Today Task For Xiaoyi Claw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:53 AM UTC
• Version: 1.0.26

Overview

The skill is a real task-result pusher, but it exposes personal API credentials in output/logs and its documented privacy controls do not match the code.

Install only if you are comfortable sending task names, content, results, timestamps, UID, and authenticated requests to the fixed Huawei endpoint. Avoid sensitive task content, restrict access to the credential file and generated logs/records, and rotate credentials if this version has already run because it may have printed or logged them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/hiboards_client.py:102

Finding

Authentication Credentials Exposed Through Console and Debug Output

Content

View full analysis

Vulnerability Details

File Location: scripts/hiboards_client.py:102-106, scripts/hiboards_client.py:117-121, and scripts/hiboards_client.py:136
Vulnerability Type: Sensitive information exposure through output and logging
Risk Level: High

Vulnerable Code

python

required_keys = ['PERSONAL-API-KEY', 'PERSONAL-UID']
check_result = True

for key in required_keys:
    if key in config:
        print(f'key "{key}" 存在：{config[key]}')
    else:
        print(f'key "{key}" 不存在：失败...')
        check_result = False

python

headers = {
    'Content-Type': 'application/json',
    'Accept': 'application/json',
    'x-hag-trace-id': trace_id,
    'x-api-key': config['PERSONAL-API-KEY'],
    'x-request-from': 'openclaw',
    'x-uid': config['PERSONAL-UID'],
    'x-skill-id': 'hiboard_today_task',
    'x-prd-pkg-name': 'com.huawei.hag',
    "x-trace-id": trace_id
}

logger.debug(f"请求头: {headers}")

Technical Analysis

The credential validation loop prints the complete value of every required credential, including PERSONAL-API-KEY and PERSONAL-UID. These values are reusable authentication data rather than harmless presence indicators.

The complete HTTP header dictionary is also submitted to the debug logger. Because that dictionary contains both x-api-key and x-uid, enabling or capturing debug output may persist the same credentials in log aggregation systems, terminal history, CI output, support bundles, or other monitoring infrastructure.

Secret values must not be written to output channels. Logging full authentication headers violates the principle of minimizing secret exposure and expands access to credentials beyond the component that needs them.

Attack Path

1. A legitimate user or automated process executes a task push.
2. The client reads PERSONAL-API-KEY and PERSONAL-UID from /home/sandbox/.openclaw/.xiaoyienv.
3. The credential valida ...[truncated 1068 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all output that includes credential values. Report only whether each required key is present.
2. Never log complete request headers. Create an explicit redaction function that replaces values for x-api-key, x-uid, authorization headers, cookies, and tokens with a fixed marker such as [REDACTED].
3. Use structured logging with an allowlist of non-sensitive fields rather than serializing entire dictionaries.
4. Ensure production logging cannot be changed to a secret-bearing debug mode without appropriate access controls.
5. Restrict access to console logs and local log files using least-privilege filesystem permissions.
6. Rotate any API credentials that have been used with the affected implementation because existing terminal or log captures may already contain them.
7. Add automated tests that fail if known secret field names or test credential values appear in captured output.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/task_pusher.py:225

Finding

Documented Record-Storage and Retention Controls Are Not Enforced

Content

View full analysis

Vulnerability Details

File Location: scripts/task_pusher.py:225-227 and scripts/task_pusher.py:322-330; related controls are defined at scripts/config.py:65-73 and scripts/config.py:95-108
Vulnerability Type: Uncontrolled local retention of potentially sensitive response data
Risk Level: Medium

Vulnerable Code

python

# Create the success response
response = self._create_success_response(
    task_data, push_data, record_id, start_time,
    hiboards_response
)

# Save the push record
self._save_push_record(response, record_id)

return response

python

def _save_push_record(self, response: Dict[str, Any], record_id: str):
    """保存推送记录"""
    try:
        records_dir = os.path.join(os.path.dirname(__file__), '..', 'push_records')
        os.makedirs(records_dir, exist_ok=True)

        record_file = os.path.join(records_dir, f"{record_id}.json")
        with open(record_file, 'w', encoding='utf-8') as f:
            json.dump(response, f, ensure_ascii=False, indent=2)
        logger.info(f"[INFO] 推送记录已保存: {record_file}")
    except Exception as e:
        logger.warning(f"保存推送记录失败: {str(e)}")

python

defaults = {
    'timeout': 30,
    'max_content_length': 5000,
    'auto_generate_id': True,
    'default_result': '任务已完成',
    'log_level': 'INFO',
    'save_records': True,
    'records_dir': 'push_records',
    'max_records': 100
}

Technical Analysis

The configuration exposes save_records, records_dir, and max_records as privacy and retention controls. However, the successful push path invokes _save_push_record unconditionally.

The record-writing function also hard-codes the push_records directory instead of using self.config.records_dir, and it does not enforce self.config.max_records. Consequently:

• Setting save_records to false does not disable storage.
• Selecting a different record directory has n ...[truncated 1641 chars]

Remediation

View remediation

Remediation Suggestions

1. Check self.config.save_records before invoking _save_push_record.
2. Use self.config.records_dir rather than a hard-coded directory.
3. Resolve the configured directory to a canonical path and apply an explicit policy for whether paths outside the project data directory are permitted.
4. Enforce self.config.max_records after each successful write by securely deleting the oldest excess records.
5. Define behavior for zero, negative, malformed, or excessively large retention values.
6. Persist only fields required for auditing. Exclude or redact tokens, credentials, personal identifiers, and unnecessary remote response fields.
7. Create record files with restrictive permissions appropriate to the operating system.
8. Document the precise data stored, retention policy, directory location, and cleanup behavior.
9. Add tests confirming that disabled storage creates no files and that the configured maximum is never exceeded.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create_task_json.py:14

Finding

Task Name Allows Path Traversal and Arbitrary JSON File Overwrite

Content

View full analysis

Vulnerability Details

File Location: scripts/create_task_json.py:14-15 and scripts/create_task_json.py:35-42
Vulnerability Type: Path traversal through an unsanitized output filename
Risk Level: Medium

Vulnerable Code

python

name = sys.argv[1]
filepath = sys.argv[2]

python

# 生成文件名
timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
output = f"{name}_{timestamp}.json"

# 保存文件
try:
    with open(output, 'w', encoding='utf-8') as f:
        json.dump(data, f, ensure_ascii=False, indent=2)
    print(f"[SUCCESS] 已创建: {output}")
    print(f"[INFO] 使用命令: python task_push.py --data {output}")
except Exception as e:
    print(f"[ERROR] 保存JSON文件失败: {e}")
    sys.exit(1)

Technical Analysis

The task name is accepted directly from the command line and interpolated into the output path without sanitization or containment checks. A task name may therefore contain:

• Parent-directory components such as ../
• Absolute path prefixes
• Platform-specific path separators
• Names targeting existing writable files

Python's open function interprets the resulting value as a filesystem path rather than a simple filename. Opening the path with mode w creates the file or truncates an existing file before writing JSON.

The timestamp suffix limits which exact filename can be selected, but it does not prevent writing outside the intended working directory. If an attacker can predict the timestamp or target a naming pattern consumed by another component, the overwrite behavior can also be security-relevant.

Attack Path

1. An attacker controls or influences the task name passed to the documented JSON creation helper.
2. The attacker supplies a name containing directory traversal, such as ../../writable-directory/task.
3. The script appends the timestamp and .json suffix but preserves the traversal components.
4. open(output, 'w') resolves the traversal and wr ...[truncated 901 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat the task name as display data, not as a filesystem path.
2. Convert it to a safe filename by allowing only a restricted character set and replacing all other characters.
3. Explicitly reject /, \, .., absolute paths, drive prefixes, null characters, and platform-specific reserved names.
4. Write files beneath a fixed, application-controlled output directory.
5. Resolve the final path with Path.resolve() and verify that it remains a descendant of the approved output directory before opening it.
6. Use exclusive creation mode, such as x, when overwriting existing files is not required.
7. Apply restrictive file permissions and avoid writing into directories controlled by less-trusted users.
8. Add tests covering absolute paths, nested traversal, mixed separators, symbolic-link edge cases, and reserved filenames.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill claims result-push functionality but also appears to perform undeclared local file writes such as creating logs. Undeclared persistence is risky because task contents or operational metadata may be retained on disk without user awareness, expanding the privacy and forensic footprint of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill claims result-push functionality but also appears to perform undeclared local file writes such as creating logs. Undeclared persistence is risky because task contents or operational metadata may be retained on disk without user awareness, expanding the privacy and forensic footprint of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims result-push functionality but also appears to perform undeclared local file writes such as creating logs. Undeclared persistence is risky because task contents or operational metadata may be retained on disk without user awareness, expanding the privacy and forensic footprint of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill claims result-push functionality but also appears to perform undeclared local file writes such as creating logs. Undeclared persistence is risky because task contents or operational metadata may be retained on disk without user awareness, expanding the privacy and forensic footprint of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill claims result-push functionality but also appears to perform undeclared local file writes such as creating logs. Undeclared persistence is risky because task contents or operational metadata may be retained on disk without user awareness, expanding the privacy and forensic footprint of the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger includes an open-ended activation condition covering virtually any scenario where a task completes and a push might be desired. In a skill that can read credentials, write files, and transmit data externally, such broad triggering is dangerous because it increases the chance of accidental activation and unintended data disclosure.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The repeated catch-all trigger condition remains ambiguous and unconstrained. Given the skill's data-push context, this can cause over-collection and transmission of task output that the user did not specifically intend to send, especially when task contents may contain sensitive information.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code prints raw values of PERSONAL-API-KEY and PERSONAL-UID during validation. Secrets written to stdout/stderr often end up in logs, CI traces, agent transcripts, or monitoring systems, where they can be recovered and reused to impersonate the user or access associated services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README repeatedly describes pushing task results to the '负一屏' service and even references a cloud URL, but it does not prominently and explicitly warn that task content is transmitted off-device to a remote network endpoint. Because task content may contain user-generated or sensitive workflow data, insufficient disclosure can cause users to unknowingly send private information to an external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This file presents all safety instructions and operational disclosures exclusively in Chinese. Under the policy rule for natural-language violations, forcing a single language without user choice or documented justification can exclude users and violates the requirement to avoid fixed locale/language constraints.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The security documentation gives contradictory statements about whether the push endpoint is user-configurable, while the same file also states the code uses a hardcoded Huawei endpoint. This can mislead users about where task data and authentication material are sent, undermining informed consent and causing unintended exfiltration of task content to a fixed third-party service.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares no explicit tool scope or permission boundary, yet the documentation describes capabilities to read local credential files, write logs/records, and perform external network requests. This is dangerous because users and orchestrators cannot accurately constrain what the skill may access, increasing the risk of unintended data exposure or execution with broader privileges than expected.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The skill instructs users to store API credentials in a persistent plaintext file under the home directory. Persistent plaintext secret storage is dangerous because other local processes, backups, or users may access the credentials, enabling unauthorized authenticated requests to the remote service.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

Linux/Mac:

bash

mkdir -p ~/.openclaw
echo "PERSONAL-API-KEY=your_api_key_here" > ~/.openclaw/.xiaoyienv
echo "PERSONAL-UID=your_uid_here" >> ~/.openclaw/.xiaoyienv

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation contradicts itself about whether authentication is obtained from local credential files or automatically from the cloud. Conflicting security instructions are dangerous because they cause users and reviewers to misunderstand where secrets are stored and how authentication occurs, leading to insecure setup and poor incident response.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The markdown states that the default service provider is Huawei Cloud and specifies a geographic location in China Dongguan, but does not present this as an explicit user choice in the activation/usage flow. For a general-purpose task push skill, fixing destination region/service in natural-language documentation without opt-in can violate locale policy expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation claims endpoint configurability in some places while the manifest says the push URL is hardcoded. This is dangerous because users may believe they can redirect data to a trusted endpoint when in fact task content may always be sent to a fixed remote host, defeating data-governance expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Later sections contradict the earlier local-credential requirement by stating the cloud handles authentication automatically. This inconsistency is dangerous because it can cause users to place secrets locally without proper caution or, conversely, assume no local secret handling exists when it actually does.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The security guide advertises custom endpoints and dry-run/validate-only modes that conflict with earlier sections. This is dangerous because reviewers and users may rely on non-existent safety controls, assuming they can test or constrain transmission when actual behavior may still perform real network operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The configuration hard-codes a Chinese-language default response via default_result: "任务已完成". This creates a language/locale policy concern because the skill appears to impose a specific output language without offering the user a choice or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This Python file contains user-facing natural-language descriptions entirely in Chinese and specifically states it is adapted for a particular skill variant, but nowhere offers the user a language/locale option. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The client unconditionally reads credentials from a fixed local path and uses them to authenticate outbound requests, even though this behavior is not surfaced by the skill description. This creates a hidden credential-access and identity-binding capability: any caller of push() can cause data to be sent under the local user's account, and the code also prints whether sensitive keys exist, increasing exposure around secret handling.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The skill transmits caller-provided push_data plus user/account identifiers to an external cloud endpoint. External transmission is expected for a push client, but in this implementation it becomes security-relevant because the destination is hardcoded, the account context is injected from local credentials, and there are insufficient guardrails around what data may be exfiltrated.

Content

Scanner excerpt · scripts/hiboards_client.py (reported line 142)May include surrounding context.

python

# 发送请求
            # 使用json参数，requests会自动处理编码
            response = requests.post(
                url, 
                json=wrapped_data, 
                headers=headers,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The logger persists task metadata and a masked portion of the authorization code to disk, which can expose sensitive operational data to local users, support personnel, backups, or log aggregation systems. In this skill context, task results may contain user or workflow data, so persistent logging increases confidentiality risk even if the auth code is only partially shown.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file contains natural-language strings that define the skill’s interface and usage entirely in Chinese, including the module docstring and later CLI/help output. Under the policy, forcing a specific language without giving the user a language or locale choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file's docstrings, logs, printed output, and user-facing messages are consistently in Chinese, with no indication that another language can be selected. Under the language/locale policy, forcing a single language without user opt-in is a natural-language policy concern unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.