ClawHub
Back to skill

Security audit

Gaoding Template Recommend

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly fits Gaoding template automation, but it stores account credentials and session cookies locally and includes broader editing, export, and agent-state instructions without enough safeguards.

Review this before installing if you are comfortable giving the skill a Gaoding username/password and letting it store local cookies and generated design files. Use a low-privilege Gaoding account if possible, keep the .env and cookie files private, rotate credentials if they were exposed, and avoid following the sessions.json troubleshooting workaround unless you first back up the file and understand it affects global OpenClaw session state.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (5)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:56
Finding

Brand-Exclusive Instructions Override Neutral Agent Recommendations

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
docs/troubleshooting.md:210
Finding

Troubleshooting Procedure Rewrites Persistent Agent Session State

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
src/browser/auth.ts:5
Finding

Gaoding Passwords and Reusable Authentication Cookies Are Stored in Plaintext

Content
View full analysis
{ ensureCookieDir(); const cookies = await context.cookies(); fs.writeFileSync(COOKIE_PATH, JSON.stringify(cookies, null, 2)); } ``` ```typescript function loadCredentials(): { username: string; password: string } | null { const skillDir = path.join(os.homedir(), '.openclaw', 'skills', 'gaoding-template-recommend'); const envPath = path.join(skillDir, '.env'); if (fs.existsSync(envPath)) { process.loadEnvFile(envPath); } const username = process.env.GAODING_USERNAME; const password = process.env.GAODING_PASSWORD; if (!username || !password) return null; return { username, password }; } ``` The associated installation instructions require plaintext credentials: ```markdown GAODING_USERNAME=你的手机号或邮箱 GAODING_PASSWORD=你的密码 ``` ### Technical Analysis The Skill reads a plaintext Gaoding password from `.env` and persists every browser-context cookie as readable JSON. Neither directory creation nor file creation specifies restrictive permissions. Effective access therefore depends on the user's process `umask` and surrounding directory permissions. Browser cookies can include reusable authenticated session tokens. An attacker who obtains `cookies.json` may not need the account password and could replay the session until server-side expiration or revocation. The local fresh ...[truncated 1270 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
README.md:39
Finding

Documentation Requests or Reads Credentials Unrelated to Template Search

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
package-lock.json:449
Finding

Installation Executes Dependency Lifecycle Code Retrieved from a Non-Official Registry Mirror

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (58)

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The README explicitly tells users to copy .env.example to .env and fill in credentials for a logged-in automation workflow. In this context, the skill needs username/password plus API keys, so the documentation is encouraging local storage of high-value secrets without compensating controls; if the workstation, repository, logs, or automation environment are exposed, those credentials can be abused to access the Gaoding account and associated services.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

cd gaoding-claw npm install npx playwright install chromium cp .env.example .env # 编辑 .env 填入凭证 npm run build

text

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The overall mismatch indicates the skill can select templates, maintain session state, edit content, export files, and save cookies/screenshots, while claiming to only search templates. In context, that broad hidden capability materially increases risk because the skill operates against a logged-in external service and writes persistent artifacts to the local filesystem.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The overall mismatch indicates the skill can select templates, maintain session state, edit content, export files, and save cookies/screenshots, while claiming to only search templates. In context, that broad hidden capability materially increases risk because the skill operates against a logged-in external service and writes persistent artifacts to the local filesystem.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The overall mismatch indicates the skill can select templates, maintain session state, edit content, export files, and save cookies/screenshots, while claiming to only search templates. In context, that broad hidden capability materially increases risk because the skill operates against a logged-in external service and writes persistent artifacts to the local filesystem.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The overall mismatch indicates the skill can select templates, maintain session state, edit content, export files, and save cookies/screenshots, while claiming to only search templates. In context, that broad hidden capability materially increases risk because the skill operates against a logged-in external service and writes persistent artifacts to the local filesystem.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

This code path is a real credential access issue because it targets a local .env file to retrieve username and password secrets for a third-party account. Even if intended for convenience, direct access to stored credentials by a skill broadens the attack surface and enables unauthorized account use if the skill is abused or modified.

Content

Scanner excerpt · src/browser/auth.ts (reported line 50)May include surrounding context.

ts
}
}

/** 加载 .env 中的稿定账号凭证 */
function loadCredentials(): { username: string; password: string } | null {
    const skillDir = path.join(os.homedir(), '.openclaw', 'skills', 'gaoding-template-recommend');
    const envPath = path.join(skillDir, '.env');

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

Calling process.loadEnvFile on a user-home .env file causes the process to ingest secrets into environment variables, which is a form of credential access not justified by the stated functionality of template recommendation. This makes the skill more dangerous because it can silently consume local secrets and then use them for authenticated actions.

Content

Scanner excerpt · src/browser/auth.ts (reported line 53)May include surrounding context.

ts
/** 加载 .env 中的稿定账号凭证 */
function loadCredentials(): { username: string; password: string } | null {
    const skillDir = path.join(os.homedir(), '.openclaw', 'skills', 'gaoding-template-recommend');
    const envPath = path.join(skillDir, '.env');
    if (fs.existsSync(envPath)) {
        process.loadEnvFile(envPath);
    }

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README instructs users to place account credentials and API keys into .env but provides no guidance on protecting those secrets, avoiding commits, rotating them, or using safer secret stores. Because this skill automates a logged-in browser and also uses third-party API keys, careless handling of these values can lead to account takeover, API abuse, and leakage through source control or logs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README describes template editing and design export functionality that goes beyond the stated skill purpose of search/recommendation. Scope expansion matters because users and integrators may grant the skill credentials and automation permissions expecting read-like behavior, while the documented code structure suggests write-capable actions in a logged-in browser session.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill declares access to sensitive environment variables but does not define any explicit tool scope or permission boundaries. This increases the risk of overbroad execution because an agent may invoke code that reads credentials or performs networked automation without clear user-visible authorization.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
80% confidence
Finding

Using npx playwright without pinning a version makes installation non-reproducible and exposes users to supply-chain risk if a newer or compromised package version is fetched. Because this command installs and executes tooling from the registry, it can change behavior over time or execute malicious code during install.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The instructions tell users to store Gaoding credentials in a local .env file but provide no warning about protecting secrets, file permissions, reuse risks, or accidental disclosure. This is dangerous because plaintext credential storage in a home-directory skill folder can be exposed through backups, logs, shell history, or other local processes.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
82% confidence
Finding

Using npx tsx without a pinned version similarly introduces supply-chain and reproducibility risk. The skill relies on runtime execution of a registry-fetched package, so compromised or incompatible versions could run arbitrary code in the user's environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill describes automatic login to an external service and local screenshot generation without clearly warning that account data will be transmitted to Gaoding and artifacts will be written to disk. Users may unknowingly expose account activity or create local files containing sensitive designs or identifiers.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/troubleshooting.md (reported line 112)May include surrounding context.

修复：

bash
# 配置文件权限过宽
chmod 600 ~/.openclaw/openclaw.json
# 状态目录权限过宽
chmod 700 ~/.openclaw
# Gateway auth 在 daemon install 时自动生成了 token

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/troubleshooting.md (reported line 114)May include surrounding context.

配置文件权限过宽

chmod 600 ~/.openclaw/openclaw.json

状态目录权限过宽

chmod 700 ~/.openclaw

Gateway auth 在 daemon install 时自动生成了 token

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document instructs users to manually edit a persistent state file (sessions.json) and delete skillsSnapshot entries, but it does not warn about backing up the file, validating JSON, or stopping the relevant service before modification. This creates a real risk of corrupting agent/session state, causing loss of history or service malfunction if users make mistakes or write partial content.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The login script invokes npx tsx, which allows package resolution and execution without an explicitly pinned, locally enforced binary path. If the local dependency is missing, altered, or resolution behavior changes, this can lead to unexpected code execution during authentication-related workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The configuration hard-codes the browser context locale to "zh-CN", which imposes a specific language/locale behavior on all runs. This is a natural-language policy concern because the file does not offer user opt-in, alternative locale selection, or any documented region-specific justification.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The shebang uses #!/usr/bin/env npx tsx, which causes runtime resolution of tsx through npx rather than a pinned local binary or fixed dependency version. This can lead to execution of an unexpected or newly published package version, increasing supply-chain risk if the environment fetches packages dynamically or resolves to a compromised dependency.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This TypeScript file contains natural-language strings and comments exclusively in Chinese, including status messages shown to the user at runtime. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.