Security audit

Unified News

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent news-push tool, but it needs Review because it documents an indefinite Feishu cron push without clear stop, expiry, or per-send confirmation controls.

Use this only if you intentionally want automated news delivery to Feishu. Before enabling the cron task, verify the bot account and recipient, add your own expiry or removal procedure, and consider using on-demand runs if you do not want recurring external requests and messages. Expect it to call external news sources and update memory/news-sent.md for deduplication.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

Location: SKILL.md:62
Finding: Unbounded Persistent News-Push Scheduled Task
Content: View full analysis
\ --to \ --session isolated \ --announce ``` ### Technical Analysis The documented command creates a scheduled task that survives the Skill invocation and starts an isolated Agent session every four hours. Each execution performs external network requests, processes remotely supplied news content, sends a message through Feishu, and modifies the local `memory/news-sent.md` state file. The task has no expiration, maximum execution count, per-execution approval gate, or documented deletion command. Consequently, once installed, it may continue operating indefinitely under the permissions of the configured OpenClaw environment and Feishu account. Although the scheduled news delivery is related to the Skill's stated function, the lack of lifecycle controls creates a persistence risk. Remotely retrieved news is also repeatedly introduced into unattended Agent sessions. If the upstream service or returned content is compromised, manipulated content could be processed on every scheduled execution. The reviewed files do not contain a remote-code execution mechanism, so this concern is limited to persistent processing and messaging within the Agent's available capabilities. ### Attack Path 1. A user follows the cron configuration instructions in `SKILL.md`. 2. OpenClaw registers a persistent scheduled task that runs every four hours. 3. Each scheduled invocation creates an isolated Agent ...[truncated 1298 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger condition is overly broad, activating on generic terms like '新闻', '资讯', or '热点'. This can cause unintended invocation in unrelated conversations, leading to unnecessary external requests, unexpected message sending behavior, and increased risk of data exposure through downstream actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The description and invocation guidance are written to operate in Chinese, and the example outputs and scheduled message content are also fixed in Chinese. There is no indication that users can choose another language or that the Chinese-only behavior is a documented regional requirement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to send content to Feishu, including via scheduled automation, without an explicit warning or consent step for outbound transmission. In context, this is more dangerous because the skill also reads local memory and aggregates content, so unintended activation could exfiltrate derived or user-linked information to an external channel.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.