利润优化引擎

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:31 AM UTC
• Version: 1.0.0

Overview

This is a local order and profit tool, but its persistent order storage has a verified file overwrite weakness and under-documented payment-state actions.

Review this skill before installing. It appears to be a small local Chinese-language order/profit helper with no network behavior, but do not use it for real business records unless the file path validation and local file permissions are fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/order_manager.py:21

Finding

Arbitrary File Overwrite Through Unvalidated Persisted Order IDs

Content

View full analysis

Vulnerability Details

File Location: scripts/order_manager.py, lines 12–24 and 87–98
Vulnerability Type: Path traversal and arbitrary file overwrite
Risk Level: High

Vulnerable Code

python

def _load_all(self):
    orders = []
    for f in os.listdir(DATA_DIR):
        if f.endswith(".json"):
            with open(os.path.join(DATA_DIR, f)) as fp:
                orders.append(json.load(fp))
    return orders

def _save(self, order):
    path = os.path.join(DATA_DIR, f"{order['id']}.json")
    with open(path, "w") as f:
        json.dump(order, f, indent=2)

The untrusted persisted identifier reaches _save() through the confirmation operation:

python

elif "--confirm" in args:
    idx = args.index("--confirm")
    oid = args[idx+1] if idx+1 < len(args) else ""
    if not oid:
        print("Please specify an order ID")
        return
    found = None
    for o in mgr.orders:
        if o['id'] == oid:
            found = o
            break
    if found:
        found['status'] = 'paid'
        found['paid_at'] = datetime.now().isoformat()
        mgr._save(found)

Technical Analysis

_load_all() deserializes every JSON file in the order-data directory without validating its schema or the value of the id property. _save() then uses that persisted value directly as part of a filesystem path.

An identifier containing parent-directory components, such as ../../target, causes the resulting path to escape DATA_DIR. An absolute identifier can cause os.path.join() to discard DATA_DIR entirely. The .json suffix limits the destination filename but does not prevent writing outside the intended directory.

This is a trust-boundary violation: data loaded from mutable persistent storage is treated as a safe filename. The --confirm operation provides a reachable path from the malicious record to the unsafe write.

Attack Path

...[truncated 1189 chars]

Remediation

View remediation

Remediation Suggestions

• Validate every loaded order against a strict schema before using it.
• Require identifiers to match the generated format, for example ^[0-9a-f]{12}$.
• Do not use a persisted identifier as an unrestricted filesystem path component.
• Resolve the final destination with os.path.realpath() or pathlib.Path.resolve() and verify that its parent is exactly the expected order directory.
• Reject absolute paths, path separators, parent-directory components, and malformed identifiers.
• Consider deriving the storage path from a separately validated identifier rather than trusting the id property inside the file.
• Refuse to follow symbolic links when opening the destination.
• Use atomic writes through a securely created temporary file in DATA_DIR, followed by os.replace().
• Apply the same validation when loading, confirming, listing, and reporting orders.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/order_manager.py:7

Finding

Financial Records Are Created Without Explicit Restrictive Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/order_manager.py, lines 7–8 and 21–24
Vulnerability Type: Insecure local file permissions
Risk Level: Low

Vulnerable Code

python

DATA_DIR = os.path.expanduser("~/.openclaw/workspace/state/orders")
os.makedirs(DATA_DIR, exist_ok=True)

python

def _save(self, order):
    path = os.path.join(DATA_DIR, f"{order['id']}.json")
    with open(path, "w") as f:
        json.dump(order, f, indent=2)

Technical Analysis

The order directory and files are created without explicit restrictive modes. Their effective permissions therefore depend on the process umask and any permissions already present on parent directories.

On a system with a permissive umask or shared access to the workspace, order records may become readable or writable by other local users. These records contain customer-provided order names, descriptions, prices, costs, calculated profits, and payment status.

Existing files are also opened directly for truncating writes. There are no checks to ensure that the destination is a regular file owned by the expected user rather than a symbolic link or another unsafe filesystem object.

Attack Path

1. The Skill runs in an environment with a permissive umask or a workspace accessible to another local account.
2. The script creates the order directory or JSON files with group or world access.
3. Another local user reads financial information from the files or modifies an order record.
4. A modified record can falsify prices, costs, and payment state. It can also supply the malicious identifier needed to reach the arbitrary-file-overwrite issue described separately.

Exploitation depends on the effective filesystem permissions; a restrictive umask and private home directory may prevent this attack.

Impact Assessment

A local attacker may obtain confidentiality and integrity access to order records under permissive files ...[truncated 297 chars]

Remediation

View remediation

Remediation Suggestions

• Create DATA_DIR with mode 0700 and verify or correct the mode when the directory already exists.
• Create order files with mode 0600, using os.open() with explicit flags and permissions where necessary.
• Refuse symbolic-link destinations and validate that existing destinations are regular files owned by the expected user.
• Write updates atomically using a temporary file created inside DATA_DIR with mode 0600, flush and synchronize it as appropriate, and replace the destination with os.replace().
• Document the sensitivity of persisted order records and ensure parent workspace directories are not accessible to unrelated local users.
• Validate the ownership and permissions of the state directory during startup and fail safely when they are insecure.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises executable script-based behavior that implies file read/write capability, but it does not declare any tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: a caller or hosting framework may not be able to enforce least privilege, and users cannot assess what filesystem access the skill expects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description and the main user-facing headings/command annotations are in Chinese, which can impose a specific language on users without opt-in. The file does not state that the skill is region-specific or provide an alternative language option, so this is a natural-language policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code file contains natural-language strings such as the module description, status messages, and usage text entirely in Chinese, and it does not provide any user opt-in, alternate locale, or justification that the skill is intended only for a Chinese-speaking region. That creates a language/locale policy issue under the requirement to avoid forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.