Security audit

智能记账本

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese-language local expense tracker that stores entries in a local JSON file; packaging has cleanup issues, but no hidden exfiltration or unsafe behavior was found.

Install only if you are comfortable with a Chinese-language expense tracker keeping your spending history in a plaintext local data.json file. Consider removing sample data, protecting the skill directory on shared machines, and preferring a fixed or removed @openclaw/sdk dependency before production use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:75
Finding: Unnecessary and Unpinned Third-Party SDK Dependency Expands the Supply-Chain Attack Surface## Vulnerability Details **File Location**: `SKILL.md:75-77`, `clawhub-manifest.json:27-29`, `skill.json:10-12` **Vulnerability Type**: Unnecessary third-party dependency with a mutable version range **Risk Level**: Medium ### Vulnerable Code `SKILL.md:75-77` ```bash # Install dependencies npm install @openclaw/sdk ``` `clawhub-manifest.json:27-29` ```json "dependencies": { "@openclaw/sdk": "^2026.3.2" }, ``` `skill.json:10-12` ```json "dependencies": { "@openclaw/sdk": "^2026.3.2" } ``` ### Technical Analysis The project instructs users to install `@openclaw/sdk` and declares it with the caret range `^2026.3.2`. However, the executable implementation never imports this package. Instead, `index.js:1-8` defines a local SDK simulation, and its only actual imports at `index.js:10-11` are the built-in Node.js `fs` and `path` modules. The unused dependency unnecessarily enlarges the package's software supply chain. The caret range permits npm to resolve later semantically compatible releases that were not necessarily included in the reviewed artifact. It may also resolve transitive dependencies. If the package, a permitted future version, or one of its transitive dependencies becomes compromised, package installation could introduce attacker-controlled code. This audit found no evidence that the currently declared SDK is malicious. The risk arises from requiring an unnecessary, externally maintained, and non-exact dependency. ### Attack Path 1. A user follows the installation instructions in `SKILL.md` or installs the skill through tooling that processes its dependency manifest. 2. npm resolves `@openclaw/sdk` using the mutable `^2026.3.2` range, together with any transitive dependencies. 3. A compromised compatible release or transitive package is selected. 4. If the compromised package defines an installation lifecycle script, npm may execute it with the privileges of the user performing t ...[truncated 728 chars]
Remediation: ## Remediation Suggestions 1. Remove `@openclaw/sdk` from `clawhub-manifest.json` and `skill.json`, and remove the corresponding `npm install` instruction, because the current implementation does not use the package. 2. If SDK integration is required, import and use only the necessary API rather than retaining both a local simulation and an external dependency. 3. Pin the dependency to an audited exact version instead of using a caret range. 4. Commit a valid npm lockfile containing resolved versions and integrity hashes. 5. Review direct and transitive dependencies with automated vulnerability and provenance checks before publication. 6. Where operationally appropriate, install dependencies with lifecycle scripts disabled and explicitly allow only reviewed packages that require installation scripts. 7. Correct the missing comma after the version field in `skill.json` so security and installation tooling can parse the manifest reliably.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The description says the skill supports Chinese natural-language input and all examples and headings are in Chinese, but it does not indicate whether other languages are supported or that Chinese is an intentional locale-specific limitation. This can violate a language/locale policy when a skill implicitly forces one language without user opt-in.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill states that financial data is stored in a local JSON file but does not clearly warn users that sensitive expense records will persist on disk. Financial records can reveal habits, locations, and personal circumstances; if users assume the data is transient, this creates a privacy and data-exposure risk, especially on shared or unmanaged systems.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The usage examples present generic triggers such as “记录”, “添加”, “查询”, “统计”, “列表”, and “明细” without documenting when they should invoke this skill versus other skills. These verbs are common in everyday assistant interactions and, without exclusion conditions or a fixed invocation format, could cause unintended activation collisions.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The manifest description, tags, category, keywords, and embedded README consistently present the skill only in Chinese and the usage examples explicitly state it supports Chinese input. There is no indication that users can choose another language or that the Chinese-only scope is a documented regional constraint, which creates a locale policy concern.

Natural-Language Policy Violations

Medium

Confidence: 86% confidence
Finding: This JSON data uses Chinese-only category and description values such as "餐饮" and "记账：今天午饭花了" with no indication that language selection is optional. Under the policy, locale or language constraints should not be forced unless the skill offers user choice or clearly documents a justified region-specific limitation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill persists potentially sensitive expense records, including descriptions and dates, to a local JSON file without any disclosure, consent flow, retention controls, or access protections. Financial spending history can reveal private habits and health-related information, so silent local storage increases privacy risk, especially on shared systems or insecure deployments.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The parsing logic and user interaction strings are hard-coded for Chinese phrases and the Chinese currency suffix 元, so the skill only works for Chinese-language requests. There is no indication that the user can choose language/locale or that the Chinese-only constraint is explicitly documented as a justified regional limitation.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The command recognition for adding, querying, and listing expenses depends entirely on Chinese trigger terms such as 记账, 查询, 统计, 列表, and 明细. This enforces a specific language for operation without any opt-in, fallback, or documented locale policy exception.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The script's console messages and example inputs are entirely in Chinese, which imposes a specific language on users without any indication of opt-in or locale selection. This matches the policy concern for language or locale restrictions expressed in natural-language strings within code.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The manifest description is written only in Chinese and presents the skill as Chinese-language by default. Per the policy, forcing a specific language without user opt-in or documented locale justification is a natural-language policy concern.

Static analysis

No suspicious patterns detected.