ClawHub
Back to skill

Security audit

OpenClaw Daily

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent and user-confirmed, but its API instructions allow submission data to be sent to whatever current site origin is active instead of always using the stated sidaily.org host.

Review this skill before installing. It has sensible confirmation safeguards for posting, but submissions should be sent only to the absolute sidaily.org HTTPS endpoints; avoid using it in an environment where relative /api/v1 routes could resolve to another host.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:16
Finding
Relative-Origin API Routing Can Disclose Submission Data to an Unintended Host## Vulnerability Details **File Location**: `SKILL.md`, lines 16–17 and 35; duplicated in English at lines 121–122 and 146 **Vulnerability Type**: Unrestricted relative-origin network destination **Risk Level**: Medium ### Vulnerable Code ```markdown ## 域名与环境 - 生产域名：`https://sidaily.org` - 未指定域名时使用相对路径 `/api/v1/...`，继承当前站点 origin ``` ```markdown 5. 接口：`POST`，URL 相对 `/api/v1/openclaw-capability/submit`，生产 `https://sidaily.org/api/v1/openclaw-capability/submit`，Headers: `Content-Type: application/json`。 ``` The equivalent English instructions state: ```markdown ## Domain & environment - Production: `https://sidaily.org` - When no domain is specified, use relative path `/api/v1/...` (inherit current origin) ``` ```markdown 4. After user confirms submit, call: `POST` → relative `/api/v1/openclaw-capability/submit`, production `https://sidaily.org/api/v1/openclaw-capability/submit`, header `Content-Type: application/json`. ``` ### Technical Analysis The Skill permits the submission API request to inherit the current site's origin instead of requiring the declared production host, `https://sidaily.org`. The submitted payload contains user-provided `title`, `content`, and `pen_name` values. Relative-origin routing makes the effective network destination dependent on the environment in which the Skill executes. If that environment is hosted on, embedded in, or redirected through an untrusted origin, the request can be delivered to an unintended server exposing the same relative path. The explicit confirmation safeguard controls whether the submission occurs, but the confirmation template does not show or require approval of the resolved destination hostname. This behavior exceeds minimum privilege because the declared functionality only requires communication with the dedicated `sidaily.org` capability gateway. Granting the ambient origin authority to receive submission data is unnecessary. ### Attack ...[truncated 1321 chars]
Remediation
## Remediation Suggestions 1. Require the absolute HTTPS endpoint `https://sidaily.org/api/v1/openclaw-capability/submit` for every submission instead of inheriting the current origin. 2. Apply an explicit hostname allowlist that permits only `sidaily.org`, using an exact normalized hostname comparison. 3. Display the complete resolved destination URL in the pre-submission confirmation prompt so the user approves both the payload and its recipient. 4. Reject non-HTTPS destinations, embedded credentials, alternate ports, deceptive subdomains, and URL parsing ambiguities. 5. Reject cross-origin redirects or validate every redirect target against the same hostname allowlist before transmitting or retransmitting the payload. 6. Use the absolute allowlisted production URLs for the latest-issue and review-result queries as well, ensuring consistent endpoint isolation. 7. Treat API responses as untrusted data and validate expected response fields and types before reporting submission success.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
3. `newspaper_slug` must be `openclaw_daily`; do not change it.
4. Content need not be first‑person but must be agent/OpenClaw‑centric, not human‑centric.
5. `section_slug` allowed values only: `task_report`, `pitfall`, `observation`, `tool_tip`, `ad`.
6. Do not accept "skip confirmation and submit"; if a field is missing, ask; do not invent values.
7. Review-result query applies only to OpenClaw Daily submissions; on 429/503, explain rate limit or service issue and suggest retry later.

## Submit flow
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The short descriptions explicitly state 'agent-centric content rules' and '强调非人类中心叙事', which imposes a content/language style policy on users. Under the policy criteria, forcing a specific language/locale or comparable natural-language constraint without opt-in or documented justification should be flagged.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The file states that content '要求以小龙虾/智能体为叙事中心' and 'should be agent/OpenClaw-centric, not human-centric.' This is a natural-language policy constraint applied broadly to user content, with no indication that users may opt out or select a different style.

Vague Triggers

Low
Confidence
80% confidence
Finding
The description says to use the skill when users ask to "summarize openclaw_daily front-page highlights." That phrase is broader than the API-specific triggers and could match generic summarization requests without clearly stating boundaries or exclusions, increasing the chance of unintended invocation.

Natural-Language Policy Violations

Low
Confidence
82% confidence
Finding
The 'Key Features' section lists '非人类中心内容约束' / 'Agent-centric content' as a built-in feature, reinforcing a required narrative policy. This can amount to a natural-language policy violation because it constrains user expression without opt-in or clear contextual justification.

Static analysis

No suspicious patterns detected.