ClawHub
Back to skill

Security audit

AI每日最新进展日报

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-news digest generator that browses public sources and saves a local Markdown report, with no evidence of hidden execution, exfiltration, or destructive behavior.

Install this if you want a Chinese daily AI/LLM digest and are comfortable with the agent browsing many public web sources and saving reports under ~/.openclaw/workspace/digests. Be aware that broad AI-news prompts may trigger it, and recurring automation requires a separate user-configured cron job.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Vague Triggers

High
Confidence
96% confidence
Finding
The skill declares extremely broad trigger phrases and even allows intent-based generalization, so ordinary requests about AI news, papers, or vendor updates may invoke the skill unexpectedly. Because the skill then performs wide web collection and writes files automatically, over-triggering can cause unanticipated network access, background work, and persistent file creation without clear user intent.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The README specifies that the skill produces '一份中文 Markdown 简报', which mandates Chinese output as the default behavior. This is a natural-language locale constraint with no indication that the user can choose another language or opt in to Chinese specifically.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs the agent to save output directly under the user's home workspace path and create directories if needed, but does not require explicit user consent at execution time. Persistent writes are security-relevant because they can fill storage, leave unexpected artifacts, or create privacy/compliance issues when automated summaries are stored by default.

Natural-Language Policy Violations

Medium
Confidence
98% confidence
Finding
L003 明确写明“生成一份…中文资讯简报”，正文 L008、L022、L198 也持续要求“中文撰写”。这构成固定语言/locale 约束，但文档未说明可根据用户偏好切换语言，也未提供用户选择机制。

Session Persistence

Medium
Category
Rogue Agent
Content
- **主文件**：`~/.openclaw/workspace/digests/YYYY-MM-DD.md`
- **同日重跑**：追加后缀 `-v2`、`-v3` 不覆盖。
- **目录不存在时**：先 `mkdir -p`。
- **索引**（可选功能）：生成完毕后更新 `~/.openclaw/workspace/digests/INDEX.md`，追加一行到开头 `- YYYY-MM-DD: [链接到今日文件] — 今日要闻第 1 条标题` 作为导航。

## Cron 定时任务配置（用户侧）
Confidence
87% confidence
Finding
The skill intentionally creates persistent artifacts (`digests/*.md` and optionally `INDEX.md`) across runs, which means data accumulates in session-adjacent workspace storage. In context this is not stealthy exfiltration, but it is a real persistence behavior that can retain browsing-derived content and metadata over time, especially when coupled with scheduled cron execution.

Session Persistence

Medium
Category
Rogue Agent
Content
- **主文件**:`~/.openclaw/workspace/digests/YYYY-MM-DD.md`
- **同日重跑**:追加后缀 `-v2`、`-v3` 不覆盖。
- **目录不存在时**:先 `mkdir -p`。
- **索引**(可选功能):生成完毕后更新 `~/.openclaw/workspace/digests/INDEX.md`,追加一行到开头 `- YYYY-MM-DD: [链接到今日文件] — 今日要闻第 1 条标题` 作为导航。

## Cron 定时任务配置(用户侧)
Confidence
87% confidence
Finding
The skill intentionally creates persistent artifacts (`digests/*.md` and optionally `INDEX.md`) across runs, which means data accumulates in session-adjacent workspace storage. In context this is not stealthy exfiltration, but it is a real persistence behavior that can retain browsing-derived content and metadata over time, especially when coupled with scheduled cron execution.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The README states that the agent will generate and save a file at `~/.openclaw/workspace/digests/YYYY-MM-DD.md`, but it does not present this behavior as a user warning or callout about modifying local data. For a markdown skill description, file creation affecting the user's filesystem should be explicitly disclosed as a behavior that impacts user data or system state.

Static analysis

No suspicious patterns detected.