全闭环管道

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:30 AM UTC
• Version: 1.0.0

Overview

The skill is not clearly malicious, but it broadly launches other local OpenClaw skills through shell commands with weak scoping and overstates some automation features.

Review this before installing. Use it only if you trust the referenced local skills in ~/.openclaw/workspace/skills and are comfortable with this pipeline launching them. Prefer a revised version that uses argument-list subprocess calls, validates exact script paths, documents required permissions, and removes or implements the advertised scheduling and self-healing claims.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill claims a fully automated closed-loop pipeline with scheduling, self-healing, and specific components, but the described behavior does not implement those controls and also exposes an undeclared status/log inspection path. This mismatch is dangerous because users may trust the skill to operate safely and comprehensively when critical safeguards are absent, and the undocumented inspection feature may expose operational data beyond what was disclosed.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

This is a true tool-parameter abuse issue because shell=True causes the shell to parse the command string, expanding metacharacters and allowing command chaining if any part of cmd ever becomes influenced by external data. In this skill context, the orchestrator runs multiple downstream scripts from ~/.openclaw/workspace/skills, increasing the blast radius: compromise of one component or path can lead to arbitrary command execution across the automated pipeline.

Content

Scanner excerpt · scripts/run_pipeline.py (reported line 22)May include surrounding context.

python

def run_step(name, cmd, timeout=30):
    print(f"  ▶ [{name}]  执行中...", end=" ", flush=True)
    try:
        r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
        status = "✅" if r.returncode == 0 else "⚠️"
        output = r.stdout[:200] + (r.stderr[:100] if r.stderr else "")
        print(f"{status} (code={r.returncode})")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises executable commands with file read, file write, and shell-like capabilities but does not declare any tool scope, permissions, or allowed-tools boundary. In an automation pipeline that chains multiple stages, this increases the risk of over-privileged execution, unintended file modification, and opaque command use because operators cannot tell what the skill is authorized to access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest description and title are written in Chinese and present the skill as a general-purpose automation pipeline, but there is no indication that the language choice is optional or that the skill is intended only for a Chinese-speaking or region-specific context. This creates a natural-language policy concern because the skill appears to impose a specific language/locale without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language strings that present the skill as Chinese-only, including the module docstring and later console messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 92% confidence

Finding

The code executes shell commands via subprocess.run(..., shell=True), which is dangerous because it routes execution through a shell and enables shell metacharacter interpretation. Although the current commands come from a hardcoded dictionary, this pipeline is explicitly designed to chain multiple other skills from a writable workspace path, so any tampering with those target paths, environment, or future command composition could turn this into command injection or unintended command execution.

Content

Scanner excerpt · scripts/run_pipeline.py (reported line 22)May include surrounding context.

python

def run_step(name, cmd, timeout=30):
    print(f"  ▶ [{name}]  执行中...", end=" ", flush=True)
    try:
        r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
        status = "✅" if r.returncode == 0 else "⚠️"
        output = r.stdout[:200] + (r.stderr[:100] if r.stderr else "")
        print(f"{status} (code={r.returncode})")