matches the policy-violation category for language or locale constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This file presents the report title and section headings entirely in Chinese, which indicates a fixed language choice in user-facing content. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no justification or locale constraint is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

Line L03 states that GITHUB_TOKEN and FEISHU_CHAT_ID must be present in environment variables, which indicates use of credentials or sensitive identifiers. The comment notes their existence but does not warn users about credential sensitivity, scope, or safe handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.