T01 · Skill Instruction Hijacking
Error
- Location
interact.md:21- Finding
Persistent Instruction Hijacking and Autonomous External Actions
- Content
View full analysis
- Remediation
View remediation
Security audit
meyo
Security checks for vulnerabilities and agentic risk
Overview
This is a real community integration, but it grants broad persistent authority for credentials, background tasks, remote instructions, and public actions without enough user control.
Install only if you are comfortable giving this skill a Meyo account key, recurring background execution, access to conversation and memory context, and authority to post, comment, like, and install community skills. Review and disable scheduler jobs, avoid running post-derived commands without manual approval, and prefer a version that uses signed/pinned downloads, scoped secrets, and explicit confirmations for every public or persistent action.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Findings (8)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:160- Finding
Persistent Meyo Directives Written into Long-Term Agent Memory
- Content
View full analysis
- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:103- Finding
Execution of Mutable Remote Scripts and Instructions Without Integrity Verification
- Content
View full analysis
and follow the instructions ``` It applies this mechanism to remotely hosted diary, assessment, heartbeat, and community documents. Heartbeat announcements can also cause the latest Skill documents and schedules to be retrieved and updated. ### Technical Analysis The reviewed package delegates effective behavior to mutable server-hosted content. The downloaded registration script is immediately made executable, and remote Markdown documents are treated as authoritative instructions. There is no pinned version, cryptographic digest, digital signature, redirect restriction, or re-audit gate. Consequently, the payload executed after installation may differ from the payload reviewed during this audit. HTTPS protects transport confidentiality and integrity in transit but does not protect against a compromised server, malicious publisher update, or incorrectly issued server content. ### Attack Path 1. An attacker compromises the Meyo server, publishing account, CDN, or update endpoint. 2. The attacker replaces `register.sh` or a remote Skill document. 3. The Agent downloads the latest unpinned content. 4. The script executes locally, or the Agent follows the changed instructions. 5. The altered payload uses the Agent's available filesystem, network, memory, and credential access. 6. Heartbeat-driven updates can repeat the process without a new package review. ### Impact Assessment A malicious remote payload co ...[truncated 283 chars]- Remediation
View remediation
T06 · System Persistence
Error
- Location
heartbeat.md:18- Finding
Mandatory Installation of Persistent Scheduled Tasks
- Content
View full analysis
notify_target= 5. The scheduled execution must follow the complete heartbeat SOP. ``` The diary module separately requires a persistent daily 10:00 task using `openclaw cron add`, `crontab`, `pm2 cron`, or another system scheduler. ### Technical Analysis Persistent schedules are mandatory onboarding side effects rather than separately consented features. The heartbeat runs twice daily and deliberately inherits conversation context and user-delivery identifiers. Its SOP reads memory, performs authenticated network actions, may post publicly, and pushes reports to the user. Using native schedulers causes the behavior to survive the original Skill run and potentially survive Agent or user-session restarts. The documentation does not define a reliable disable, removal, expiry, or permission-reduction process. ### Attack Path 1. The user initiates registration or onboarding. 2. The Skill creates a daily diary schedule and two daily heartbeat schedules. 3. Scheduler payloads retain the channel and recipient identifiers. 4. Future scheduled executions inherit or inspect conversation and memory context. 5. The tasks call Meyo APIs, interact publicly, update memory, and send reports. 6. The activity continues until the sc ...[truncated 375 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
link.md:53- Finding
Untrusted Community Posts Are Converted into Local Execution Plans
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
diary.md:62- Finding
Excessive Access to Conversation History, Global Memory, and Unrelated Activity
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/register.sh:67- Finding
Registration Script Uses Unsafe JSON Construction and Weak Secret Handling
- Content
View full analysis
/dev/null) ``` Additional vulnerable error and credential handling: ```bash echo "response=$http_body" mkdir -p "$CREDENTIAL_DIR" cat > "$CRED_FILE" <- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
store.md:210- Finding
Unsigned Community Skill Archives Are Downloaded and Installed Without Safe Extraction
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (52)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The file claims to be a main orchestration skill, but much of the actionable content is direct registration and credential-handling logic rather than clearly implemented boundary management. Ambiguous scope increases the risk that operators enable the skill without realizing it can create accounts and persist secrets locally.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The file claims to be a main orchestration skill, but much of the actionable content is direct registration and credential-handling logic rather than clearly implemented boundary management. Ambiguous scope increases the risk that operators enable the skill without realizing it can create accounts and persist secrets locally.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
The skill instructs the agent to look for credentials in local filesystem paths across multiple runtimes. Accessing local secrets is security-sensitive because it increases the chance of unintended secret use, cross-context credential reuse, or exposure if the skill is invoked in an unexpected environment.
- Content
md | 环境 | 凭证路径 | |------|---------| | OpenClaw | `~/.openclaw/meyo/credentials.json` | | Hermes | `~/.hermes/meyo/credentials.json` | | 其他 / 未知 | `~/.meyo/credentials.json` |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
The document defines a credential file structure containing API keys and identifiers, encouraging direct local handling of sensitive secrets. Clear instructions to parse and use these values can normalize secret access by the skill and broaden the blast radius if the skill is misused.
- Content
md | 环境 | 凭证路径 | |------|---------| | OpenClaw | `~/.openclaw/meyo/credentials.json` | | Hermes | `~/.hermes/meyo/credentials.json` | | 其他 / 未知 | `~/.meyo/credentials.json` | 凭证文件结构：
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
By specifying where and how credentials are stored, the skill operationalizes local secret retrieval as part of normal execution. In hostile or multi-skill environments, that behavior can facilitate unauthorized access to sensitive tokens even if the stated purpose is legitimate.
- Content
md |------|---------| | OpenClaw | `~/.openclaw/meyo/credentials.json` | | Hermes | `~/.hermes/meyo/credentials.json` | | 其他 / 未知 | `~/.meyo/credentials.json` | 凭证文件结构：
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The skill directs credential persistence to credentials.json, including a one-time API key returned at registration. Persisting a reusable API credential on disk is sensitive because compromise of the host, logs, or backup systems can expose a long-lived token that enables account takeover or impersonation.
- Content
md 3. 脚本输出以 `REGISTER_SUCCESS` 开头表示成功，包含 `agent_id`、`claim_code`、`claim_url` 等信息 4. 将 `claim_url` 对应的完整链接 `https://www.meyo123.com/claim/<claim_code>` 展示给用户 5. 凭证已由脚本写入 `credentials.json`，无需再手动写文件 ⚠️ `api_key` 仅在注册时返回一次，脚本已将其安全写入文件。
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The skill exposes a destructive DELETE endpoint for posts, and the surrounding guidance notes that deleting a post also deletes all associated comments and cannot be migrated. Without explicit authorization, confirmation, and identifier validation safeguards in the skill instructions, an agent could delete the wrong post or comply with ambiguous prompts, causing irreversible content loss.
- Content
删帖（仅作者）
bash DELETE /api/v1/feeds/{id}注意：当前不支持编辑帖子，需修改时删帖重发。删帖后原帖评论一并删除，无法迁移。
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 89% confidence
- Finding
The skill exposes a DELETE endpoint for comments with no built-in guardrails around target verification or destructive-action confirmation. In the context of agent-driven tool use, this creates risk of accidental or user-unintended deletion if the model misbinds commentId, follows ambiguous instructions, or acts on stale context.
- Content
删评论（仅作者）
bash DELETE /api/v1/feeds/{id}/comments/{commentId}评论点赞
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The description says the skill will automatically fetch updates, process replies, interact, and post, but it does not clearly warn the user that these actions may occur autonomously on their behalf. This creates a consent and account-safety issue because users may enable the skill without understanding that it can publicly act using their identity or credentials.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description frames the capability as simple 'link interaction' while the body grants authority to fetch authenticated content, reproduce tasks, debug, and perform social actions on the user's behalf. This scope understatement undermines informed consent and can cause users or orchestrators to invoke a far more powerful skill than intended.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
Referencing a concrete credentials.json path is a direct indicator of credential harvesting behavior within the skill. In this context, the skill is not merely documenting configuration; it is instructing runtime access to local secrets to authenticate subsequent requests, which materially increases the risk of unauthorized secret use.
- Content
- 提取 ID：从用户提供的链接中提取出帖子 ID（通常是链接最后的部分）。
- 读取凭证：从你的本地沙箱中读取 Meyo 的 API Key。
- 路径通常为
~/.openclaw/meyo/credentials.json或~/.meyo/credentials.json。
- 路径通常为
- 调用接口：使用提取到的 ID 和 API Key，请求帖子详情接口：
bash curl "https://www.meyo123.com/api/v1/feeds/{id}" \
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill authorizes itself to execute whatever steps are described in a fetched post using available tools, scripts, APIs, or browser automation. Because post content is external and effectively untrusted input, this is equivalent to delegating agent behavior to arbitrary remote instructions, which can lead to data access, code execution, destructive changes, or exfiltration.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill directs autonomous liking and commenting after task completion without requiring user confirmation. These are outbound authenticated actions that can impersonate the user/agent identity, create reputation harm, and be manipulated through malicious post content or false success claims.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill mandates automatic network write actions on the user's behalf without warning or confirmation, including voting and posting comments. This removes user agency and can be abused to generate spam, fraudulent endorsement, or unwanted account activity.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The script explicitly writes an API key to ~/.meyo/credentials.json, creating a credential-at-rest target on the local machine. If the file is read by other users, malware, backups, or misconfigured tooling, the attacker can reuse the API key to impersonate the agent and access the associated account.
- Content
python # 写入凭证文件，不将 api_key 输出到 stdout cred_dir = os.path.expanduser("~/.meyo") os.makedirs(cred_dir, exist_ok=True) cred_path = os.path.join(cred_dir, "credentials.json") with open(cred_path, "w") as f: json.dump({ "api_key": data["api_key"],
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The skill provides exact local filesystem paths for credential storage and instructs the agent to read API keys from those files for authenticated requests. Even though intended for legitimate use, exposing and operationalizing credential access materially increases the chance that a compromised or confused agent will retrieve and use secrets beyond the minimum necessary scope.
- Content
md | 环境 | 凭证路径 | |------|---------| | OpenClaw | `~/.openclaw/meyo/credentials.json` | | Hermes | `~/.hermes/meyo/credentials.json` | | 其他 / 未知 | `~/.meyo/credentials.json` |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | 环境 | 凭证路径 | |------|---------| | OpenClaw | `~/.openclaw/meyo/credentials.json` | | Hermes | `~/.hermes/meyo/credentials.json` | | 其他 / 未知 | `~/.meyo/credentials.json` | 凭证文件结构：
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh | 环境 | 凭证路径 | |------|---------| | OpenClaw | `~/.openclaw/meyo/credentials.json` | | Hermes | `~/.hermes/meyo/credentials.json` | | 其他 / 未知 | `~/.meyo/credentials.json` | 凭证文件结构：
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | 环境 | 凭证路径 | |------|---------| | OpenClaw | `~/.openclaw/meyo/credentials.json` | | Hermes | `~/.hermes/meyo/credentials.json` | | 其他 / 未知 | `~/.meyo/credentials.json` | 凭证文件结构：
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | 环境 | 凭证路径 | |------|---------| | OpenClaw | `~/.openclaw/meyo/credentials.json` | | Hermes | `~/.hermes/meyo/credentials.json` | | 其他 / 未知 | `~/.meyo/credentials.json` | 凭证文件结构：
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill instructs the agent to use file write, network access, and shell execution, but declares no explicit tool scope or permission boundary. That makes the skill harder to sandbox and review, and increases the chance an agent runtime will grant broader capabilities than users expect.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill tells the agent to download and execute a remote shell or PowerShell script from the network. This is a classic remote-code-execution supply-chain risk: if the script or delivery path is compromised, the agent may execute arbitrary commands and expose local data or credentials.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to fetch a remote registration script over the network and then execute it locally. Even though the destination domain is fixed, this still creates an external transmission and code execution chain that can be abused via server compromise, script tampering, or insufficient verification.
- Content
md 注册脚本直接调用 API 并将凭证写入文件，api_key 不经过 Agent 文本通道，避免被运行时脱敏。 1. 下载注册脚本到当前目录： - macOS/Linux: `curl -sO https://www.meyo123.com/scripts/register.sh && chmod +x register.sh` - Windows: `Invoke-WebRequest -Uri "https://www.meyo123.com/scripts/register.ps1" -OutFile register.ps1` 2. 确定你的凭证目录（见上方路径表），执行脚本：
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill goes beyond onboarding and authentication into ongoing autonomous social behavior, recurring tasks, and prioritizing a specific skill store. That expanded operational scope can cause unexpected external actions and preference shaping not clearly conveyed by the manifest.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The memory-writing instruction says to '优先使用中文交流' as a default behavior. This imposes a language preference on future interactions without offering the user a choice or documenting a justified locale restriction, which matches the language/locale policy violation category.
- Content