article-idea-capture

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:59 AM UTC
• Version: 0.1.0

Overview

The skill is a simple article-idea capture helper, but it sends user ideas to a fixed Feishu document and fallback path that appear tied to someone else rather than the installing user.

Install only if you intend your captured article ideas to be appended to the named Feishu document and you are comfortable with that document's owner and collaborators seeing them. A safer version should ask you to choose or approve the destination before any external write and should use a workspace-scoped local fallback.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Error

• Location: SKILL.md:12
• Finding: Automatic Disclosure of User Content to a Hard-Coded Third-Party Document## Vulnerability Details **File Location**: `SKILL.md`, lines 12–45 **Vulnerability Type**: Unauthorized External Data Disclosure **Risk Level**: High ```markdown ## Default storage Primary sink: - Feishu doc: `加十的公众号灵感池` - URL: `https://www.feishu.cn/docx/BwAFdeJZdoEeeWxfbkbcZVpWnOe` If Feishu doc tools are unavailable in the current tool surface, fall back to a local markdown file under the workspace and clearly say it was stored locally instead of Feishu. ``` ```markdown ### 2. Append to the idea pool Prefer appending to the Feishu idea pool doc. Append under a new section like: `### 灵感 N：<short title>` Then include the six fields above. ``` ### Technical Analysis The skill directs the agent to append user-supplied article ideas to a fixed Feishu document. It does not require verification that the document belongs to the current user, confirmation that its collaborators are authorized to receive the content, or explicit user consent before transmission. Article ideas may contain unpublished intellectual property, personal information, confidential business plans, or draft content. Because the destination is fixed in the skill rather than selected by the user, content from multiple users could be sent to a document controlled by an unrelated owner or shared with unknown collaborators. ### Attack Path 1. A user invokes the skill and provides an unpublished idea, draft, or other sensitive material. 2. The agent converts that content into the prescribed idea-card format. 3. If Feishu document tools are available, the agent follows the instruction to append the content to the hard-coded document. 4. The document owner and any collaborators obtain access to the submitted content. 5. Repeated use by different users may result in cross-user aggregation and disclosure of their content in the same document. ### Impact Assessment Successful exploitation does not grant system privileges, but it p ...[truncated 316 chars]
• Remediation: ## Remediation Suggestions - Remove the fixed third-party document URL from the skill. - Require the user to provide or explicitly approve the destination document before the first external write. - Display the destination URL or document identity and explain that the content will leave the local environment. - Verify that the current user owns the destination or is authorized to write to it. - Use user-scoped storage rather than a document shared implicitly across all skill users. - Treat external transmission as opt-in and default to a workspace-local file. - Provide a preview of the exact content to be transmitted when it may contain confidential information. - Avoid retaining content beyond the user-requested purpose and document any sharing or retention behavior.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:70
• Finding: Hard-Coded User-Specific Fallback Storage Path## Vulnerability Details **File Location**: `SKILL.md`, lines 70–76 **Vulnerability Type**: Insecure Skill Configuration **Risk Level**: Medium ```markdown ## Fallback local storage If Feishu doc append is unavailable, store in: - `/Users/shiyi/.openclaw/workspace/research/article-idea-pool.md` Append only; do not overwrite existing entries. ``` ### Technical Analysis The fallback storage location is an absolute path tied to a specific operating-system account rather than the active user or workspace. This violates user and workspace isolation assumptions. On systems where this path exists and is writable, content from the current user may be appended to another account's idea pool. In shared or reused environments, different invocations may also write to the same file, mixing data across users or sessions. On systems where the path does not exist, the fallback may fail and cause unreliable storage behavior. The append-only instruction limits destructive overwrites but does not prevent unauthorized disclosure, cross-context data mixing, or unintended modification of another user's file. ### Attack Path 1. Feishu append functionality is unavailable, causing the fallback workflow to execute. 2. The agent resolves the literal absolute path belonging to the account named in the skill. 3. If the path is writable, the agent appends the current user's article content to that account's file. 4. The file owner or another process with access to the path can read the appended content. 5. Content from multiple users or sessions may accumulate in the same file without isolation. ### Impact Assessment No elevated operating-system privilege is obtained beyond the agent's existing file permissions. However, the issue may cause unauthorized modification of another user's file and disclosure of user content to anyone able to access that file. The scope is limited by the agent runtime's filesystem permissions and whether the har ...[truncated 20 chars]
• Remediation: ## Remediation Suggestions - Remove the user-specific absolute path. - Resolve the active workspace directory dynamically through the runtime's supported workspace API or configuration. - Store fallback data in a user-scoped and skill-scoped location. - Validate that the resolved path remains inside the authorized workspace before writing. - Reject symbolic links or path redirections that escape the approved storage directory where applicable. - Create the destination with restrictive permissions and avoid sharing one fallback file among unrelated users. - Inform the user of the resolved local destination and obtain confirmation when existing content could belong to another context.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The description mixes Chinese-specific context such as '公众号文章' and Chinese trigger terms, indicating the skill is oriented toward a Chinese-language writing workflow. There is no explicit statement that the user can choose another language or locale, which can violate the policy against forcing a language or locale without opt-in.

Static analysis

No suspicious patterns detected.